USER_IN_WHITELIST problem.

[Bug <71...@mail.primorye.ru>]

Dear users !

I`m using exim + spamd + user_prefs in mysql. All works fine.

But I found a bug, when I`m using whitelist, and header rcpt to:  have
address with character description, whitelist failed to catch it in
database. For example:

1st message:
spamd: clean message (-91.7/10.0) for test@localdomain.com:501 in 8.2 seconds, 13522829 bytes.

2nd message:
spamd: identified spam (9.2/5.0) for some text <te...@localdomain.com>:501 in 8.3 seconds, 14874071 bytes.



Where "some text" for example User Name in address book of senders
mail agent.


Mysql userpref struct:
 username | preference            | value                              | prefid
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 test     | whitelist_from        | sender@hidden.com                  | 1


 Mysql database query in sql.cf:
 user_scores_sql_custom_query SELECT preference, value FROM _TABLE_ WHERE username IN (_USERNAME_, '$GLOBAL', CONCAT(_MAILBOX_, '@' , _DOMAIN_),SUBSTRING_INDEX(_USERNAME_, '@', 1)) ORDER BY username ASC


All works fine, when address of recipient in incoming letter is canonical like test@localdomain.com
How can I fix this ?


Thanks.
Wbr,
Steve

Re[2]: USER_IN_WHITELIST problem. SOLVED

[Bug <71...@mail.primorye.ru>]

Thank you Matt!


Your letter helped me to understand my problem better.

I`m not using sa-spamc, my exim using ACL spam, that connects directly
to spamd ip/port.

My founded solution was described in Exim FAQ:

A0512:  Envelope-To: is added at delivery time, by the transport.
Therefore, the header doesn't exist at filter time. In a user filter, the values you probably
want are in $original_local_part and $original_domain. In a system filter, the complete list
of all envelope recipients is in $recipients.

Incorrect lines - commented, now working config of ACL spam looks like:


  warn  message         = X-Spam-Score: $spam_score ($spam_bar)
        spam            = $recipients
#       spam            = $h_to
  warn  message         = X-Spam-Report: $spam_report
        spam            = $recipients
#       spam            = $h_to



> Stop passing extra garbage in the -u parameter to spamc?

> The "some text" part can't legally occur in a RCPT TO: command (which is
> not a header). Did you mean are you extracting the entire contents of
> the To: header?

> spamc isn't designed to parse all that extra data off, username or
> username@domain only.

> I'd try to find a way to get the RCPT TO not the To: anyway. The To:
> header might not contain the actual recipient and isn't a useful header
> for selecting user prefs. (i.e.: posts sent to mailing lists are RCPT
> TO: you, but they are To: the list) This is precisely why SA doesn't try
> to parse the To: header and use that for selecting prefs.. It is often
> misleading.


>> But I found a bug, when I`m using whitelist, and header rcpt to:  have
>> address with character description, whitelist failed to catch it in
>> database. For example:
>>
>> 1st message:
>> spamd: clean message (-91.7/10.0) for test@localdomain.com:501 in 8.2 seconds, 13522829 bytes.
>>
>> 2nd message:
>> spamd: identified spam (9.2/5.0) for some text <te...@localdomain.com>:501 in 8.3 seconds, 14874071 bytes.


Thank you!
Wbr,
Good luck with spam fight!

Re: USER_IN_WHITELIST problem.

[Matt Kettler <mk...@verizon.net>]

Bug wrote:
> Dear users !
>
> I`m using exim + spamd + user_prefs in mysql. All works fine.
>
> But I found a bug, when I`m using whitelist, and header rcpt to:  have
> address with character description, whitelist failed to catch it in
> database. For example:
>
> 1st message:
> spamd: clean message (-91.7/10.0) for test@localdomain.com:501 in 8.2 seconds, 13522829 bytes.
>
> 2nd message:
> spamd: identified spam (9.2/5.0) for some text <te...@localdomain.com>:501 in 8.3 seconds, 14874071 bytes.
>
>
>
> Where "some text" for example User Name in address book of senders
> mail agent.
>
>
> Mysql userpref struct:
>  username | preference            | value                              | prefid
>  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>  test     | whitelist_from        | sender@hidden.com                  | 1
>
>
>  Mysql database query in sql.cf:
>  user_scores_sql_custom_query SELECT preference, value FROM _TABLE_ WHERE username IN (_USERNAME_, '$GLOBAL', CONCAT(_MAILBOX_, '@' , _DOMAIN_),SUBSTRING_INDEX(_USERNAME_, '@', 1)) ORDER BY username ASC
>
>
> All works fine, when address of recipient in incoming letter is canonical like test@localdomain.com
> How can I fix this ?
>   
Stop passing extra garbage in the -u parameter to spamc?

The "some text" part can't legally occur in a RCPT TO: command (which is
not a header). Did you mean are you extracting the entire contents of
the To: header?

spamc isn't designed to parse all that extra data off, username or
username@domain only.

I'd try to find a way to get the RCPT TO not the To: anyway. The To:
header might not contain the actual recipient and isn't a useful header
for selecting user prefs. (i.e.: posts sent to mailing lists are RCPT
TO: you, but they are To: the list) This is precisely why SA doesn't try
to parse the To: header and use that for selecting prefs.. It is often
misleading.