You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Marcin Mirosław <ma...@mejor.pl> on 2014/02/24 16:10:46 UTC
How the rules __TO_EQ_FROM_1 __TO_EQ_FROM_2 work?
Hi!
Sorry for silly question. I'd like to know if mentioned rules catches
all email address or only user part?
I'd like to catch such spam:
From: Charlene Torres <za...@johnnywinslow.com>
To: zawodynn <za...@bielin.pl>
Where user part in header From: and To: is the same (and SPF_FAIL and
SPF_SOFTFAIL etc). My tests shows that __TO_EQ_FROM doesn't catch it.
If rules catches all email I'd like to vote for creating rule for
caching pasted example:)
Marcin
Re: How the rules __TO_EQ_FROM_1 __TO_EQ_FROM_2 work?
Posted by John Hardin <jh...@impsec.org>.
On Thu, 27 Mar 2014, Joe Quinn wrote:
> On 3/27/2014 12:34 PM, Marcin Mirosław wrote:
>> W dniu 24.02.2014 16:24, John Hardin pisze:
>> Hi!
>>
>> > On Mon, 24 Feb 2014, Marcin Mirosław wrote:
>> >
>> > > Sorry for silly question. I'd like to know if mentioned rules catches
>> > > all email address or only user part?
>> > It's not a silly question. All of the TO_EQ_FROM rules compare the full
>> > email address.
>> In theory I could it by self, it's only one line of code:) But I'm not
>> so good in regexp to do it.
>>
> A better idea would probably be to turn it into a plugin. Those regexes are
> multi-line, very complex, and the fact that there are multiple of them with
> only minor differences is a maintenance nightmare.
What would be very welcome is a way to capture a match in one rule and use
that match in a different rule.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Show me somebody who waxes poetic about "Being at one with Nature"
and I'll show you someone who hasn't figured out that Nature is an
infinite stomach demanding to be fed. -- Atomic, at Wapsi forum
-----------------------------------------------------------------------
5 days until April Fools' day
Re: How the rules __TO_EQ_FROM_1 __TO_EQ_FROM_2 work?
Posted by Joe Quinn <jq...@pccc.com>.
On 3/27/2014 12:34 PM, Marcin Mirosław wrote:
> W dniu 24.02.2014 16:24, John Hardin pisze:
> Hi!
>
>> On Mon, 24 Feb 2014, Marcin Mirosław wrote:
>>
>>> Sorry for silly question. I'd like to know if mentioned rules catches
>>> all email address or only user part?
>> It's not a silly question. All of the TO_EQ_FROM rules compare the full
>> email address.
> In theory I could it by self, it's only one line of code:) But I'm not
> so good in regexp to do it.
>
> Regards,
> Marcin
A better idea would probably be to turn it into a plugin. Those regexes
are multi-line, very complex, and the fact that there are multiple of
them with only minor differences is a maintenance nightmare.
Re: How the rules __TO_EQ_FROM_1 __TO_EQ_FROM_2 work?
Posted by John Hardin <jh...@impsec.org>.
On Thu, 27 Mar 2014, Marcin Mirosław wrote:
> W dniu 24.02.2014 16:24, John Hardin pisze:
>> On Mon, 24 Feb 2014, Marcin Mirosław wrote:
>>
>>> Sorry for silly question. I'd like to know if mentioned rules catches
>>> all email address or only user part?
>>
>> It's not a silly question. All of the TO_EQ_FROM rules compare the full
>> email address.
>
> In theory I could it by self, it's only one line of code:) But I'm not
> so good in regexp to do it.
These rules compare the All pseudo-header since we want to check whether
two different headers contain the same value.
One is for the case where the From: header precedes the To: header. This
is the simpler case. It matches and captures the email address that
appears in the From: header. (Note that the ":addr" option isn't available
for the All pseudo-header so we need to pick out the address part
explicitly.) We then look for the captured string in the To: header.
The other is for the reverse, where the To: header precedes the From:
header. Since the To: header can contain multiple addresses, this one is
less optimal, but it essentially does the same thing: matches and captures
the (first) email address in the To: header and looks for that string in
the From: header.
One possible improvement would be to add a third version that gets the
envelope recipient address in a Received: header, similar to what
__SUBJ_HAS_TO_2 does, and checks for that in the From: header. I will
probably add that shortly.
If you wanted to compare parts of the address you'd have to modify the
part that matches the address; for example to match just the username part
you'd change the capture expression from ([^\n\s>]+) to ([^\s\n>\@]+) and
the match expression from \1[>,\s\n] to \1[\@]
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
My sidearm is a piece of emergency equipment. It absolutely must
be reliable, not "smart".
-----------------------------------------------------------------------
5 days until April Fools' day
Re: How the rules __TO_EQ_FROM_1 __TO_EQ_FROM_2 work?
Posted by Marcin Mirosław <ma...@mejor.pl>.
W dniu 24.02.2014 16:24, John Hardin pisze:
Hi!
> On Mon, 24 Feb 2014, Marcin Mirosław wrote:
>
>> Sorry for silly question. I'd like to know if mentioned rules catches
>> all email address or only user part?
>
> It's not a silly question. All of the TO_EQ_FROM rules compare the full
> email address.
In theory I could it by self, it's only one line of code:) But I'm not
so good in regexp to do it.
Regards,
Marcin
Re: How the rules __TO_EQ_FROM_1 __TO_EQ_FROM_2 work?
Posted by Benny Pedersen <me...@junc.eu>.
On 2014-02-24 16:24, John Hardin wrote:
>> From: Charlene Torres <za...@johnnywinslow.com>
>> To: zawodynn <za...@bielin.pl>
> I will take a look at it. Thanks for the suggestion.
i have seen samples with local part being used as a pattern in from
padded with 2 or more chars at end of local part
Re: How the rules __TO_EQ_FROM_1 __TO_EQ_FROM_2 work?
Posted by John Hardin <jh...@impsec.org>.
On Mon, 24 Feb 2014, Marcin Mirosław wrote:
> Sorry for silly question. I'd like to know if mentioned rules catches all
> email address or only user part?
It's not a silly question. All of the TO_EQ_FROM rules compare the full
email address.
> I'd like to catch such spam:
>
> From: Charlene Torres <za...@johnnywinslow.com>
> To: zawodynn <za...@bielin.pl>
>
> Where user part in header From: and To: is the same (and SPF_FAIL and
> SPF_SOFTFAIL etc). My tests shows that __TO_EQ_FROM doesn't catch it.
> If rules catches all email I'd like to vote for creating rule for caching
> pasted example:)
I will take a look at it. Thanks for the suggestion.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Perfect Security and Absolute Safety are unattainable; beware
those who would try to sell them to you, regardless of the cost,
for they are trying to sell you your own slavery.
-----------------------------------------------------------------------
634 days since the first successful private support mission to ISS (SpaceX)