You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Luca Bertoncello <lu...@lucabert.de> on 2017/09/26 12:20:35 UTC
Writing rules to parse Kaspersky-headers
Hi list!
I'm trying to write some rules to merge Kaspersky with SpamAssassin...
Kaspersky saves the result in the header X-KLMS-AntiSpam-Rate, so I
wrote in my local.cf this:
header KLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/
describe KLMSSPAM_LT10 E-Mail has less than 10% probability to
be Spam according to Kaspersky
score KLMSSPAM_LT10 0.0
header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^([012]{1})([0-9]{1})$/
describe KLMSSPAM_1030 E-Mail has 10-30% probability to be Spam
according to Kaspersky
score KLMSSPAM_1030 0.5
header KLMSSPAM_3060 X-KLMS-AntiSpam-Rate =~ /^([345]{1})([0-9]{1})$/
describe KLMSSPAM_3060 E-Mail has 30%-60% probability to be
Spam according to Kaspersky
score KLMSSPAM_3060 1.5
header KLMSSPAM_6090 X-KLMS-AntiSpam-Rate =~ /^([678]{1})([0-9]{1})$/
describe KLMSSPAM_6090 E-Mail has 60%-90% probability to be
Spam according to Kaspersky
score KLMSSPAM_6090 2.0
header KLMSSPAM_90 X-KLMS-AntiSpam-Rate =~
/^([9]{1}|[10]{2})([0-9]{1})$/
describe KLMSSPAM_90 E-Mail has more than 90% probability to
be Spam according to Kaspersky
score KLMSSPAM_90 3.0
Unfortunately, it doesn't work...
__SOMETIMES__, really random!, the rule KLMSSPAM_90 will be used, but
in that case I see in the E-Mail:
X-KLMS-AntiSpam-Rate: 0
Could someone help me and say what am I doing wrong?
Thanks a lot
Luca Bertoncello
(lucabert@lucabert.de)
Re: Writing rules to parse Kaspersky-headers
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>Luca Bertoncello skrev den 2017-09-26 14:20:
>
>>header KLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/
>>describe KLMSSPAM_LT10 E-Mail has less than 10% probability to
>>be Spam according to Kaspersky
>>score KLMSSPAM_LT10 0.0
>
>silly score, but rule is correct with pcre
>
>>header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~
>>/^([012]{1})([0-9]{1})$/
>>describe KLMSSPAM_1030 E-Mail has 10-30% probability to be Spam
>> according to Kaspersky
>>score KLMSSPAM_1030 0.5
On 26.09.17 14:53, Benny Pedersen wrote:
>header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^[1-2][0-9]{2}$/
this should hit all scores between 100 and 299. which is far away from
wanted.
the {2} means that the [0-9] has to appear twice. Which is, why I
recommended to remove all {1} quantifiers, because they are competely
useless, they just make the RE harder to read
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I'm not interested in your website anymore.
If you need cookies, bake them yourself.
Re: Writing rules to parse Kaspersky-headers
Posted by Benny Pedersen <me...@junc.eu>.
Luca Bertoncello skrev den 2017-09-26 14:20:
> header KLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/
> describe KLMSSPAM_LT10 E-Mail has less than 10% probability to
> be Spam according to Kaspersky
> score KLMSSPAM_LT10 0.0
silly score, but rule is correct with pcre
> header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~
> /^([012]{1})([0-9]{1})$/
> describe KLMSSPAM_1030 E-Mail has 10-30% probability to be Spam
> according to Kaspersky
> score KLMSSPAM_1030 0.5
[snip]
header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^[1-2][0-9]{2}$/
untested
Re: Writing rules to parse Kaspersky-headers
Posted by Luca Bertoncello <lu...@lucabert.de>.
Zitat von Matus UHLAR - fantomas <uh...@fantomas.sk>:
>> But if SpamAssassin was called by Exim, it does NOT work.
>
> 1. you were asked to provide samples e.g. on pastebin.
>
>> Therefore my question "when will the header be added"?
>
> 2. how do you integrate SA and kaspersky AV?
I got it!
The problem was that Exim adds the Kaspersky-Header at the __END__ of
the ACL so that SpamAssassin will just get the message __WITHOUT__
these headers...
I solved the problem by requeue the E-Mail after the Kaspersky-check.
Thanks
Luca Bertoncello
(lucabert@lucabert.de)
Re: Writing rules to parse Kaspersky-headers
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>>Luca Bertoncello skrev den 2017-09-26 15:18:
>>>and it will NOT match...
>>>I'm really think, that the problem is not by SpamAssassin, but in Exim
>>>that does not send the complete message to SpamAssassin...
>Zitat von Benny Pedersen <me...@junc.eu>:
>>why use exim for testing ?
>>
>>spamassassin -t mailmsg | less
>>
>>did it hit or not ?
>>
>>more debug ?
>>
>>spamassassin 2>&1 -D -t mailmsg | less
>>
>>dont use in exim before it works
On 26.09.17 13:44, Luca Bertoncello wrote:
>Of course, if I check the E-Mail with SpamAssassin, it does work...
>
>But if SpamAssassin was called by Exim, it does NOT work.
1. you were asked to provide samples e.g. on pastebin.
>Therefore my question "when will the header be added"?
2. how do you integrate SA and kaspersky AV?
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
We are but packets in the Internet of life (userfriendly.org)
Re: Writing rules to parse Kaspersky-headers
Posted by Benny Pedersen <me...@junc.eu>.
Luca Bertoncello skrev den 2017-09-26 15:44:
> But if SpamAssassin was called by Exim, it does NOT work.
> Therefore my question "when will the header be added"?
this is not a spamassassin problem then
Re: Writing rules to parse Kaspersky-headers
Posted by Luca Bertoncello <lu...@lucabert.de>.
Zitat von Benny Pedersen <me...@junc.eu>:
> Luca Bertoncello skrev den 2017-09-26 15:18:
>
>> and it will NOT match...
>> I'm really think, that the problem is not by SpamAssassin, but in Exim
>> that does not send the complete message to SpamAssassin...
>
> why use exim for testing ?
>
> spamassassin -t mailmsg | less
>
> did it hit or not ?
>
> more debug ?
>
> spamassassin 2>&1 -D -t mailmsg | less
>
> dont use in exim before it works
Of course, if I check the E-Mail with SpamAssassin, it does work...
But if SpamAssassin was called by Exim, it does NOT work.
Therefore my question "when will the header be added"?
Thanks
Luca Bertoncello
(lucabert@lucabert.de)
Re: Writing rules to parse Kaspersky-headers
Posted by Benny Pedersen <me...@junc.eu>.
Luca Bertoncello skrev den 2017-09-26 15:18:
> and it will NOT match...
> I'm really think, that the problem is not by SpamAssassin, but in Exim
> that does not send the complete message to SpamAssassin...
why use exim for testing ?
spamassassin -t mailmsg | less
did it hit or not ?
more debug ?
spamassassin 2>&1 -D -t mailmsg | less
dont use in exim before it works
Re: Writing rules to parse Kaspersky-headers
Posted by Luca Bertoncello <lu...@lucabert.de>.
Zitat von Merijn van den Kroonenberg <me...@web2all.nl>:
> maybe you can provide a pastebin example of a mail you want to match with
> the KLMSSPAM_90 rule?
I have another idea...
I manual add the header "X-AV-scan: yes" in Exim when I receive the E-Mail.
This happens just a couple of line before the Spam check.
I wrote in local.cf:
header TEST X-AV-scan =~ /yes/
describe TEST TEST Kaspersky
score TEST 0.1
and it will NOT match...
I'm really think, that the problem is not by SpamAssassin, but in Exim
that does not send the complete message to SpamAssassin...
Regards
Luca Bertoncello
(lucabert@lucabert.de)
Re: Writing rules to parse Kaspersky-headers
Posted by Merijn van den Kroonenberg <me...@web2all.nl>.
>> at third, the last rule should be rewritten, the {2} does not what you
>> apparently means it does:
>>
>> header KLMSSPAM_90 X-KLMS-AntiSpam-Rate =~ /^(?:9[0-9]|100)$/
>>
>> should do what you expect.
>
> Unfortunately not...
>
> Same behaviour. Nothing changes...
maybe you can provide a pastebin example of a mail you want to match with
the KLMSSPAM_90 rule?
The above rule looks as if it should work, if header content is just 90-100.
>
> Any other suggestion?
>
Re: Writing rules to parse Kaspersky-headers
Posted by Luca Bertoncello <lu...@lucabert.de>.
Zitat von Matus UHLAR - fantomas <uh...@fantomas.sk>:
> at first I'd recommend avoid those {1} and skip useless ()
> at second, 1030, 3060, and 6090 should be named 1029, 3059 and 6089
>
> header KLMSSPAM_0X X-KLMS-AntiSpam-Rate =~ /^[0-9]$/
> header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^[012][0-9]$/
> header KLMSSPAM_3060 X-KLMS-AntiSpam-Rate =~ /^[345][0-9]$/
> header KLMSSPAM_6090 X-KLMS-AntiSpam-Rate =~ /^[678][0-9]$/
>
> at third, the last rule should be rewritten, the {2} does not what you
> apparently means it does:
>
> header KLMSSPAM_90 X-KLMS-AntiSpam-Rate =~ /^(?:9[0-9]|100)$/
>
> should do what you expect.
Unfortunately not...
Same behaviour. Nothing changes...
Any other suggestion?
Thanks
Luca Bertoncello
(lucabert@lucabert.de)
Re: Writing rules to parse Kaspersky-headers
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 26.09.17 12:20, Luca Bertoncello wrote:
>I'm trying to write some rules to merge Kaspersky with SpamAssassin...
>Kaspersky saves the result in the header X-KLMS-AntiSpam-Rate, so I
>wrote in my local.cf this:
>
>header KLMSSPAM_LT10 X-KLMS-AntiSpam-Rate =~ /^([0-9]{1})$/
>describe KLMSSPAM_LT10 E-Mail has less than 10% probability to
>be Spam according to Kaspersky
>score KLMSSPAM_LT10 0.0
>
>header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^([012]{1})([0-9]{1})$/
>describe KLMSSPAM_1030 E-Mail has 10-30% probability to be
>Spam according to Kaspersky
>score KLMSSPAM_1030 0.5
>
>header KLMSSPAM_3060 X-KLMS-AntiSpam-Rate =~ /^([345]{1})([0-9]{1})$/
>describe KLMSSPAM_3060 E-Mail has 30%-60% probability to be
>Spam according to Kaspersky
>score KLMSSPAM_3060 1.5
>
>header KLMSSPAM_6090 X-KLMS-AntiSpam-Rate =~ /^([678]{1})([0-9]{1})$/
>describe KLMSSPAM_6090 E-Mail has 60%-90% probability to be
>Spam according to Kaspersky
>score KLMSSPAM_6090 2.0
>
>header KLMSSPAM_90 X-KLMS-AntiSpam-Rate =~
>/^([9]{1}|[10]{2})([0-9]{1})$/
>describe KLMSSPAM_90 E-Mail has more than 90% probability to
>be Spam according to Kaspersky
>score KLMSSPAM_90 3.0
>
>Unfortunately, it doesn't work...
>__SOMETIMES__, really random!, the rule KLMSSPAM_90 will be used, but
>in that case I see in the E-Mail:
>
>X-KLMS-AntiSpam-Rate: 0
>
>Could someone help me and say what am I doing wrong?
at first I'd recommend avoid those {1} and skip useless ()
at second, 1030, 3060, and 6090 should be named 1029, 3059 and 6089
header KLMSSPAM_0X X-KLMS-AntiSpam-Rate =~ /^[0-9]$/
header KLMSSPAM_1030 X-KLMS-AntiSpam-Rate =~ /^[012][0-9]$/
header KLMSSPAM_3060 X-KLMS-AntiSpam-Rate =~ /^[345][0-9]$/
header KLMSSPAM_6090 X-KLMS-AntiSpam-Rate =~ /^[678][0-9]$/
at third, the last rule should be rewritten, the {2} does not what you
apparently means it does:
header KLMSSPAM_90 X-KLMS-AntiSpam-Rate =~ /^(?:9[0-9]|100)$/
should do what you expect.
at fourth, don't you believe kaspersky enough to give first rules small
negative score?
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Fucking windows! Bring Bill Gates! (Southpark the movie)