Stumped by these spams

[Roy Brown]

Hi

I'm getting some spams, obviously all from the same source, where there
is a common factor in the Return Paths, e.g.:-

Return-path: <mailhealthquotes-roy=***@fast-clientele.org>
Return-path: <mailda-roy=***@zenhcf.org>
Return-path: <mailequity-roy=***@unitedorgs.org>

So it seems to me that the Envelope Rejection rule:-

Reject - has reverse path:

mail*roy?kelmscott\.co\.uk@

(* includes the dash -, ? replaces the equals sign = in case these
aren't quite what they seem)

should get rid of these, but they keep sailing on in.

In case Stunnel being in the loop - though that should only be for
Namesco mail, which this isn't, this is ordinary POP3 - was affecting
TP seeing the SMTP envelope properly, I also added the Accept rule:-

/mail*roy?kelmscott\.co\.uk@/h

to my Spam folder (/h, not /f, in case, as above Stunnel being in the
loop affected TP seeing the SMTP envelope even here, or in case
Return-path <> Return-Path)

But they sail past that as well and get to my Inbox still.

I'm running TP 6.07 in a VMware Virtual Windows 10 32-bit

I used to be good at custom rules, but I seem to have grown rusty :-(

Anyone like to suggest what I might be doing wrong?

[Andy]

Post by Roy Brown
Hi
I'm getting some spams, obviously all from the same source, where there
is a common factor in the Return Paths, e.g.:-
So it seems to me that the Envelope Rejection rule:-
(* includes the dash -, ? replaces the equals sign = in case these
aren't quite what they seem)

I thought a ? meant "one or more of the preceding character" - so would
pick up royyyy - and something I can't read (but I think it's a dot)
means "any character". There's always "\D" meaning "any char that isn't
a digit".

[Roy Brown]

In message <***@kitzbuhel.co.uk>, Andy
<***@kitzbuhel.co.uk> writing at 19:37:22 in his/her local time
opines:-

Post by Andy

Post by Roy Brown
Hi
I'm getting some spams, obviously all from the same source, where
there is a common factor in the Return Paths, e.g.:-
So it seems to me that the Envelope Rejection rule:-
(* includes the dash -, ? replaces the equals sign = in case these
aren't quite what they seem)

I thought a ? meant "one or more of the preceding character" - so would
pick up royyyy - and something I can't read (but I think it's a dot)
means "any character". There's always "\D" meaning "any char that isn't
a digit".

Thanks Andy, and the others who have replied in the same vein.

I'm pretty sure you are correct about the Folder Routing rules.

But the VFH explicitly says this for the Envelope Rejection rules:-

=======================================

New/Modify Envelope Rejection Rule dialog

<snip>

Has reverse path:

Enter the address that errors are sent to. This will usually be who the
mail is from (except for SPAM). Matches a substring and Wildcards may be
used.

Copyright (c) 1995-2002 Thus plc.

=======================================

and 'Wildcards', when clicked on, expands to:-

(I had to OCR this, as it won't allow CTRL-C, and the third option on
the Help to search for any character string doesn't seem to work on
Windows 10, but I think it is correct - anyone with TP Help still
working should be able to independently check it)

=======================================

Wildcards

When you want to match text, e.g. in the subject lines, or body text of
a message, you can in some cases use the wildcard characters ? and
*. ? means match a single character and * means match any number of
characters.

There is always an implied * at the beginning and end of the match
string so that you can match any substring of the target text without
using any extra wildcards.

Examples

To match any subject line containing the word astrology anywhere, the
match string should be just astrology.
The match string b?nd would match band, bond, bend or bind anywhere in
the line.
The match string e?e*nts would match events, elephants or elements.

=======================================

Though I'm probably very late indeed to be pointing out a bug, or at
least an ambiguity, in the TP Help, if this is what this is :-)

Anyway, I have now put both formulations, with and without the '.', in
both places, and I will see how I get on.

[J. P. Gilliver (John)]

In message <***@acanthus.demon.co.uk>, Roy Brown
<***@kelmscott.co.uk> writes:
[]

Post by Roy Brown
=======================================
Wildcards
When you want to match text, e.g. in the subject lines, or body text of
a message, you can in some cases use the wildcard characters ? and
*. ? means match a single character and * means match any number of
characters.
There is always an implied * at the beginning and end of the match
string so that you can match any substring of the target text without
using any extra wildcards.
Examples
To match any subject line containing the word astrology anywhere, the
match string should be just astrology.
The match string b?nd would match band, bond, bend or bind anywhere in
the line.
The match string e?e*nts would match events, elephants or elements.
=======================================
Though I'm probably very late indeed to be pointing out a bug, or at
least an ambiguity, in the TP Help, if this is what this is :-)
Anyway, I have now put both formulations, with and without the '.', in
both places, and I will see how I get on.

I think their get-out clause is those three words "in some cases" (-:.
In some cases, you can use the standard wildcards (e. g. "*"), in others
you have to use the regex ones (e. g. ".*"). And remembering where you
can use one and where you have to use the other is a little taxing!

[SilverE]

Post by J. P. Gilliver (John)
[]

Post by Roy Brown
=======================================
Wildcards
When you want to match text, e.g. in the subject lines, or body text
of a message, you can in some cases use the wildcard characters ? and
*. ? means match a single character and * means match any number of
characters.
There is always an implied * at the beginning and end of the match
string so that you can match any substring of the target text without
using any extra wildcards.
Examples
To match any subject line containing the word astrology anywhere, the
match string should be just astrology.
The match string b?nd would match band, bond, bend or bind anywhere in
the line.
The match string e?e*nts would match events, elephants or elements.
=======================================
Though I'm probably very late indeed to be pointing out a bug, or at
least an ambiguity, in the TP Help, if this is what this is :-)
Anyway, I have now put both formulations, with and without the '.', in
both places, and I will see how I get on.

I think their get-out clause is those three words "in some cases" (-:.
In some cases, you can use the standard wildcards (e. g. "*"), in
others you have to use the regex ones (e. g. ".*"). And remembering
where you can use one and where you have to use the other is a little
taxing!

There is subtly different wording in the pdf Manual

Post by J. P. Gilliver (John)

Post by Roy Brown
=======================================

When you want to tell Turnpike a name or a topic to look for in
newsgroup names, subject lines, or message text, you can use the
wildcard characters ? and *

Post by J. P. Gilliver (John)

Post by Roy Brown
=======================================

which (by omitting "e.g.") restricts this to only "newsgroup names,
subject lines, or message text". I believe that to be the case, and
elsewhere Custom Rules rules apply.

[Roy Brown]

In message <BbjewwBZ3z2ZFw+***@inspace.screaming.invalid>, SilverE
<***@localhost.invalid> writing at 10:14:01 in his/her local time
opines:-

Post by SilverE
There is subtly different wording in the pdf Manual

Post by Roy Brown
=======================================

When you want to tell Turnpike a name or a topic to look for in
newsgroup names, subject lines, or message text, you can use the
wildcard characters ? and *

Post by Roy Brown
=======================================

which (by omitting "e.g.") restricts this to only "newsgroup names,
subject lines, or message text". I believe that to be the case, and
elsewhere Custom Rules rules apply.

I'm pleased to report that the rules, with .* and .? rather than just *
and ? are now working.

Once I got over the issue that, surprisingly, my rule was rejecting a
bunch of mail I didn't intend it to, due to its wide interpretation of
.*

I have several formulations of the rule under Email Routeing, both
Envelope and Mail Rejection.

I don't know quite which one is working, and Turnpike does not tell you.
But scanning the log, all the rejections are now the stuff I intended to
reject.

If I cared enough, I would put a 'cuckoo' (something that means the rule
won't fire, but that I can easily remove to get the original rule back)
in each in turn until they stopped working again, but if it ain't
broke.....

Thanks for all the fish....

[SilverE]

At 10:52:21 on Tue, 17 Oct 2017, Roy Brown wrote in
<***@acanthus.demon.co.uk>
<>

Post by Roy Brown
If I cared enough, I would put a 'cuckoo' (something that means the
rule won't fire, but that I can easily remove to get the original rule
back) in each in turn until they stopped working again, but if it ain't
broke.....
Thanks for all the fish....

I have a rule to Accept ".*" (i.e. everything), and I move rules below
that to see the effect, so I don't have to edit them, just move them
back up if they are effective.

[Roy Brown]

In message <B+***@inspace.screaming.invalid>, SilverE
<***@localhost.invalid> writing at 18:36:19 in his/her local time
opines:-

Post by SilverE
At 10:52:21 on Tue, 17 Oct 2017, Roy Brown wrote in
<>

Post by Roy Brown
If I cared enough, I would put a 'cuckoo' (something that means the
rule won't fire, but that I can easily remove to get the original rule
back) in each in turn until they stopped working again, but if it
ain't broke.....
Thanks for all the fish....

I have a rule to Accept ".*" (i.e. everything), and I move rules below
that to see the effect, so I don't have to edit them, just move them
back up if they are effective.

Neat.

I may try that.....

[J. P. Gilliver (John)]

Post by Roy Brown
opines:-

Post by SilverE
At 10:52:21 on Tue, 17 Oct 2017, Roy Brown wrote in
<>

Post by Roy Brown
If I cared enough, I would put a 'cuckoo' (something that means the
rule won't fire, but that I can easily remove to get the original
rule back) in each in turn until they stopped working again, but if
it ain't broke.....
Thanks for all the fish....

I have a rule to Accept ".*" (i.e. everything), and I move rules below
that to see the effect, so I don't have to edit them, just move them
back up if they are effective.

Neat.
I may try that.....

I have similar, except that it's just "*" in one of the predefined
fields (e. g. from or subject). It's certainly worth doing if you want
to experiment with a long convoluted rule, so you don't have to enter it
all over again after trying without it.

[Andy]

In message <j3hof$***@soft255.demon.co.uk>, "J. P. Gilliver
(John)" <G6JPG-***@255soft.uk> wrote
[]

Post by J. P. Gilliver (John)
I have similar, except that it's just "*" in one of the predefined
fields (e. g. from or subject).

Care needed: I have over 100 legitimate emails in my archive with no
subject. All do have a From, though.

[J. P. Gilliver (John)]

Post by Andy
[]

Post by J. P. Gilliver (John)
I have similar, except that it's just "*" in one of the predefined
fields (e. g. from or subject).

Care needed: I have over 100 legitimate emails in my archive with no
subject. All do have a From, though.

Yes, I suppose "subject containing *" would match an empty one. I had
thought I had them with subject, but when I looked before posting the
above, I could only find a From one (though I didn't look through all
'groups).

[John Hall]

Post by Roy Brown
I used to be good at custom rules, but I seem to have grown rusty :-(
Anyone like to suggest what I might be doing wrong?

Sadly, I'm very rusty too, but I'd expect the Very Fine Help to answer
your question, if you can find the right place to look.

I've just checked my own Envelope Rejection rules to see if they would
provide any clues, but sadly I don't seem to have any any more. Another
possibility might be to do a Google search on "custom rules Turnpike",
to see if it picks up any relevant posts to this newsgroup archived on
Googlegroups. I've checked on Jim Crowther's admirable plainfaqs site,
but it doesn't seem to cover envelope rejection.

One other thought: the regular expressions that TP uses between the
slashes for its custom rules are a standard notation and there will be
several sites on the web setting out the syntax. In fact a search on
"regular expressions tutorial" turns up dozens of them.

[John Hall]

Post by John Hall
Sadly, I'm very rusty too, but I'd expect the Very Fine Help to answer
your question, if you can find the right place to look.

Having looked at the VFH myself, I found "? 0 or 1 of the previous
character", which I suspect wasn't what you intended. A full stop
matches any character.

[J. P. Gilliver (John)]

Post by Roy Brown
Hi
I'm getting some spams, obviously all from the same source, where there
is a common factor in the Return Paths, e.g.:-
So it seems to me that the Envelope Rejection rule:-
(* includes the dash -, ? replaces the equals sign = in case these
aren't quite what they seem)

[]
Should the "*" have been either "." or ".*"? (Without the "".)

[John Hall]

Post by J. P. Gilliver (John)

Post by Roy Brown
Hi
I'm getting some spams, obviously all from the same source, where
there is a common factor in the Return Paths, e.g.:-
So it seems to me that the Envelope Rejection rule:-
(* includes the dash -, ? replaces the equals sign = in case these
aren't quite what they seem)

[]
Should the "*" have been either "." or ".*"? (Without the "".)

It's starting to come back to me. I think the * may need to be .* which
IIRC matches any string ( . is any character and the * says any number
from 0 upwards).

[SilverE]

Post by John Hall

Post by J. P. Gilliver (John)

Post by Roy Brown
Hi
I'm getting some spams, obviously all from the same source, where
there is a common factor in the Return Paths, e.g.:-
So it seems to me that the Envelope Rejection rule:-
(* includes the dash -, ? replaces the equals sign = in case these
aren't quite what they seem)

[]
Should the "*" have been either "." or ".*"? (Without the "".)

It's starting to come back to me. I think the * may need to be .*
which IIRC matches any string ( . is any character and the * says any
number from 0 upwards).

Yes indeed, and also the "?" should be replaced by "." as ? means zero
or 1 of the preceding char.

These rules are RegEx, the MSDOS wildcards do not apply here