Method of setting score for a custom rule to be the required_score ?

classic Classic list List threaded Threaded
8 messages Options
Reply | Threaded
Open this post in threaded view
|

Method of setting score for a custom rule to be the required_score ?

J Doe
Hello,

I was wondering if it is possible to assign a score to a custom rule that will evaluate to the value that required_score is set to.

My thinking here is that if this rule ever passes, it should not add a small value to the score but push the score up to the value
that required_score is set to.  This way, if the custom rule ever matches, it automatically scores the amount required to flag
the message as spam because the score applied is the value of required_score.

I am wondering if it’s possible to do something like this:

    body __BODY_TEST1 . . .
    body __BODY_TEST2 . . .
    meta CUSTOM_RULE1    (__BODY_TEST1 && __BODY_TEST2)
    describe CUSTOM_RULE1 My custom rule
    score CUSTOM_RULE1 %required_score

…where that last %required_score is the part I am curious about.

If it’s not possible to do this directly, is there a way to achieve the same effect that is used by SA rule writers ?

Thanks,

- J
Reply | Threaded
Open this post in threaded view
|

Re: Method of setting score for a custom rule to be the required_score ?

John Hardin
On Mon, 25 Jun 2018, J Doe wrote:

> Hello,
>
> I was wondering if it is possible to assign a score to a custom rule that will evaluate to the value that required_score is set to.
>
> My thinking here is that if this rule ever passes, it should not add a small value to the score but push the score up to the value
> that required_score is set to.  This way, if the custom rule ever matches, it automatically scores the amount required to flag
> the message as spam because the score applied is the value of required_score.
>
> I am wondering if it’s possible to do something like this:
>
>    body __BODY_TEST1 . . .
>    body __BODY_TEST2 . . .
>    meta CUSTOM_RULE1    (__BODY_TEST1 && __BODY_TEST2)
>    describe CUSTOM_RULE1 My custom rule
>    score CUSTOM_RULE1 %required_score
>
> …where that last %required_score is the part I am curious about.
>
> If it’s not possible to do this directly, is there a way to achieve the same effect that is used by SA rule writers ?
That's called a "poison pill rule", and generally you don't worry about
hitting the required score exactly, you just set it to something large -
like 10 or 100.

--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  [hidden email]    FALaholic #11174     pgpk -a [hidden email]
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  9 days until the 242nd anniversary of the Declaration of Independence
Reply | Threaded
Open this post in threaded view
|

Re: Method of setting score for a custom rule to be the required_score ?

J Doe

On Jun 26, 2018, at 12:13 AM, John Hardin <[hidden email]> wrote:

Hello,

I was wondering if it is possible to assign a score to a custom rule that will evaluate to the value that required_score is set to.

My thinking here is that if this rule ever passes, it should not add a small value to the score but push the score up to the value
that required_score is set to.  This way, if the custom rule ever matches, it automatically scores the amount required to flag
the message as spam because the score applied is the value of required_score.

I am wondering if it’s possible to do something like this:

  body __BODY_TEST1 . . .
  body __BODY_TEST2 . . .
  meta CUSTOM_RULE1    (__BODY_TEST1 && __BODY_TEST2)
  describe CUSTOM_RULE1 My custom rule
  score CUSTOM_RULE1 %required_score

…where that last %required_score is the part I am curious about.

If it’s not possible to do this directly, is there a way to achieve the same effect that is used by SA rule writers ?

That's called a "poison pill rule", and generally you don't worry about hitting the required score exactly, you just set it to something large - like 10 or 100.

Hi John,

Ok, good to know.

Is it possible with the SA grammar to have variables ?  I was thinking I’d have something like the following in my: /etc/spamassassin/local.cf

    POISON_PILL = 100

…and then all the poison pill rules would reference that:

    score CUSTOM_RULE1 %POISON_PILL

…with the advantage being that if I did want to vary the score assigned to all these rules, I could change it in one place ?

Thanks,

- J
Reply | Threaded
Open this post in threaded view
|

Re: Method of setting score for a custom rule to be the required_score ?

John Hardin
On Tue, 26 Jun 2018, J Doe wrote:

>> On Jun 26, 2018, at 12:13 AM, John Hardin <[hidden email] <mailto:[hidden email]>> wrote:
>>
>>> My thinking here is that if this rule ever passes, it should not add a small value to the score but push the score up to the value
>>> that required_score is set to.  This way, if the custom rule ever matches, it automatically scores the amount required to flag
>>> the message as spam because the score applied is the value of required_score.
>>
>> That's called a "poison pill rule", and generally you don't worry about hitting the required score exactly, you just set it to something large - like 10 or 100.
>
> Is it possible with the SA grammar to have variables ?  I was thinking I’d have something like the following in my: /etc/spamassassin/local.cf
>
>    POISON_PILL = 100
>
> …and then all the poison pill rules would reference that:
>
>    score CUSTOM_RULE1 %POISON_PILL
>
> …with the advantage being that if I did want to vary the score assigned to all these rules, I could change it in one place ?
Not at this time. As we say, "Patches are welcome!"

You'd have to do that in a preprocessing stage if you wanted to do that:
have a set of "source" rule files with tokens like that which you edit,
and run that through a substitution tool to get the local rules files for
SA to use.


--
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  [hidden email]    FALaholic #11174     pgpk -a [hidden email]
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   The world has enough Mouse Clicking System Engineers.
                                                        -- Dave Pooser
-----------------------------------------------------------------------
  8 days until the 242nd anniversary of the Declaration of Independence
Reply | Threaded
Open this post in threaded view
|

Re: Method of setting score for a custom rule to be the required_score ?

Daniele Duca
In reply to this post by J Doe

On 27/06/2018 02:15, J Doe wrote:


Hi John,

Ok, good to know.

Is it possible with the SA grammar to have variables ?  I was thinking I’d have something like the following in my: /etc/spamassassin/local.cf

    POISON_PILL = 100

Hi,

I'd say that a better solution would be to use shortcircuit:
body __BODY_TEST1 . . .
body __BODY_TEST2 . . .
meta CUSTOM_RULE1    (__BODY_TEST1 && __BODY_TEST2)
shortcircuit CUSTOM_RULE1 spam

At least that saves computing power because other rules would not be processed once a rule is shortcircuited

Daniele
Reply | Threaded
Open this post in threaded view
|

Re: Method of setting score for a custom rule to be the required_score ?

J Doe

> On Jun 27, 2018, at 6:20 AM, Daniele Duca <[hidden email]> wrote:
> Hi,
>
> I'd say that a better solution would be to use shortcircuit:
> body __BODY_TEST1 . . .
> body __BODY_TEST2 . . .
> meta CUSTOM_RULE1    (__BODY_TEST1 && __BODY_TEST2)
> shortcircuit CUSTOM_RULE1 spam
>
> At least that saves computing power because other rules would not be processed once a rule is shortcircuited
Hi John and Daniele,

Thank you for your replies.

John - I’d love to submit a patch, but Perl is not one of the languages I speak . . . but if that changes in the near future, I’ll submit one.

Daniele - I like your solution in the fact that you mention processing is short-circuited - since mail that meets my rules is already satisfied, additional work by SA is not needed.

I went back to “man Mail::SpamAssassin::Conf” and can see mention of the shortcircuit plugin . . . is there more documentation (perhaps in another man or perldoc), where the shortcircuit keyword is mentioned ?

Thanks again,

- J

Reply | Threaded
Open this post in threaded view
|

Re: Method of setting score for a custom rule to be the required_score ?

Daniele Duca
On 28/06/2018 04:17, J Doe wrote:

>
> I went back to “man Mail::SpamAssassin::Conf” and can see mention of the shortcircuit plugin . . . is there more documentation (perhaps in another man or perldoc), where the shortcircuit keyword is mentioned ?
>
I'd say a good starting point would be
https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Shortcircuit.html

Daniele
Reply | Threaded
Open this post in threaded view
|

Re: Method of setting score for a custom rule to be the required_score ?

Bill Cole
In reply to this post by J Doe
On 27 Jun 2018, at 22:17, J Doe wrote:

> I went back to “man Mail::SpamAssassin::Conf” and can see mention
> of the shortcircuit plugin . . . is there more documentation (perhaps
> in another man or perldoc), where the shortcircuit keyword is
> mentioned ?

perldoc Mail::SpamAssassin::Plugin::Shortcircuit

For any Perl module that has embedded 'pod' documentation, 'perldoc'
provides the best documentation because it is extracted from the actual
module rather than relying on a 'man' page that was almost certainly
extracted from the module originally but may be stale.