back where I was: why is this rule misfiring?

[Vicki Brown <vl...@cfcl.com>]

What is going on here?

The rule
 header CF_NOT_FOR_ME            ToCc !~
/(?:vlb\@cfcl|vicki\.vlb\@gmail)\.com/i
 score CF_NOT_FOR_ME             0.01
 describe CF_NOT_FOR_ME          Neither To nor Cc me

The mail
Received: from moutng.kundenserver.de (moutng.kundenserver.de
[212.227.126.177])
	by cfcl.com (8.12.6/8.12.6) with ESMTP id j2MNxFnu051106
	for <vl...@cfcl.com>; Tue, 22 Mar 2005 15:59:16 -0800 (PST)
	(envelope-from marcel@bresink.de)
...
From: Marcel Bresink <ma...@bresink.de>
Subject: Re: TinkerTool System Feedback
Date: Wed, 23 Mar 2005 00:56:43 +0100
To: Vicki Brown <vl...@cfcl.com>

The SA Report
 X-Spam-Flag: YES
 X-Spam-Checker-Version: SpamAssassin 3.0.2 (2004-11-16) on cfcl.com
 X-Spam-Level: *
 X-Spam-Status: Yes, score=1.0 required=0.5 tests=CF_NOT_FOR_ME
	autolearn=disabled version=3.0.2
 X-Spam-Report:
	*  1.0 CF_NOT_FOR_ME Neither To nor Cc me

The mail is To: Vicki Brown <vl...@cfcl.com>
The test should not trigger

Required disclaimer:
  Yes, I ran spamassassin --lint
  Yes I hupped spamd recently (I shouldn't need to; this is a user rule)
  Yes we allow user rules (yes we trust our users :)


Last time someone suggested that my M[TU]A might add a To: line if it was
missing. Even if that was occurring, I doubt it would add my full name as
well....

Besides which, according to my procmail logs, my address _was_ in the To:
header well before the mail was piped into spamc.

procmail: [47355] Tue Mar 22 15:38:13 2005
...
procmail: Executing "formail,-zxFrom:,-zxReply-To:"
procmail: Assigning "SENTFROM=Marcel Bresink <ma...@bresink.de>"
procmail: Executing "formail,-zxTo:,-zxCc:"
procmail: Assigning "SENTTO=Vicki Brown <vl...@cfcl.com>"


So why does spamd say that
  Vicki Brown <vl...@cfcl.com> !~ /(?:vlb\@cfcl|vicki\.vlb\@gmail)\.com/i

I ran this through vanilla Perl and
  Vicki Brown <vl...@cfcl.com> =~ /(?:vlb\@cfcl|vicki\.vlb\@gmail)\.com/i
-- 
Vicki Brown          ZZZ
Journeyman Sourceror:  zz  |\     _,,,---,,_     Code, Docs, Process,
Scripts & Philtres      zz /,`.-'`'    -.  ;-;;,_   Perl, WWW, Mac OS X
http://cfcl.com/vlb       |,4-  ) )-,_. ,\ ( `'-'   SF Bay Area, CA  USA
_______________________  '---''(_/--'  `-'\_)  ___________________________

Re: back where I was: why is this rule misfiring?

[Loren Wilton <lw...@earthlink.net>]

> What is going on here?

Good question.

> So why does spamd say that
>   Vicki Brown <vl...@cfcl.com> !~ /(?:vlb\@cfcl|vicki\.vlb\@gmail)\.com/i
>
> I ran this through vanilla Perl and
>   Vicki Brown <vl...@cfcl.com> =~ /(?:vlb\@cfcl|vicki\.vlb\@gmail)\.com/i

I ran both versions thru plain perl from the command line too.  And I get
exactly opposite results if I either escape the first @ sign, or don't
escape the second one.

Being the paronoid type, and knowing that =~ expressions work in ways I
understand, I'd do a

header __TO_ME ToCc =~ /(?:vlb\@cfcl|vicki\.vlb\@gmail)\.com/i
meta     NOT_TO_ME    !__TO_ME

        Loren

Which is better, DCC or Pyzor?

[qqqq <qq...@usermail.com>]

I don't want to start a flame war but I would like to implement both.  I
just want to do one at a time and would like to know which is better in your
opinion.

TIA,


QQQQ

Re: back where I was: why is this rule misfiring?

[alan premselaar <al...@12inch.com>]

Vicki Brown wrote:
> What is going on here?
> 
> The rule
>  header CF_NOT_FOR_ME            ToCc !~
> /(?:vlb\@cfcl|vicki\.vlb\@gmail)\.com/i
>  score CF_NOT_FOR_ME             0.01
>  describe CF_NOT_FOR_ME          Neither To nor Cc me
> 

Vicki,

  You're using a negated OR test, you want to use a negated AND test.

so, you're saying "if the mail isn't for vlb[at]cfcl OR the mail isn't 
for vicki.vlb[at]gmail then it's not for me"

in this situation, if one of the tests is true, the other one is false 
and thus the entire test is true. because one of the criteria passes the 
!~ test.

This is why you're not seeing the expected results.

[...snip...]

hope this helps,

alan