From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Fri, 1 May 2015 15:51:34 +0000 (+0100)
Subject: Add negation for forged thunderbird MID in case of maillist.
X-Git-Tag: 0.9.0~112
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=390c8290d7747e2ab53a821e8077ab3fc80a706f;p=thirdparty%2Frspamd.git

Add negation for forged thunderbird MID in case of maillist.
---

diff --git a/conf/composites.conf b/conf/composites.conf
index 35c23c3753..1a0dacb68e 100644
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -10,7 +10,11 @@ composite {
 }
 composite {
     name = "FORGED_MUA_OUTLOOK_MAILLIST";
-    expression = "FORGED_MUA_OUTLOOK and MAILLIST";
+    expression = "FORGED_MUA_OUTLOOK and -MAILLIST";
+}
+composite {
+    name = "FORGED_MUA_THUNDERBIRD_MSGID_MAILLIST";
+    expression = "(FORGED_MUA_THUNDERBIRD_MSGID orFORGED_MUA_THUNDERBIRD_MSGID_UNKNOWN) and -MAILLIST";
 }
 composite {
     name = "RBL_SPAMHAUS_XBL";
diff --git a/conf/metrics.conf b/conf/metrics.conf
index 75abf37ae5..7c48392455 100644
--- a/conf/metrics.conf
+++ b/conf/metrics.conf
@@ -393,6 +393,11 @@ metric {
 	        description = "Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID";
 	        name = "FORGED_MUA_THUNDERBIRD_MSGID";
 	    }
+	    symbol {
+	        weight = 0.0;
+	        description = "Avoid false positives for FORGED_MUA_THUNDERBIRD_MSGID in maillist";
+	        name = "FORGED_MUA_THUNDERBIRD_MSGID_MAILLIST";
+	    }
 	    symbol {
 	        weight = 2.500000;
 	        description = "Forged mail pretending to be from Mozilla Thunderbird but has forged Message-ID";