You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by qu...@apache.org on 2004/03/01 23:22:30 UTC
svn commit: rev 6954 - incubator/spamassassin/trunk/rules
Author: quinlan
Date: Mon Mar 1 14:22:28 2004
New Revision: 6954
Modified:
incubator/spamassassin/trunk/rules/70_testing.cf
Log:
T_DOUBLE_IP_* evolves
Modified: incubator/spamassassin/trunk/rules/70_testing.cf
==============================================================================
--- incubator/spamassassin/trunk/rules/70_testing.cf (original)
+++ incubator/spamassassin/trunk/rules/70_testing.cf Mon Mar 1 14:22:28 2004
@@ -377,29 +377,27 @@
describe T_RCVD_DOUBLE_IP_SPAM Bulk email fingerprint (double IP) found
# some looser variants
-header __DOUBLE_IP_LOOSE_1 Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b.{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b/i
-meta T_RCVD_DOUBLE_IP_LOOSE_1 (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_1)
-describe T_RCVD_DOUBLE_IP_LOOSE_1 Received: by and from are both IP addresses
+header __DOUBLE_IP_LOOSE_A Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b/i
+meta T_RCVD_DOUBLE_IP_LOOSE_A (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_A)
+describe T_RCVD_DOUBLE_IP_LOOSE_A Received: by and from are both IP addresses
-header __DOUBLE_IP_LOOSE_2 Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b(?!\.).{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b(?!\.)/i
-meta T_RCVD_DOUBLE_IP_LOOSE_2 (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_2)
-describe T_RCVD_DOUBLE_IP_LOOSE_2 Received: by and from are both IP addresses
+# should be the same as A except shorter
+header __DOUBLE_IP_LOOSE_B Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{0,4}){2}/i
+meta T_RCVD_DOUBLE_IP_LOOSE_B (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_B)
+describe T_RCVD_DOUBLE_IP_LOOSE_B Received: by and from are both IP addresses
-header __DOUBLE_IP_LOOSE_3 Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b(?![.-]).{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}(?<!127\.0\.0\.1)\b(?![.-])/i
-meta T_RCVD_DOUBLE_IP_LOOSE_3 (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_3)
-describe T_RCVD_DOUBLE_IP_LOOSE_3 Received: by and from are both IP addresses
+# longer distances between from and by
+header __DOUBLE_IP_LOOSE_C Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{0,32}){2}/i
+meta T_RCVD_DOUBLE_IP_LOOSE_C (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_C)
+describe T_RCVD_DOUBLE_IP_LOOSE_C Received: by and from are both IP addresses
-header __DOUBLE_IP_LOOSE_4 Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}[.-]\d{1,3}[.-]\d{1,3}[.-]\d{1,3}(?<!127\.0\.0\.1)\b.{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}[.-]\d{1,3}[.-]\d{1,3}[.-]\d{1,3}(?<!127\.0\.0\.1)\b/i
-meta T_RCVD_DOUBLE_IP_LOOSE_4 (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_4)
-describe T_RCVD_DOUBLE_IP_LOOSE_4 Received: by and from are both IP addresses
+header __DOUBLE_IP_LOOSE_D Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{0,64}){2}/i
+meta T_RCVD_DOUBLE_IP_LOOSE_D (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_D)
+describe T_RCVD_DOUBLE_IP_LOOSE_D Received: by and from are both IP addresses
-header __DOUBLE_IP_LOOSE_5 Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b/i
-meta T_RCVD_DOUBLE_IP_LOOSE_5 (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_5)
-describe T_RCVD_DOUBLE_IP_LOOSE_5 Received: by and from are both IP addresses
-
-header __DOUBLE_IP_LOOSE_6 Received =~ /\b(?:from|by)\b.{1,4}\b\d{1,3}\D\d{1,3}\D\d{1,3}\D\d{1,3}(?<!127\.0\.0\.1)\b.{1,4}\b(?:by|from)\b.{1,4}\b\d{1,3}\D\d{1,3}\D\d{1,3}\D\d{1,3}(?<!127\.0\.0\.1)\b/i
-meta T_RCVD_DOUBLE_IP_LOOSE_6 (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_6)
-describe T_RCVD_DOUBLE_IP_LOOSE_6 Received: by and from are both IP addresses
+header __DOUBLE_IP_LOOSE_E Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(?<!127\.0\.0\.1)\b.*){2}/i
+meta T_RCVD_DOUBLE_IP_LOOSE_E (!T_RCVD_DOUBLE_IP_SPAM && __DOUBLE_IP_LOOSE_E)
+describe T_RCVD_DOUBLE_IP_LOOSE_E Received: by and from are both IP addresses
header T_MIME_BOUND_DIGITS15 Content-Type =~ /boundary=\"\d{15,}\"/
describe T_MIME_BOUND_DIGITS15 MIME boundary contains all digits