Matching X-Message-Info headers

[Jan Theofel <th...@etes.de>]

Hello,

I wanted to create a rule to match any X-Message-Info line which I only
know from spam mails. There are two questions I have about that:

1. How can I find out if a rule like this exists in spamassassin or SARE?

2. I tried adding these lines to my local.cf:

header          ETES_X_MESSAGE_INFO X-Message-Info =~ /.*/
score           ETES_X_MESSAGE_INFO 0.01

The Problem is, that this matches every message, even these which don't have
and X-Message-Info header line at all. How to fix this rule? (The content of
the X-Message-Info line is unimportant.)

Thanks in advance,
Jan Theofel

-- 
Jan Theofel                              Fon:  +49 (7 11) 48 90 83 - 0
ETES - EDV-Systemhaus GbR                Fax:  +49 (7 11) 48 90 83 - 50
Libanonstrasse 58 A * D-70184 Stuttgart  Web: http://www.etes.de

Re: Matching X-Message-Info headers

[Theo Van Dinter <fe...@kluge.net>]

On Wed, Aug 18, 2004 at 09:40:48PM +0200, Jan Theofel wrote:
> 1. How can I find out if a rule like this exists in spamassassin or SARE?

grep X-Message /whereever/you/have/the/rules/*.cf

It's in 3.0 BTW:

header X_MESSAGE_INFO            exists:X-Message-Info
score X_MESSAGE_INFO 3.600 4.187 4.162 4.244

Good rule. :)

> 2. I tried adding these lines to my local.cf:
> 
> header          ETES_X_MESSAGE_INFO X-Message-Info =~ /.*/
> score           ETES_X_MESSAGE_INFO 0.01
> 
> The Problem is, that this matches every message, even these which don't have
> and X-Message-Info header line at all. How to fix this rule? (The content of
> the X-Message-Info line is unimportant.)

Right.  You're trying to match /.*/ which will match anything,
even nothing.  In RE form, you'd want /./ which would match any single
character, but the correct way to do it in SpamAssassin is use "exists:"
since you don't actually care if there's any data in the header, you
just care if the header exists.

-- 
Randomly Generated Tagline:
"Yogi Bear went to hell in a pic-a-nic basket, NOT a handbasket..."
                      - Theo

Re: Matching X-Message-Info headers

[Robert Menschel <Ro...@Menschel.net>]

Hello Jan,

Wednesday, August 18, 2004, 12:40:48 PM, you wrote:

JT> I wanted to create a rule to match any X-Message-Info line which I
JT> only know from spam mails. There are two questions I have about that: 

JT> 1. How can I find out if a rule like this exists in spamassassin or
JT> SARE?

Theo answered this, but grep doesn't help if you don't already have the
rules.  Second method is to ask, which you kind of did.  :-)

It's currently part of a long regex in the SARE_HEAD_SPAM rule within
70_sare_header1.cf

It's being converted into an exists: rule for the next release, and will
be in a file to be used by systems not using version 2.64 or 3.0 (the
rule is part of the distribution set in those two versions).

Bob Menschel