Broken rule FAKED_IP_IN_RCVD in spamassassin v 2.55?

[Laura Palmer <la...@hotmail.com>]

Hi. 

The FAKED_IP_IN_RCVD rule in v2.55 coming with the SuSE distribution reads:

header FAKED_IP_IN_RCVD         
Received =~ /from [-0-9a-z\._]+_\[\d+\.\d+\.\d+\.\d+\] /i

I thought this was supposed to catch lines like this:

Received: from mx249.Bluebird9.us (unknown [203.208.248.249])

which is the standard second Received line as written by Postfix (also coming
with SuSE).  The first Received line reads:

Received: from localhost (localhost [127.0.0.1])

This test is an important test (2.9 points in local configuration), but it never
gets triggered, obviously, because of the underscore following the + sign in the
rule and the paranthesis in the Received line.  I don't understand:

1. Do I misinterpret the purpose of this rule?
2. Or, is the rule written for a different MTA (like Sendmail) and it wasn't
properly adapted for Postfix?
3. ?

Can you give me an idea?  Thanks a lot.

Laura Palmer

Re: Broken rule FAKED_IP_IN_RCVD in spamassassin v 2.55?

[Matt Kettler <mk...@evi-inc.com>]

At 06:14 AM 5/26/2004, Laura Palmer wrote:
>Hi.
>
>The FAKED_IP_IN_RCVD rule in v2.55 coming with the SuSE distribution reads:

<snip>

>Can you give me an idea?  Thanks a lot.

As a side note, 2.55 is four releases behind the current version of SA 
(We're on 2.63)

That particular rule remains unchanged in 2.63, but it is a "rare hit". 
Looking at STATISTICS.txt from 2.63 one can see it's not a common hit in 
the SA corpus.

OVERALL%   SPAM%     HAM%     S/O    RANK   SCORE  NAME
   0.021   0.0316   0.0000    1.000   0.95    2.90  FAKED_IP_IN_RCVD

Yes, that's 0.0316% or 1 in 3,164 spam messages that matches it in the sa 
development corpus.

Current-spam hit rates may be even lower.

Re: Broken rule FAKED_IP_IN_RCVD in spamassassin v 2.55?

["Christopher X. Candreva" <ch...@westnet.com>]

On Wed, 26 May 2004, Laura Palmer wrote:

>
> header FAKED_IP_IN_RCVD
> Received =~ /from [-0-9a-z\._]+_\[\d+\.\d+\.\d+\.\d+\] /i
>
> I thought this was supposed to catch lines like this:
>
> Received: from mx249.Bluebird9.us (unknown [203.208.248.249])

No -- there is no '(' in the rule.  As I read it, it would only catch a line 
like

Received: from somename_203.208.248.249

Unless  _ has a meaning I don't know about, in which case it might get

Received: from somename 203.208.248.249

But it wouldn't get the Received line you posted.


==========================================================
Chris Candreva  -- chris@westnet.com -- (914) 967-7816
WestNet Internet Services of Westchester
http://www.westnet.com/