Re: 20_xmailer.cf

[Justin Mason <jm...@jmason.org>]

On Wed, May 25, 2011 at 12:33, Alex Broens <su...@alexb.ch> wrote:
> # automatically-generated; see
> '~/ftp/spamassassin/hack/xmailer/notes.xmailer'
> # in jm's homedir for details. (or ask jm)
>
> Asking Justin...:)
>
> How do you generate these?
> thx

here's the contents of that file:


Procedure to find X-Mailer / X-MimeOLE combos, using "mail-scan-headers"
and "so-display" scripts:


mail-scan-headers -h X-MimeOLE,X-Mailer /local/cor/recent/ham/  \
    | grep MimeOLE > hdrs.h
mail-scan-headers -h X-MimeOLE,X-Mailer /local/cor/recent/spam/  \
    | grep MimeOLE > hdrs.s

perl -pe 's/^\S+ //' < hdrs.h > x.h
perl -pe 's/^\S+ //' < hdrs.s > x.s
so-display x.s x.h > hdrs.so


Now cut out sections of hdrs.so which look like good rules, and
generate rules from that:

perl -ne ' use Digest::MD5 qw(md5_hex);
  if (m{^\s*\S+\s+\S+\s+\S+\s+(\S+): (.*?)\|(\S+): (.*)$}) {
    my ($h1,$v1,$h2,$v2) = ($1,$2,$3,$4);
    my $name = uc md5_hex("$h1$v1$h2$v2"); $name =~ s/^(.....).*$/$1/;
    $v1 = quotemeta $v1;
    $v2 = quotemeta $v2;
    print "
header __XM_OL_$name  $h1 =~ /$v1/
header __MO_OL_$name  $h2 =~ /$v2/
meta XMAILER_MIMEOLE_OL_$name  (__XM_OL_$name && __MO_OL_$name)
"; } ' < spamrules