{"action":"created","issue":{"url":"https://api.github.com/repos/vstakhov/rspamd/issues/514","repository_url":"https://api.github.com/repos/vstakhov/rspamd","labels_url":"https://api.github.com/repos/vstakhov/rspamd/issues/514/labels{/name}","comments_url":"https://api.github.com/repos/vstakhov/rspamd/issues/514/comments","events_url":"https://api.github.com/repos/vstakhov/rspamd/issues/514/events","html_url":"https://github.com/vstakhov/rspamd/issues/514","id":131551194,"number":514,"title":"\"MISSING_MIMEOLE\" rule incorrectly interpreted (fixed in SpamAssassin, broken in rspamd).","user":{"login":"ilyakruchinin","id":16409780,"avatar_url":"https://avatars.githubusercontent.com/u/16409780?v=3","gravatar_id":"","url":"https://api.github.com/users/ilyakruchinin","html_url":"https://github.com/ilyakruchinin","followers_url":"https://api.github.com/users/ilyakruchinin/followers","following_url":"https://api.github.com/users/ilyakruchinin/following{/other_user}","gists_url":"https://api.github.com/users/ilyakruchinin/gists{/gist_id}","starred_url":"https://api.github.com/users/ilyakruchinin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ilyakruchinin/subscriptions","organizations_url":"https://api.github.com/users/ilyakruchinin/orgs","repos_url":"https://api.github.com/users/ilyakruchinin/repos","events_url":"https://api.github.com/users/ilyakruchinin/events{/privacy}","received_events_url":"https://api.github.com/users/ilyakruchinin/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-05T04:23:58Z","updated_at":"2016-02-16T04:01:56Z","closed_at":null,"body":"IMPORTANT: see next message for details and a bugreport (this rule/rating has been fixed in SpamAssassin long ago).\r\n\r\nVersion: rspamd 1.1.1\r\n\r\nWe are using rspamd as outbound antispam.\r\nA user has complained that some of his messages get bounced.\r\nI checked and some (not all) of his messages get:\r\n\r\n> Feb 01 16:59:21 antispam rspamd[497]: (normal) <e585be>; task; rspamd_task_write_log: id: <000801d15cb5$cfd5db30$6f819190$@contoso.com>, qid: <1aQ7WC-00082L-Rz>, ip: XXX.XX.XX.XX, from: <john@contoso.com>, (default: T (reject): [15.09/15.00] [**MISSING_MIMEOLE,FORGED_OUTLOOK_TAGS**,SUBJ_ALL_CAPS,HFILTER_HELO_IP_A,HFILTER_HOSTNAME_UNKNOWN]), len: 48467, time: 397.687ms real, 30.368ms virtual, dns req: 38\r\n\r\nI've discussed it with the user and he's using Outlook, not using any other email software.\r\nHere's a different message from the same user (for comparison), where NO scores are assigned for MISSING_MIMEOLE or FORGED_OUTLOOK_TAGS:\r\n\r\n> Feb 02 09:31:46 antispam rspamd[497]: (normal) <31f3e2>; task; rspamd_task_write_log: id: <000601d15d40$7623e8d0$626bba70$@contoso.com>, qid: <1aQN0b-000A3a-Mx>, ip: 111.67.28.43, from: <john@contoso.com>, (default: F (no action): [2.00/15.00] [HFILTER_HELO_IP_A,URIBL_BLOCKED,BAYES_HAM,HFILTER_HOSTNAME_UNKNOWN]), len: 52298, time: 408.724ms real, 20.649ms virtual, dns req: 54\r\n\r\nFor the first example of \"incorrectly detected as missing_mimeole/forged_outlook_tags - below are the headers from exim4 rejectlog:\r\n\r\n```\r\n2016-02-01 16:59:21 1aQ7WC-00082L-Rz H=(wp010.contoso.com) [XXX.XX.XX.XX] F=<john@contoso.com> rejected after DATA: Message discarded as high-probability spam 15.1 reject\r\nEnvelope-from: <john@contoso.com>\r\nEnvelope-to: <aaron@contoso.com>\r\n    ...\r\nP Received: from [XXX.XX.XX.XX] (helo=contoso.com)\r\n        by antispam.contoso.com with esmtp (Exim 4.86)\r\n        (envelope-from <john@contoso.com>)\r\n        id 1aQ7WC-00082L-Rz; Mon, 01 Feb 2016 16:59:20 +1100\r\nP Received: from Giovanni ([YYY.YY.YY>YY]) by wp010.contoso.com with MailEnable ESMTP; Mon, 1 Feb 2016 16:59:14 +1100\r\nF From: <john@contoso.com>\r\nT To: <prash@contoso.com>\r\n  References:\r\n  In-Reply-To:\r\n  Subject: RE: 2016 DESIGN GROUP STRATEGIC CONFERENCE\r\n  Date: Mon, 1 Feb 2016 17:00:10 +1100\r\nI Message-ID: <000801d15cb5$cfd5db30$6f819190$@contoso.com>\r\n  MIME-Version: 1.0\r\n  Content-Type: multipart/related;\r\n        boundary=\"----=_NextPart_000_0009_01D15D12.03484F00\"\r\n  X-Priority: 1 (Highest)\r\n  X-MSMail-Priority: High\r\n  X-Mailer: Microsoft Outlook 15.0\r\n  Thread-Index: AdFMtJ4fItqFX3o2T5yHfZbyYOiEtAP/cbUw\r\n  Content-Language: en-au\r\n  Importance: High\r\n  X-ME-Bayesian: 0.000000\r\n```"},"comment":{"url":"https://api.github.com/repos/vstakhov/rspamd/issues/comments/184507699","html_url":"https://github.com/vstakhov/rspamd/issues/514#issuecomment-184507699","issue_url":"https://api.github.com/repos/vstakhov/rspamd/issues/514","id":184507699,"user":{"login":"ilyakruchinin","id":16409780,"avatar_url":"https://avatars.githubusercontent.com/u/16409780?v=3","gravatar_id":"","url":"https://api.github.com/users/ilyakruchinin","html_url":"https://github.com/ilyakruchinin","followers_url":"https://api.github.com/users/ilyakruchinin/followers","following_url":"https://api.github.com/users/ilyakruchinin/following{/other_user}","gists_url":"https://api.github.com/users/ilyakruchinin/gists{/gist_id}","starred_url":"https://api.github.com/users/ilyakruchinin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ilyakruchinin/subscriptions","organizations_url":"https://api.github.com/users/ilyakruchinin/orgs","repos_url":"https://api.github.com/users/ilyakruchinin/repos","events_url":"https://api.github.com/users/ilyakruchinin/events{/privacy}","received_events_url":"https://api.github.com/users/ilyakruchinin/received_events","type":"User","site_admin":false},"created_at":"2016-02-16T04:01:56Z","updated_at":"2016-02-16T04:01:56Z","body":"Could you please correct the rule (for example, using the suggested workaround for SA)? Lots of false positives."}}