[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    Re-2: A rule to check X-ASN header
From:       "steve" <steve () mailinglists ! spectrumcs ! net>
Date:       2015-11-23 16:13:06
Message-ID: 0000EB1B.56533B12 () rainbow ! spectrumcs ! net
[Download RAW message or body]



> > Hi all,
> > 
> > I'm trying to create a rule which will check the results of the ASN
> > plugin. 
> ...
> > As a test I have the following...
> > 
> > ifplugin Mail::SpamAssassin::Plugin::ASN
> >    header      T_SCS_ASN_EXISTS              exists:X-ASN
> >    header      T_SCS_ASN_ANYTHING            X-ASN =~ /.*/i
> >    header      T_SCS_ASN_ANY_AS              X-ASN =~ /AS[0-9]*/i
> >    header      T_SCS_ASN_AS15169             X-ASN =~ /AS15169/
> >    header      T_SCS_ASN_AS15169B            X-ASN =~ /^AS15169 /
> > endif
> > 
> > On a test message which I sent myself on Friday from my google
> > account and which I am now currently pipping into SpamAssassin at the
> > command line the rules T_SCS_ASN_EXISTS and T_SCS_ASN_ANYTHING
> > trigger but T_SCS_ASN_ANY_AS, T_SCS_ASN_AS15169 and
> > T_SCS_ASN_AS15169B.
> ...
> > rules: ran header rule T_SCS_ASN_ANYTHING ======> got hit: "15169"
> 
> This is why the other tests fail, there's no "AS" before the number.
> 

RW,

Thank you! With that in mind I've made the following adjustment and the rule is now being triggered.

header      T_SCS_ASN_AS15169C            X-ASN =~ /^15169$/

As to whether this will be helpful in detecting spam I'll let you know.

Kind regards

Steve


[prev in list] [next in list] [prev in thread] [next in thread]