Re: IP country plugin - can we look for two countries?

On Sat, 2008-06-28 at 01:40 +0200, mouss wrote:
> mouss wrote:
> >> Is there some way to grab the metadata from IPCountry to count the
> >> number of countries that were involved in sending a mail, and set a
> >> score based on that?
> >
> > you mean catching the "Junkman traveller"?
> >
> > you can try
> >
> > header THREE_COUNTRIES X-Relay-Countries =~ /\s[a-z]{2}\s/
> > score THREE_COUNTRIES 0.01
> >
> > header FOUR_COUNTRIES X-Relay-Countries =~ /\s[a-z]{2}\s[a-z]{2}\s/
> > score FOUR_COUNTRIES 0.01
> >
>
> argh. This is wrong as it will hit things like "US US FR FR"...
> > and so on...

Correct. And Spamassassin rules developers generally frown on using back-tracking, as it slows down the whole ruleset even if only used for one rule....

Seems like I would need to write a plugin to count this then, something like this metacode...

my %countries
foreach my $relay (split(/\s/,$vauleofx\-relay\-countries)) {

        $countries{$relay}++;
};
return #$countries

-- 
Daniel J McDonald, CCIE #2495, CISSP #78281, CNX
Austin Energy
http://www.austinenergy.com


application/pgp-signature attachment: This is a digitally signed message part