On 1/24/19 12:15 AM, Per Jessen wrote:> Trever L. Adams wrote: > >> I know that sieve doesn't do math. The file would be created >> externally. >> >> Based on examples in section 4.4 of >> https://tools.ietf.org/html/rfc5260#section-4 >> >> I figured something like this would work. >> >> if date :value "le" :originalzone "date" "date" "2018-10-25" { >> fileinto "SPAM"; >> stop; >> } >> >> However, I get the following. >> >> spam: line 41: error: unknown tagged argument ':value' for the date >> test (reported only once at first occurrence). >> spam: error: validation failed. >> sievec(root): Fatal: failed to compile sieve script 'spam.sieve' >> >> Does anyone have any advice on how to get this working? > Hi Trever > > here is a snippet I use occasionally: > > if allof( > currentdate :zone "+0200" :value "ge" "iso8601" "2017-09-04T00:00:00+02:00", > currentdate :zone "+0200" :value "le" "iso8601" "2017-09-06T18:09:00+02:00" > ) > > > HTH > PerPlease, correct me if I am wrong. This looks at the system clock. I need to look at the date in the email (Date header). I am trying to catch spam that hides 6-9 months in the past (in the last week I have had two from August 2018 show up... obviously forged header, but...). Thanks. Trever -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: OpenPGP digital signature URL: <https://dovecot.org/pipermail/dovecot/attachments/20190124/cddce197/attachment.sig>
On 1/24/19 6:01 AM, Trever L. Adams wrote:> On 1/24/19 12:15 AM, Per Jessen wrote: >> Trever L. Adams wrote: >> >>> I know that sieve doesn't do math. The file would be created >>> externally. >>> >>> Based on examples in section 4.4 of >>> https://tools.ietf.org/html/rfc5260#section-4 >>> >>> I figured something like this would work. >>> >>> if date :value "le" :originalzone "date" "date" "2018-10-25" { >>> fileinto "SPAM"; >>> stop; >>> } >>> >>> However, I get the following. >>> >>> spam: line 41: error: unknown tagged argument ':value' for the date >>> test (reported only once at first occurrence). >>> spam: error: validation failed. >>> sievec(root): Fatal: failed to compile sieve script 'spam.sieve' >>> >>> Does anyone have any advice on how to get this working? >> Hi Trever >> >> here is a snippet I use occasionally: >> >> if allof( >> currentdate :zone "+0200" :value "ge" "iso8601" "2017-09-04T00:00:00+02:00", >> currentdate :zone "+0200" :value "le" "iso8601" "2017-09-06T18:09:00+02:00" >> ) >> >> >> HTH >> Per > > Please, correct me if I am wrong. This looks at the system clock. I need > to look at the date in the email (Date header). I am trying to catch > spam that hides 6-9 months in the past (in the last week I have had two > from August 2018 show up... obviously forged header, but...). > > Thanks. > > Trever > >Thank you Per. My problem was I wasn't requiring relational. With it, this works: if date :originalzone :value "le" "date" "date" "2018-10-26" { ??????? fileinto "SPAM"; ??????? stop; } I am sorry for the noise. Obviously, anyone using the above snippet will need something to modify the date on a regular basis so it is say 90 days in the past or what not. Thank you again. Trever -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: OpenPGP digital signature URL: <https://dovecot.org/pipermail/dovecot/attachments/20190124/a5c3ff2c/attachment.sig>
Trever L. Adams wrote:> On 1/24/19 12:15 AM, Per Jessen wrote: >> Trever L. Adams wrote: >> >>> I know that sieve doesn't do math. The file would be created >>> externally. >>> >>> Based on examples in section 4.4 of >>> https://tools.ietf.org/html/rfc5260#section-4 >>> >>> I figured something like this would work. >>> >>> if date :value "le" :originalzone "date" "date" "2018-10-25" { >>> fileinto "SPAM"; >>> stop; >>> } >>> >>> However, I get the following. >>> >>> spam: line 41: error: unknown tagged argument ':value' for the date >>> test (reported only once at first occurrence). >>> spam: error: validation failed. >>> sievec(root): Fatal: failed to compile sieve script 'spam.sieve' >>> >>> Does anyone have any advice on how to get this working? >> Hi Trever >> >> here is a snippet I use occasionally: >> >> if allof( >> currentdate :zone "+0200" :value "ge" "iso8601" "2017-09-04T00:00:00+02:00", >> currentdate :zone "+0200" :value "le" "iso8601" "2017-09-06T18:09:00+02:00" >> ) >> >> >> HTH >> Per > > > Please, correct me if I am wrong. This looks at the system clock. I need > to look at the date in the email (Date header).Sorry, I misunderstood. I rely on spamassasssin to deal with spam. /Per
On 24 Jan 2019, at 10:07, Per Jessen <per at computer.org> wrote:> Sorry, I misunderstood.Same> I rely on spamassasssin to deal with spam.Same. SA has rules like DATE_IN_PAST_06_12 which scores for messages that are 6 to 12 HOURS in the past. The highest scoring one is for message more than 96 hours old. -- The King of Marigold was in the kitchen cooking breakfast for the Queen The Queen was in the parlor playing piano for the children of the King
On 1/24/19 10:07 AM, Per Jessen wrote:> > Sorry, I misunderstood. > > I rely on spamassasssin to deal with spam. > > > /Per > >You still led me to the correct solution. I use dspam. Occassionally some odd spams get through. Usually they are using this date trick (not that it fools dspam). The problem is the content is novel. So, I am using this to catch what cannot be caught the other ways. Trever -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 228 bytes Desc: OpenPGP digital signature URL: <https://dovecot.org/pipermail/dovecot/attachments/20190125/7e8d98ce/attachment.sig>