https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6297

--- Comment #3 from Warren Togami <[email protected]> 2010-01-20 13:59:42 UTC 
---
T_KHOP_BOTNET_2 is a separate issue from ANBREP.

72_active.cf:meta     KHOP_HELO_BOT    __HELO_NO_DOMAIN && T_KHOP_BOTNET_2
72_active.cf:describe KHOP_HELO_BOT    Suspect botnet sender claims no domain
name

rulesrc/sandbox/khopesh/20_khop_general.cf:
meta     KHOP_HELO_BOT  __HELO_NO_DOMAIN && KHOP_BOTNET_2
describe KHOP_HELO_BOT  Suspect botnet sender claims no domain name

rulesrc/sandbox/khopesh/20_s25r.cf:
meta     KHOP_BOTNET_2  __LAST_EXTERNAL_RELAY_NO_AUTH && !(__FROM_FREEMAIL ||
__NOT_SPOOFED || __GREYLISTED) && (__S25R_3 || __S25R_4 || __S25R_5 || __S25R_6
|| (RDNS_DYNAMIC + __S25R_1 + __S25R_2) > 1)
describe KHOP_BOTNET_2  Relay looks like a dynamic address
tflags   KHOP_BOTNET_2  nopublish

rules/active.list:
# good enough
KHOP_HELO_BOT

KHOP_HELO_BOT was auto-promoted, but it relies upon KHOP_BOTNET_2 which is
marked as nopublish in khopesh's sandbox.  The active.list and meta boolean
appear to be forcing T_KHOP_BOTNET_2 to be an active rule despite nopublish?

It appears the safest thing we can do now is switch KHOP_HELO_BOT to nopublish,
remove it from rules/active.list.  Then we should be able to safely cut the
3.3.0.  We can decide if it is a good idea to enable KHOP_HELO_BOT and an
appropriate score later.

Any objections?

This does suggest there is a bug having to do with auto-promotion, where
auto-promote forcefully publishes a meta boolean dependent rule even if that
dependency is nopublish.  Let us solve this for 3.3.1.

-- 
Configure bugmail: 
https://issues.apache.org/SpamAssassin/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

Reply via email to