You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2006/11/20 18:25:53 UTC
[Bug 5198] New: RCVD_FORGED_WROTE doesn't match when it should
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5198
Summary: RCVD_FORGED_WROTE doesn't match when it should
Product: Spamassassin
Version: 3.1.7
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P5
Component: Rules
AssignedTo: dev@spamassassin.apache.org
ReportedBy: dot@dotat.at
Received: from 69.80.208.30 (HELO mail.boscodog.com)
by dotat.at with esmtp (.).2),I8R07 >/-3)
id 01(4K<-<K864B-G7
for dot@dotat.at; Mon, 20 Nov 2006 16:48:11 +0180
This doesn't match because of the [A-Z0-9] at the end of RCVD_FORGED_WROTE
I suggest
header RCVD_FORGED_WROTE Received =~ /from [0-9.]+ \(HELO \S+[a-z]+\) by
(\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5198] RCVD_FORGED_WROTE doesn't match when it should
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5198
------- Additional Comments From jm@jmason.org 2006-11-20 12:34 -------
thanks, that's in as RCVD_FORGED_WROTE2 for testing.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5198] RCVD_FORGED_WROTE doesn't match when it should
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5198
------- Additional Comments From dot@dotat.at 2006-11-22 07:46 -------
Created an attachment (id=3755)
--> (http://issues.apache.org/SpamAssassin/attachment.cgi?id=3755&action=view)
example with new forged received line
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5198] RCVD_FORGED_WROTE doesn't match when it should
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5198
------- Additional Comments From dot@dotat.at 2006-11-22 11:03 -------
hmm, looks like we get occasional capitalized hostnames too
header RCVD_FORGED_WROTE Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by
(\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s
header RCVD_FORGED_WROTE3 Received =~ /from \[[0-9.]+\] \(port=\d+
helo=\S+[A-Za-z]+\) by (\S+) with asmtp id \S{6}-\S{6}-\S\S for \S+@\1;/s
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 5198] RCVD_FORGED_WROTE doesn't match when it should
Posted by bu...@bugzilla.spamassassin.org.
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5198
------- Additional Comments From dot@dotat.at 2006-11-22 07:45 -------
I've just seen another variant of this forged Received: line, so I suggest
header RCVD_FORGED_WROTE3 Received =~ /from \[[0-9.]+\] \(port=\d+
helo=\S+[a-z]+\) by (\S+) with asmtp id \S{6}-\S{6}-\S\S for \S+@\1;/s
(seems to be a bit closer to exim's layout, but still faked)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.