You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Rejaine Monteiro <re...@bhz.jamef.com.br> on 2014/05/28 15:19:20 UTC
Rule Help
Hi
I need a rule to block spam contains
Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente'
AND URI contains links to orcamento or panilha (php or pdf)
So, I doing this:
header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
body __ORCAMENTO_B /or.*amento|planilha|urgente/i
uri __ORCAMENTO_U
/orcamento\.php|/orcamento\.pdf|planilha\.php|planilha\.pdf)
meta ORCAMENTO ( __JAMEF_ORCAMENTO_H || __JAMEF_ORCAMENTO_B ) &&
__JAMEF_ORCAMENTO_U
score ORCAMENTO 5.5
describe ORCAMENTO Fala sobre orçamentos urgentes e contem links
supostamente para arquivos PDF
But is not working. What I'm doing wrong?
Sample spam Subject:
Subject:
=?iso-8859-1?Q?Veja_meu_ora=E7amento_com_carinho_e_me_responda_o_mais_rap?=
=?iso-8859-1?Q?ido_possivel____quarta-feira=2C_28_de_maio_de_2014___06:26?=
=?iso-8859-1?Q?:23?=
Sampe spam Body:
SR. Contribuinte
Segue Abaixo Or=E7amento de Planilha.pdf
Sample Spam URI:
<meta http-equiv="refresh" content="0;
url=http://msaojose.org/orcamento.php">
------=_NextPart_000_005E_01CF7A4E.D1CAF290--
# spamc -R < spam.eml
2.6/5.0
Content preview: Segue em anexo o or�amento solicitado Or�amento Urgente
quarta-feira,
28 de maio de 2014 04:09:06 Segue em anexo o or�amento solicitado [...]
Content analysis details: (2.6 points, 5.0 required)
pts rule name description
---- ----------------------
--------------------------------------------------
0.6 SPF_SOFTFAIL SPF: sender does not match SPF record (softfail)
-0.2 BAYES_40 BODY: Bayesian spam probability is 20 to 40%
[score: 0.2096]
0.0 HTML_MESSAGE BODY: HTML included in message
2.2 DCC_CHECK Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
Re: Rule Help
Posted by Bowie Bailey <Bo...@BUC.com>.
On 5/28/2014 11:14 AM, Martin Gregorie wrote:
> On Wed, 2014-05-28 at 10:19 -0300, Rejaine Monteiro wrote:
>> So, I doing this:
>>
>> header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
>> body __ORCAMENTO_B /or.*amento|planilha|urgente/i
>> uri __ORCAMENTO_U
>> /orcamento\.php|/orcamento\.pdf|planilha\.php|planilha\.pdf)
>> meta ORCAMENTO ( __JAMEF_ORCAMENTO_H || __JAMEF_ORCAMENTO_B ) &&
>> __JAMEF_ORCAMENTO_U
>> score ORCAMENTO 5.5
>> describe ORCAMENTO Fala sobre orçamentos urgentes e contem links
>> supostamente para arquivos PDF
>>
> Your header and body lack grouping brackets round the list of alternates
> - you should write /(alt1|alt2|alt3|alt4)/ NOT /alt1|alt2|alt3|alt4/
The grouping is not necessary if the entire expression consists of a
simple list of alternates. And if you do use the grouping, it should be
/(?:alt1|alt2|alt3|alt4)/ to avoid unnecessary capturing of the
results. (This is not a big deal, but there is a minor performance hit
associated with the capture.)
--
Bowie
Re: Rule Help
Posted by Martin Gregorie <ma...@gregorie.org>.
On Wed, 2014-05-28 at 10:19 -0300, Rejaine Monteiro wrote:
> Hi
>
> I need a rule to block spam contains
> Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente'
> AND URI contains links to orcamento or panilha (php or pdf)
>
First, you are not writing valid regular expressions and you're not
running lint checks to find the errors. You need to make sure the runes
are syntactically correct before even thinking of running checks.
Use "spamassassin --lint" to find syntax errors in your rules.
> So, I doing this:
>
> header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
> body __ORCAMENTO_B /or.*amento|planilha|urgente/i
> uri __ORCAMENTO_U
> /orcamento\.php|/orcamento\.pdf|planilha\.php|planilha\.pdf)
> meta ORCAMENTO ( __JAMEF_ORCAMENTO_H || __JAMEF_ORCAMENTO_B ) &&
> __JAMEF_ORCAMENTO_U
> score ORCAMENTO 5.5
> describe ORCAMENTO Fala sobre orçamentos urgentes e contem links
> supostamente para arquivos PDF
>
Your header and body lack grouping brackets round the list of alternates
- you should write /(alt1|alt2|alt3|alt4)/ NOT /alt1|alt2|alt3|alt4/
Your URI rule has a lot of errors:
- missing opening round bracket
- missing final '/'
- the '/' starting the second alternate needs to be escaped, i.e. '\/'
because the unescaped form is part of the regex syntax
Your meta rule contains two closing round brackets but only one opening
bracket. I have assumed you meant this logic, i.e ((A OR B) AND C). I
have no idea where the subrules named in your meta rule are defined but
its certain that __JAMEF_ORCAMENTO_H is nothing to do with __ORCAMENTO_H
and the same goes for __JAMEF_ORCAMENTO_B and __JAMEF_ORCAMENTO_U but I
have assumed that you meant to write:
meta ORCAMENTO (( __ORCAMENTO_H || __ORCAMENTO_B ) && __ORCAMENTO_U)
In other words, I think the rule you meant to write is this:
header __ORCAMENTO_H Subject =~ /(or.*amento|planilha|urgente)/i
body __ORCAMENTO_B /(or.*amento|planilha|urgente)/i
uri __ORCAMENTO_U /(orcamento\.php|\/orcamento\.pdf|planilha\.php|
planilha\.pdf)/
meta ORCAMENTO (( __ORCAMENTO_H || __ORCAMENTO_B ) && __ORCAMENTO_U)
score ORCAMENTO 5.5
describe ORCAMENTO Fala sobre orçamentos urgentes e contem
linkssupostamente para arquivos PDF
And, I assembled a test message from the following:
> Sample spam Subject:
>
> Subject:
> =?iso-8859-1?Q?Veja_meu_ora=E7amento_com_carinho_e_me_responda_o_mais_rap?=
> =?iso-8859-1?Q?ido_possivel____quarta-feira=2C_28_de_maio_de_2014___06:26?=
> =?iso-8859-1?Q?:23?=
>
> Sampe spam Body:
>
> SR. Contribuinte
> Segue Abaixo Or=E7amento de Planilha.pdf
>
> Sample Spam URI:
> <meta http-equiv="refresh" content="0;
> url=http://msaojose.org/orcamento.php">
My test message looks like this (between the lines of equals signs, with
a single line of Subject header:
===========================================================
Subject:
=?iso-8859-1?Q?Veja_meu_ora=E7amento_com_carinho_e_me_responda_o_mais_rap?=
SR. Contribuinte
> Segue Abaixo Or=E7amento de Planilha.pdf
>
> Sample Spam URI:
> <meta http-equiv="refresh" content="0;
> url=http://msaojose.org/orcamento.php">
===========================================================
Once the problems I've listed are fixed, this dummy message gives a
score of 9.3 in my system:
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on example.com
X-Spam-Flag: YES
X-Spam-Level: *********
X-Spam-Status: Yes, score=9.3 required=6.0
tests=MG_WRONG_DOMAIN,MISSING_DATE,
MISSING_FROM,MISSING_HEADERS,MISSING_MID,NO_HEADERS_MESSAGE,NO_RECEIVED,
NO_RELAYS,ORCAMENTO autolearn=no version=3.3.2
MG_WRONG_DOMAIN is a private rule that fires if the To: header isn't my
published e-mail address
MISSING_DATE,MISSING_FROM,MISSING_HEADERS,MISSING_MID,NO_HEADERS_MESSAGE,NO_RECEIVED,
NO_RELAYS, because the only header in my test was Subject:
And, as you can see, my revision of ORCAMENTO fired on your text.
=====
You need to find, read and understand the rules for writing Perl regular
expressions. I use the O'Reilly Camel book, "Programming Perl", but
everything is available online here: http://perldoc.perl.org/
http://www.regular-expressions.info/ deals with just regular
expressions, but be aware that it covers all regular expressions, not
just the Perl dialect that Spamassassin uses. There is a regex tester
for Perl and POSIX expressions here: http://quanetic.com/Regex
Martin
Martin
Re: Rule Help
Posted by John Hardin <jh...@impsec.org>.
On Wed, 28 May 2014, Rejaine Monteiro wrote:
> So, I doing this:
>
> header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
> body __ORCAMENTO_B /or.*amento|planilha|urgente/i
...is redundant. The subject text is included in body rules.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
"They will be slaughtered as result of England's anti-gun laws
that concentrates power to the Government."
-- Shifty Powers (101 abn) observing British
subjects training to repel a German invasion
using rakes, hoes and pitchforks
-----------------------------------------------------------------------
9 days until the 70th anniversary of D-Day
Re: Rule Help
Posted by Rejaine Monteiro <re...@bhz.jamef.com.br>.
In fact, there was this error, even after fixing it still didn't work.
I believe that the problem was occurring because the message had a HMTL
attached and in turn had a link to the file. I decided to change and do
as follows:
header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
body __ORCAMENTO_B /or.*amento|planilha|urgente/i
mimeheader __ORCAMENTO_M Content-Disposition =~ /\.html[";]/i
meta ORCAMENTO ( __ORCAMENTO_H || __ORCAMENTO_B ) && __ORCAMENTO_M
score ORCAMENTO 5.5
I don't know if you're absolutely correct and efficient, but I did some
tests with a few spams and seems to have worked
Em 28-05-2014 11:38, Bowie Bailey escreveu:
> On 5/28/2014 9:19 AM, Rejaine Monteiro wrote:
>> Hi
>>
>> I need a rule to block spam contains
>> Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente'
>> AND URI contains links to orcamento or panilha (php or pdf)
>>
>> So, I doing this:
>>
>> header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
>> body __ORCAMENTO_B /or.*amento|planilha|urgente/i
>> uri __ORCAMENTO_U
>> /orcamento\.php|/orcamento\.pdf|planilha\.php|planilha\.pdf)
>> meta ORCAMENTO ( __JAMEF_ORCAMENTO_H || __JAMEF_ORCAMENTO_B ) &&
>> __JAMEF_ORCAMENTO_U
>> score ORCAMENTO 5.5
>> describe ORCAMENTO Fala sobre orçamentos urgentes e contem links
>> supostamente para arquivos PDF
>>
>> But is not working. What I'm doing wrong?
>
> __JAMEF_ORCAMENTO_H is not the same as __ORCAMENTO_H.
>
> Make sure you are using the same name in the meta as you use to define
> the rules.
>
> I don't see anything else obviously wrong. If it's still not working,
> put a sample spam in pastebin and give us a link so we can see what
> the full spam looks like and test the rules for ourselves.
>
Re: Rule Help
Posted by Bowie Bailey <Bo...@BUC.com>.
On 5/28/2014 9:19 AM, Rejaine Monteiro wrote:
> Hi
>
> I need a rule to block spam contains
> Subject or Body contains words 'or.*amento' or 'planilha' or 'urgente'
> AND URI contains links to orcamento or panilha (php or pdf)
>
> So, I doing this:
>
> header __ORCAMENTO_H Subject =~ /or.*amento|planilha|urgente/i
> body __ORCAMENTO_B /or.*amento|planilha|urgente/i
> uri __ORCAMENTO_U
> /orcamento\.php|/orcamento\.pdf|planilha\.php|planilha\.pdf)
> meta ORCAMENTO ( __JAMEF_ORCAMENTO_H || __JAMEF_ORCAMENTO_B ) &&
> __JAMEF_ORCAMENTO_U
> score ORCAMENTO 5.5
> describe ORCAMENTO Fala sobre orçamentos urgentes e contem links
> supostamente para arquivos PDF
>
> But is not working. What I'm doing wrong?
__JAMEF_ORCAMENTO_H is not the same as __ORCAMENTO_H.
Make sure you are using the same name in the meta as you use to define
the rules.
I don't see anything else obviously wrong. If it's still not working,
put a sample spam in pastebin and give us a link so we can see what the
full spam looks like and test the rules for ourselves.
--
Bowie