__ rules can't call multiple __ rules?

[Michael Scheidell <sc...@secnap.net>]

meta rules can't combine results from other meta rules?


header __L_ML1       Precedence =~ m{\b(list|bulk)\b}i
header __L_ML2       exists:List-Id
header __L_ML3       exists:List-Post
header __L_ML4       exists:Mailing-List
header __L_HAS_SNDR  exists:Sender

meta   __L_VIA_ML    __L_ML1 || __L_ML2 || __L_ML3 || __L_ML4 || 
__L_HAS_SNDR

header __L_FROM_Y1   From:addr =~ m{[@.]yahoo\.com$}i
header __L_FROM_Y2   From:addr =~ m{\@yahoo\.com\.(ar|br|cn|hk|my|sg)$}i
header __L_FROM_Y3   From:addr =~ m{\@yahoo\.co\.(id|in|jp|nz|uk)$}i
header __L_FROM_Y4   From:addr =~ 
m{\@yahoo\.(ca|de|dk|es|fr|gr|ie|it|pl|se)$}i
header __L_FROM_Y5   Reply-to =~ 
/\@yahoo\.(ca|de|dk|es|fr|gr|ie|it|pl|se|co)/i

meta   __L_FROM_YAHOO __L_FROM_Y5 || __L_FROM_Y1 || __L_FROM_Y2 || 
__L_FROM_Y3 || __L_FROM_Y4

meta     L_UNVERIFIED_YAHOO  !DKIM_VERIFIED && __L_FROM_YAHOO && !__L_VIA_ML
priority L_UNVERIFIED_YAHOO  500
score    L_UNVERIFIED_YAHOO  2.5


meta    TEST0  __L_FROM_Y5 || __L_FROM_Y1 || __L_FROM_Y2 || __L_FROM_Y3 
|| __L_FROM_Y4

meta    TEST1   __L_FROM_Y5
meta    TEST2   __L_FROM_YAHOO
meta    TEST3   !__L_VIA_ML
meta    TEST4   !DKIM_VERIFIED
meta    TEST5   !DKIM_VERIFIED && TEST0 && TEST3

only TEST0,TEST1,TEST3,TEST4 and TEST5 triggers?

email at http://www.secnap.com/downloads/nometa.txt

why doesn't test2 trigger!
why doesn't L_UNVERIFIED_YAHOO trigger and TEST5 does?

Is it because __L_FROM_YAHOO calls __L_FROM_Y5?  and you can't have two 
__ (meta rules with score 0) combine results?


-- 
Michael Scheidell, CTO
SECNAP Network Security Corporation
http://www.secnap.com





_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(tm). 
For Information please see http://www.spammertrap.com
_________________________________________________________________________

Re: __ rules can't call multiple __ rules?

[Theo Van Dinter <fe...@apache.org>]

On Thu, Jul 12, 2007 at 12:33:17PM -0400, Michael Scheidell wrote:
> meta rules can't combine results from other meta rules?

Sure they can.

> header __L_FROM_Y1   From:addr =~ m{[@.]yahoo\.com$}i
> header __L_FROM_Y2   From:addr =~ m{\@yahoo\.com\.(ar|br|cn|hk|my|sg)$}i
> header __L_FROM_Y3   From:addr =~ m{\@yahoo\.co\.(id|in|jp|nz|uk)$}i
> header __L_FROM_Y4   From:addr =~ 
> m{\@yahoo\.(ca|de|dk|es|fr|gr|ie|it|pl|se)$}i
> header __L_FROM_Y5   Reply-to =~ 
> /\@yahoo\.(ca|de|dk|es|fr|gr|ie|it|pl|se|co)/i
> 
> meta   __L_FROM_YAHOO __L_FROM_Y5 || __L_FROM_Y1 || __L_FROM_Y2 || 
> __L_FROM_Y3 || __L_FROM_Y4
> meta    TEST2   __L_FROM_YAHOO
> 
> email at http://www.secnap.com/downloads/nometa.txt
> 
> why doesn't test2 trigger!
> 
> Is it because __L_FROM_YAHOO calls __L_FROM_Y5?  and you can't have two 
> __ (meta rules with score 0) combine results?

When you say "with score 0", do you mean you set their score to 0?  Meta 
subrules (__) don't have a 0 score, the score just doesn't get added to the
overall message score.  If you set the subrule to a score of 0, it won't run,
same as any other rule.

Meta rules can depend on other meta rules, and the algorithm also detects
deadlocks (meta A B, meta B A) and handles those as well.

FWIW, having a meta which is simply the result of another rule (TEST2) is
wasteful and inefficient.  Just change __L_FROM_YAHOO to be a rule.

Anyway, I'd run your mail through "spamassassin -D" and post the result
somewhere.  My guess is that you have errors in your config somewhere
causing you problems, but debug output would let us see.  It also lets you see
the subrules that hit, so it'd be more obvious why meta rules do/don't hit.

-- 
Randomly Selected Tagline:
"I hate sitting in the smoking section when I'm not a smoker.  I always feel
 that there's this pressure to start." - Theo