You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Bagnoud Thierry [ezwww.ch]" <ho...@ezwww.ch> on 2011/03/22 22:32:34 UTC
BUG : all messages rule RP_8BIT
hi,
until 21 mars 2011 after the normal cron.daily/update_spamassassin,
Spamassassin report all messages with the rule RP_8BIT
header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
describe RP_8BIT Return-Path contains 8-bit characters with high bit on
score RP_8BIT 2.8
Thanks to correct this rule.
Thierry Bagnoud
Re: BUG : all messages rule RP_8BIT
Posted by jdow <jd...@earthlink.net>.
On 2011/03/22 14:48, Lawrence @ Rogers wrote:
> On 22/03/2011 7:02 PM, Bagnoud Thierry [ezwww.ch] wrote:
>>
>> until 21 mars 2011 after the normal cron.daily/update_spamassassin,
>> Spamassassin report all messages with the rule RP_8BIT
>>
>> header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
>> describe RP_8BIT Return-Path contains 8-bit characters with high bit on
>> score RP_8BIT 2.8
>>
>> Thanks to correct this rule.
>>
>> Thierry Bagnoud
> I looked through our mail logs and don't see any such hits on our e-mail. If
> all of your e-mail is hitting this rule, I would think something before
> SpamAssassin is messing up the Return-Path (perhaps another scanner or MTA)
He is in Switzerland and is probably using character sets that do have
the 8 bit rule violated. He probably needs to set the score for RP_8BIT
to zero in a local rule file 99_local.cf. (So named so that it processes
last over all other rules. He can put other local optimzations there,
too.)
{^_^}
Re: BUG : all messages rule RP_8BIT
Posted by "Lawrence @ Rogers" <la...@nl.rogers.com>.
On 22/03/2011 7:02 PM, Bagnoud Thierry [ezwww.ch] wrote:
>
> until 21 mars 2011 after the normal cron.daily/update_spamassassin,
> Spamassassin report all messages with the rule RP_8BIT
>
> header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
> describe RP_8BIT Return-Path contains 8-bit characters with high bit on
> score RP_8BIT 2.8
>
> Thanks to correct this rule.
>
> Thierry Bagnoud
I looked through our mail logs and don't see any such hits on our
e-mail. If all of your e-mail is hitting this rule, I would think
something before SpamAssassin is messing up the Return-Path (perhaps
another scanner or MTA)
- Lawrence
Re: BUG : all messages rule RP_8BIT
Posted by René Berber <r....@computer.org>.
On 3/22/2011 6:43 PM, Steve Freegard wrote:
> I've been hit by this issue; it's nothing to do with the rule misfiring
> - it's more of a conceptual issue of how MailScanner works e.g. by
> taking the queue file and moving it from an inbound to and outbound
> spool and then forcing a delivery.
>
> In the Sendmail queue files, there is always a 'Return-Path:' header
> that is a placeholder for expansion should Sendmail be delivering the
> message to a mailer that specifies that it requires a Return-Path header
> (e.g. local/procmail etc.); however as the header is in the queue file,
> MailScanner still reads it in as a regular header and it therefore gets
> passed to SpamAssassin when the message is checked. Unfortunately the
> placeholder used by Sendmail contains a high-bit character which then
> causes this rule to fire.
Same here, sendmail + MailScanner and "RP_8BIT 1.39" seems to be a false
positive added to every message I see marked as spam, and many wouldn't
be if that point and fraction weren't added.
--
René Berber
Re: BUG : all messages rule RP_8BIT
Posted by Steve Freegard <st...@fsl.com>.
On 22/03/11 23:28, Lawrence @ Rogers wrote:
> Something is definitely off. We use SA with MailScanner, and that rule
> never hits anything (less than 1 or 2 messages in several thousand).
My guess would be that you aren't using MailScanner with Sendmail
whereas the original poster is.
I've been hit by this issue; it's nothing to do with the rule misfiring
- it's more of a conceptual issue of how MailScanner works e.g. by
taking the queue file and moving it from an inbound to and outbound
spool and then forcing a delivery.
In the Sendmail queue files, there is always a 'Return-Path:' header
that is a placeholder for expansion should Sendmail be delivering the
message to a mailer that specifies that it requires a Return-Path header
(e.g. local/procmail etc.); however as the header is in the queue file,
MailScanner still reads it in as a regular header and it therefore gets
passed to SpamAssassin when the message is checked. Unfortunately the
placeholder used by Sendmail contains a high-bit character which then
causes this rule to fire.
Regards,
Steve.
Re: BUG : all messages rule RP_8BIT
Posted by "Lawrence @ Rogers" <la...@nl.rogers.com>.
On 22/03/2011 7:21 PM, Bagnoud Thierry [ezwww.ch] wrote:
> oups, since 21 mars and not until 21 mars, excuse me bad english :-)
>
> the modification from the rule on 2011-03-21
>
> -header RP_8BIT Return-Path =~ /[^\000-\177]/
> +header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
>
> http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/mmartinec/20_misc.cf?r1=906046&r2=906045&pathrev=906046
>
>
> perhaps the MTA MailScanner is messing up the Return-Path
>
> Thierry Bagnoud
>
>> On 3/22/11 5:32 PM, Bagnoud Thierry [ezwww.ch] wrote:
>>> hi,
>>>
>>> until 21 mars 2011 after the normal cron.daily/update_spamassassin,
>>> Spamassassin report all messages with the rule RP_8BIT
>>>
>> I don't see this on any inbound email.
>>
>> what are you saying? you want the rule to be changed to the below?
>> I don;t see any difference between this rule and your proposed changes
>> except for the score.
>>
>> and, I don't recommending changing that score. leave it at 2.866 1.389
>> 2.866 1.389
>>> header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
>>> describe RP_8BIT Return-Path contains 8-bit characters with high bit on
>>> score RP_8BIT 2.8
>>>
>>> Thanks to correct this rule.
>>>
>> or are you saying that it is hitting on email that does not have the 8th
>> bit high?
>>
>> you might want to post a full email to pastbin.com and send THE LINK
>> ONLY to this group.
>>
>> are you saying its a false positive on YOUR system since you like
>> getting emails with illegal chars in the headers?
>> then add this to local.cf:
>> score RP_8BIT 0
>>
>>
>>> Thierry Bagnoud
>>>
>>
>>
>
Something is definitely off. We use SA with MailScanner, and that rule
never hits anything (less than 1 or 2 messages in several thousand).
- Lawrence
Re: BUG : all messages rule RP_8BIT
Posted by "Bagnoud Thierry [ezwww.ch]" <ho...@ezwww.ch>.
oups, since 21 mars and not until 21 mars, excuse me bad english :-)
the modification from the rule on 2011-03-21
-header RP_8BIT Return-Path =~ /[^\000-\177]/
+header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/mmartinec/20_misc.cf?r1=906046&r2=906045&pathrev=906046
perhaps the MTA MailScanner is messing up the Return-Path
Thierry Bagnoud
> On 3/22/11 5:32 PM, Bagnoud Thierry [ezwww.ch] wrote:
>> hi,
>>
>> until 21 mars 2011 after the normal cron.daily/update_spamassassin,
>> Spamassassin report all messages with the rule RP_8BIT
>>
> I don't see this on any inbound email.
>
> what are you saying? you want the rule to be changed to the below?
> I don;t see any difference between this rule and your proposed changes
> except for the score.
>
> and, I don't recommending changing that score. leave it at 2.866 1.389
> 2.866 1.389
>> header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
>> describe RP_8BIT Return-Path contains 8-bit characters with high bit on
>> score RP_8BIT 2.8
>>
>> Thanks to correct this rule.
>>
> or are you saying that it is hitting on email that does not have the 8th
> bit high?
>
> you might want to post a full email to pastbin.com and send THE LINK
> ONLY to this group.
>
> are you saying its a false positive on YOUR system since you like
> getting emails with illegal chars in the headers?
> then add this to local.cf:
> score RP_8BIT 0
>
>
>> Thierry Bagnoud
>>
>
>
Re: BUG : all messages rule RP_8BIT
Posted by Michael Scheidell <mi...@secnap.com>.
On 3/22/11 5:32 PM, Bagnoud Thierry [ezwww.ch] wrote:
> hi,
>
> until 21 mars 2011 after the normal cron.daily/update_spamassassin,
> Spamassassin report all messages with the rule RP_8BIT
>
I don't see this on any inbound email.
what are you saying? you want the rule to be changed to the below?
I don;t see any difference between this rule and your proposed changes
except for the score.
and, I don't recommending changing that score. leave it at 2.866 1.389
2.866 1.389
> header RP_8BIT Return-Path:raw =~ /[^\000-\177]/
> describe RP_8BIT Return-Path contains 8-bit characters with high bit on
> score RP_8BIT 2.8
>
> Thanks to correct this rule.
>
or are you saying that it is hitting on email that does not have the 8th
bit high?
you might want to post a full email to pastbin.com and send THE LINK
ONLY to this group.
are you saying its a false positive on YOUR system since you like
getting emails with illegal chars in the headers?
then add this to local.cf:
score RP_8BIT 0
> Thierry Bagnoud
>
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Best Intrusion Prevention Product, Networks Product Guide
* Certified SNORT Integrator
* Hot Company Award, World Executive Alliance
* Best in Email Security, 2010 Network Products Guide
* King of Spam Filters, SC Magazine
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________