Using SpamAssassin variables

[John W Mickevich <jm...@cmtonline.com>]

Hello all!

 

I am relatively new to SpamAssassin and subscribing to this group had really
helped me in understanding many of SpamAssassin's intricacies.  Thanks to
everybody who posts replies to the questions asked here.

 

Also, if this is not the proper place for me to post this question, I
apologize in advance.

 

I am in need of assistance in one area.  It does not seem to me that this
should be too difficult to do, but I can't seem to find any information so I
figured I would ask here.

 

I would like to know now to use a variable within SpamAssassin.  For
example, how would I "capture" the last name of the From header field for
use in comparisons elsewhere?  Here is a sample:

 

>>From: "Molly Owens" <de...@business-solutionsuk.com>

>>Subject: Me again Owens

 

I am sure a lot of folks have been seeing this spam coming thru lately.  I
would like to check if the last name in From (Owens) shows up in the Subject
header.  There may or may not be a better way to catch this specific
example, but being able to define a variable and use it elsewhere would be
great.  I have to assume that SpamAssassin allows for this, but I just can't
seem to figure out how to do it.  I have seen mention of eval and $1, $2,
etc, and assume they have something to do with defining or using a variable,
but I can find no specifics on how to use them.

 

Also, I am curious if using variables has a significant impact on
performance.

 

I am using SpamAssassin 2.64.  I know it is an older version, but that what
I have to work with at this time.

 

Thanks!

 

John W Mickevich

Computer Management Technologies

jm@cmtonline.com

 

Re: Using SpamAssassin variables

[Stuart Johnston <st...@ebby.com>]

John W Mickevich wrote:
> Hello all!
...
> I would like to know now to use a variable within SpamAssassin.  For 
> example, how would I “capture” the last name of the From header field 
> for use in comparisons elsewhere?  Here is a sample:
> 
>  
> 
>> >From: "Molly Owens" <de...@business-solutionsuk.com>
> 
>> >Subject: Me again Owens
> 
>  
> 
> I am sure a lot of folks have been seeing this spam coming thru lately.  
> I would like to check if the last name in From (Owens) shows up in the 
> Subject header.  There may or may not be a better way to catch this 
> specific example, but being able to define a variable and use it 
> elsewhere would be great.  I have to assume that SpamAssassin allows for 
> this, but I just can’t seem to figure out how to do it.  I have seen 
> mention of eval and $1, $2, etc, and assume they have something to do 
> with defining or using a variable, but I can find no specifics on how to 
> use them.
> 

SpamAssassin only supports captured variables within a single rule. 
This means that you have to write a single rule that matches over all 
headers.  This is not very efficient or easy to write and usually it is 
better to look for spam signs to trigger on.  If you were running a 
recent version of SA kept up to date with sa-update and SARE rules you 
would see this messages hitting on a lot more rules.

Tom Brown posted this header rule to the sare-users list yesterday that 
tries to do what you are talking about:

ALL =~ m/(?:^|\n)From: \S+ (\S+?)(?: |").*\nSubject:.*\1\n/s

>  
> 
> Also, I am curious if using variables has a significant impact on 
> performance.

Yes, using variables does impact performance.  In particular, the type 
of rules you often need to make use of variables, matching over long 
areas of text, are inefficient as well.

It would be interesting if SA added the ability to capture variable in 
one rule and match against them in another.  It would certainly have a 
negative impact on performance at least for the rules that used it.  And 
someone would have to write the code to implement it.  Could allow for 
some pretty nifty rules though.