Empty_Message always triggers ?

[Paul Hurley <pa...@paulhurley.co.uk>]

I'm running SAProxy 3.1.7.0 (http://sawin32.sourceforge.net/) with 
standard rules plus some SARE ones, all updated via SAUpdate, along with 
Bayes and network testing on Windows XP SP2 and Mozilla 1.7.13.

I've started receiving some obvious spam recently that didn't get picked 
up.  Examples are http://www.paulhurley.co.uk/media/urgent.eml and 
http://www.paulhurley.co.uk/media/dearest.eml.  I looked at the messages 
and noticed empty_message was firing.  Thinking maybe the spammers had 
'hidden' the body somehow I checked some of my other spam, and that had 
Empty_message too.  All my ham has it as well, like 
http://www.paulhurley.co.uk/media/ham_example.eml.

This wasn't always the case, but it seems to start around the 1st of 
April.  I can't find anything via google on this, or on the wiki.

Any clues ?

-- 
Paul Hurley	http://www.paulhurley.co.uk/
The knack of flying is learning how to throw yourself at the ground and miss.
    Hitchhikers Guide to the Galaxy

Re: Empty_Message always triggers ?

[Paul Hurley <pa...@paulhurley.co.uk>]

Paul Hurley wrote:

> Alexis Manning wrote:
>
>>When I've hacked about with the rules and introduced something malformed 
>>I sometimes got MISSING_SUBJECT and its ilk firing.  Don't know if you 
>>may be seeing something similar - try linting your rules and see if 
>>there's any typos.
>>
>>HTH
>>
>>-- A. 
>>
>>  
>>
> I ran Lint, and I had a few config errors (badly written 
> whitelist_from_rcvd lines) which I've fixed.  Lint did catch the 
> non_empty_body meta rule that is part of the NOT clause for Empty_Message
>
> [4688] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "I"
>
> Paul.

I tried doing some diagnostics, by removing rules and running a sample 
message through spamassassin.  First time with all the rules produced 
this debug output;
[3204] warn: config: invalid regexp for rule HK_OBFDOM: /^https?:\/\/ 
[a-z0-9._-]*? (?: [^a-z0-9._':\@\/-]: Unmatched ( in regex; marked by 
<-- HERE in m//^https?:\/\/ [a-z0-9._-]*? ( <-- HERE ?: [^a-z0-9._':\@\/-]/
[3204] warn: config: invalid regexp for rule HK_OBFDOM2: /^http?:\/\/ 
[a-z0-9._-]*? (?: [^a-z0-9._':\@\/-]: Unmatched ( in regex; marked by 
<-- HERE in m//^http?:\/\/ [a-z0-9._-]*? ( <-- HERE ?: [^a-z0-9._':\@\/-]/
[3204] warn: Unrecognized escape \v passed through in regex; marked by 
<-- HERE in m/(?i)\v <-- HERE i.{0,10}ra/ at 
/PerlApp/Mail/SpamAssassin/Conf/Parser.pm line 969.
[3204] warn: Unrecognized escape \l passed through in regex; marked by 
<-- HERE in m/(?i)\l <-- HERE e.{0,10}ra/ at 
/PerlApp/Mail/SpamAssassin/Conf/Parser.pm line 969.
[3204] warn: Bareword found where operator expected at 
./share/spamassassin/local.cf, rule __HILO_STOCKS5, line 1, near 
"/(c[e3]nt|dollar|[e3]ur[o]?|p[e3]nc[e3])[\ \t\_]+?\d/ibody"
[3204] warn:  (Missing operator before body?)
[3204] warn: Unrecognized escape \v passed through at 
./share/spamassassin/local.cf, rule PH_BODY_VIRA, line 1.
[3204] warn: rules: failed to compile body tests, skipping:
[3204] warn:  (syntax error at ./share/spamassassin/local.cf, rule 
__HILO_STOCKS5, line 1, near "/(c[e3]nt|dollar|[e3]ur[o]?|p[e3]nc[e3])[\ 
\t\_]+?\d/ibody __HILO_STOCKS9 "
[3204] warn: syntax error at ./share/spamassassin/20_vbounce.cf, rule 
__VBOUNCE_VALERT, line 4522, near ";
[3204] warn: }"
[3204] warn: )

Which does indeed suggest I screwed something up in local.cf.  If I 
remove local.cf and rerun the test, there's no error messages and 
several new tests trigger.

I went through local.cf and had several errors (two were missing 
linefeeds so one test started at the end of another...)  Now all works fine.

So why didn't lint pick up those errors ?

Thanks for all the help

Paul.

-- 
Paul Hurley	http://www.paulhurley.co.uk/
The knack of flying is learning how to throw yourself at the ground and miss.
    Hitchhikers Guide to the Galaxy

Re: Empty_Message always triggers ?

[Paul Hurley <pa...@paulhurley.co.uk>]

Alexis Manning wrote:

>In article <46...@paulhurley.co.uk>, paul@paulhurley.co.uk 
>says...
>  
>
>>This wasn't always the case, but it seems to start around the 1st of 
>>April.  I can't find anything via google on this, or on the wiki.
>>
>>Any clues ?
>>    
>>
>
>When I've hacked about with the rules and introduced something malformed 
>I sometimes got MISSING_SUBJECT and its ilk firing.  Don't know if you 
>may be seeing something similar - try linting your rules and see if 
>there's any typos.
>
>HTH
>
>-- A. 
>
>  
>
I ran Lint, and I had a few config errors (badly written 
whitelist_from_rcvd lines) which I've fixed.  Lint did catch the 
non_empty_body meta rule that is part of the NOT clause for Empty_Message

[4688] dbg: rules: ran body rule __NONEMPTY_BODY ======> got hit: "I"

Paul.

-- 
Paul Hurley	http://www.paulhurley.co.uk/
The knack of flying is learning how to throw yourself at the ground and miss.
    Hitchhikers Guide to the Galaxy

Re: Empty_Message always triggers ?

[Alexis Manning <al...@googlemail.com>]

In article <46...@paulhurley.co.uk>, paul@paulhurley.co.uk 
says...
> This wasn't always the case, but it seems to start around the 1st of 
> April.  I can't find anything via google on this, or on the wiki.
> 
> Any clues ?

When I've hacked about with the rules and introduced something malformed 
I sometimes got MISSING_SUBJECT and its ilk firing.  Don't know if you 
may be seeing something similar - try linting your rules and see if 
there's any typos.

HTH

-- A.