You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by km...@apache.org on 2018/09/16 14:36:13 UTC
svn commit: r1841017 [10/17] - in /spamassassin/site/full/3.4.x: ./ doc/
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,263 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#TAGS">TAGS</a></li>
+ <li><a href="#SEE-ALSO">SEE ALSO</a></li>
+ <li><a href="#USER-SETTINGS">USER SETTINGS</a></li>
+ <li><a href="#ADMINISTRATOR-SETTINGS">ADMINISTRATOR SETTINGS</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>Mail::SpamAssassin::Plugin::DKIM - perform DKIM verification tests</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::DKIM [/path/to/DKIM.pm]</code></pre>
+
+<p>Taking into account signatures from any signing domains:</p>
+
+<pre><code> full DKIM_SIGNED eval:check_dkim_signed()
+ full DKIM_VALID eval:check_dkim_valid()
+ full DKIM_VALID_AU eval:check_dkim_valid_author_sig()
+ full DKIM_VALID_EF eval:check_dkim_valid_envelopefrom()</code></pre>
+
+<p>Taking into account signatures from specified signing domains only: (quotes may be omitted on domain names consisting only of letters, digits, dots, and minus characters)</p>
+
+<pre><code> full DKIM_SIGNED_MY1 eval:check_dkim_signed('dom1','dom2',...)
+ full DKIM_VALID_MY1 eval:check_dkim_valid('dom1','dom2',...)
+ full DKIM_VALID_AU_MY1 eval:check_dkim_valid_author_sig('d1','d2',...)
+
+ full __DKIM_DEPENDABLE eval:check_dkim_dependable()</code></pre>
+
+<p>Author Domain Signing Practices (ADSP) from any author domains:</p>
+
+<pre><code> header DKIM_ADSP_NXDOMAIN eval:check_dkim_adsp('N')
+ header DKIM_ADSP_ALL eval:check_dkim_adsp('A')
+ header DKIM_ADSP_DISCARD eval:check_dkim_adsp('D')
+ header DKIM_ADSP_CUSTOM_LOW eval:check_dkim_adsp('1')
+ header DKIM_ADSP_CUSTOM_MED eval:check_dkim_adsp('2')
+ header DKIM_ADSP_CUSTOM_HIGH eval:check_dkim_adsp('3')</code></pre>
+
+<p>Author Domain Signing Practices (ADSP) from specified author domains only:</p>
+
+<pre><code> header DKIM_ADSP_MY1 eval:check_dkim_adsp('*','dom1','dom2',...)
+
+ describe DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
+ describe DKIM_VALID Message has at least one valid DKIM or DK signature
+ describe DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain
+ describe DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain
+ describe __DKIM_DEPENDABLE A validation failure not attributable to truncation
+
+ describe DKIM_ADSP_NXDOMAIN Domain not in DNS and no valid author domain signature
+ describe DKIM_ADSP_ALL Domain signs all mail, no valid author domain signature
+ describe DKIM_ADSP_DISCARD Domain signs all mail and suggests discarding mail with no valid author domain signature, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_LOW adsp_override is CUSTOM_LOW, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_MED adsp_override is CUSTOM_MED, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_HIGH adsp_override is CUSTOM_HIGH, no valid author domain signature</code></pre>
+
+<p>For compatibility with pre-3.3.0 versions, the following are synonyms:</p>
+
+<pre><code> OLD: eval:check_dkim_verified = NEW: eval:check_dkim_valid
+ OLD: eval:check_dkim_signall = NEW: eval:check_dkim_adsp('A')
+ OLD: eval:check_dkim_signsome = NEW: redundant, semantically always true</code></pre>
+
+<p>The __DKIM_DEPENDABLE eval rule deserves an explanation. The rule yields true when signatures are supplied by a caller, OR ELSE when signatures are obtained by this plugin AND either there are no signatures OR a rule __TRUNCATED was false. In other words: __DKIM_DEPENDABLE is true when failed signatures can not be attributed to message truncation when feeding a message to SpamAssassin. It can be consulted to prevent false positives on large but truncated messages with poor man's implementation of ADSP by hand-crafted rules.</p>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>This SpamAssassin plugin implements DKIM lookups as described by the RFC 4871, as well as historical DomainKeys lookups, as described by RFC 4870, thanks to the support for both types of signatures by newer versions of module Mail::DKIM.</p>
+
+<p>It requires the <code>Mail::DKIM</code> CPAN module to operate. Many thanks to Jason Long for that module.</p>
+
+<h1 id="TAGS">TAGS</h1>
+
+<p>The following tags are added to the set, available for use in reports, header fields, other plugins, etc.:</p>
+
+<pre><code> _DKIMIDENTITY_
+ Agent or User Identifier (AUID) (the 'i' tag) from valid signatures;
+
+ _DKIMDOMAIN_
+ Signing Domain Identifier (SDID) (the 'd' tag) from valid signatures;
+
+ _DKIMSELECTOR_
+ DKIM selector (the 's' tag) from valid signatures;</code></pre>
+
+<p>Identities and domains from signatures which failed verification are not included in these tags. Duplicates are eliminated (e.g. when there are two or more valid signatures from the same signer, only one copy makes it into a tag). Note that there may be more than one signature in a message - currently they are provided as a space-separated list, although this behaviour may change.</p>
+
+<h1 id="SEE-ALSO">SEE ALSO</h1>
+
+<p><code>Mail::DKIM</code>, <code>Mail::SpamAssassin::Plugin</code></p>
+
+<pre><code> http://jason.long.name/dkimproxy/
+ http://tools.ietf.org/rfc/rfc4871.txt
+ http://tools.ietf.org/rfc/rfc4870.txt
+ http://tools.ietf.org/rfc/rfc5617.txt
+ http://ietf.org/html.charters/dkim-charter.html</code></pre>
+
+<h1 id="USER-SETTINGS">USER SETTINGS</h1>
+
+<dl>
+
+<dt id="whitelist_from_dkim-author-example.com-signing-domain">whitelist_from_dkim author@example.com [signing-domain]</dt>
+<dd>
+
+<p>Works similarly to whitelist_from, except that in addition to matching an author address (From) to the pattern in the first parameter, the message must also carry a valid Domain Keys Identified Mail (DKIM) signature made by a signing domain (SDID, i.e. the d= tag) that is acceptable to us.</p>
+
+<p>Only one whitelist entry is allowed per line, as in <code>whitelist_from_rcvd</code>. Multiple <code>whitelist_from_dkim</code> lines are allowed. File-glob style characters are allowed for the From address (the first parameter), just like with <code>whitelist_from_rcvd</code>.</p>
+
+<p>The second parameter (the signing-domain) does not accept full file-glob style wildcards, although a simple '*.' (or just a '.') prefix to a domain name is recognized and implies any subdomain of the specified domain (but not the domain itself).</p>
+
+<p>If no signing-domain parameter is specified, the only acceptable signature will be an Author Domain Signature (sometimes called first-party signature) which is a signature where the signing domain (SDID) of a signature matches the domain of the author's address (i.e. the address in a From header field).</p>
+
+<p>Since this whitelist requires a DKIM check to be made, network tests must be enabled.</p>
+
+<p>Examples of whitelisting based on an author domain signature (first-party):</p>
+
+<pre><code> whitelist_from_dkim joe@example.com
+ whitelist_from_dkim *@corp.example.com
+ whitelist_from_dkim *@*.example.com</code></pre>
+
+<p>Examples of whitelisting based on third-party signatures:</p>
+
+<pre><code> whitelist_from_dkim jane@example.net example.org
+ whitelist_from_dkim rick@info.example.net example.net
+ whitelist_from_dkim *@info.example.net example.net
+ whitelist_from_dkim *@* mail7.remailer.example.com
+ whitelist_from_dkim *@* *.remailer.example.com</code></pre>
+
+</dd>
+<dt id="def_whitelist_from_dkim-author-example.com-signing-domain">def_whitelist_from_dkim author@example.com [signing-domain]</dt>
+<dd>
+
+<p>Same as <code>whitelist_from_dkim</code>, but used for the default whitelist entries in the SpamAssassin distribution. The whitelist score is lower, because these are often targets for abuse of public mailers which sign their mail.</p>
+
+</dd>
+<dt id="unwhitelist_from_dkim-author-example.com-signing-domain">unwhitelist_from_dkim author@example.com [signing-domain]</dt>
+<dd>
+
+<p>Removes an email address with its corresponding signing-domain field from def_whitelist_from_dkim and whitelist_from_dkim tables, if it exists. Parameters to unwhitelist_from_dkim must exactly match the parameters of a corresponding whitelist_from_dkim or def_whitelist_from_dkim config option which created the entry, for it to be removed (a domain name is matched case-insensitively); i.e. if a signing-domain parameter was specified in a whitelisting command, it must also be specified in the unwhitelisting command.</p>
+
+<p>Useful for removing undesired default entries from a distributed configuration by a local or site-specific configuration or by <code>user_prefs</code>.</p>
+
+</dd>
+<dt id="adsp_override-domain-signing-practices">adsp_override domain [signing-practices]</dt>
+<dd>
+
+<p>Currently few domains publish their signing practices (RFC 5617 - ADSP), partly because the ADSP rfc is rather new, partly because they think hardly any recipient bothers to check it, and partly for fear that some recipients might lose mail due to problems in their signature validation procedures or mail mangling by mailers beyond their control.</p>
+
+<p>Nevertheless, recipients could benefit by knowing signing practices of a sending (author's) domain, for example to recognize forged mail claiming to be from certain domains which are popular targets for phishing, like financial institutions. Unfortunately, as signing practices are seldom published or are weak, it is hardly justifiable to look them up in DNS.</p>
+
+<p>To overcome this chicken-or-the-egg problem, the <code>adsp_override</code> mechanism allows recipients using SpamAssassin to override published or defaulted ADSP for certain domains. This makes it possible to manually specify a stronger (or weaker) signing practices than a signing domain is willing to publish (explicitly or by default), and also save on a DNS lookup.</p>
+
+<p>Note that ADSP (published or overridden) is only consulted for messages which do not contain a valid DKIM signature from the author's domain.</p>
+
+<p>According to RFC 5617, signing practices can be one of the following: <code>unknown</code>, <code>all</code> and <code>discardable</code>.</p>
+
+<p><code>unknown</code>: The domain might sign some or all email - messages from the domain may or may not have an Author Domain Signature. This is a default if a domain exists in DNS but no ADSP record is found.</p>
+
+<p><code>all</code>: All mail from the domain is signed with an Author Domain Signature.</p>
+
+<p><code>discardable</code>: All mail from the domain is signed with an Author Domain Signature. Furthermore, if a message arrives without a valid Author Domain Signature, the domain encourages the recipient(s) to discard it.</p>
+
+<p>ADSP lookup can also determine that a domain is "out of scope", i.e., the domain does not exist (NXDOMAIN) in the DNS.</p>
+
+<p>To override domain's signing practices in a SpamAssassin configuration file, specify an <code>adsp_override</code> directive for each sending domain to be overridden.</p>
+
+<p>Its first argument is a domain name. Author's domain is matched against it, matching is case insensitive. This is not a regular expression or a file-glob style wildcard, but limited wildcarding is still available: if this argument starts by a "*." (or is a sole "*"), author's domain matches if it is a subdomain (to one or more levels) of the argument. Otherwise (with no leading asterisk) the match must be exact (not a subdomain).</p>
+
+<p>An optional second parameter is one of the following keywords (case-insensitive): <code>nxdomain</code>, <code>unknown</code>, <code>all</code>, <code>discardable</code>, <code>custom_low</code>, <code>custom_med</code>, <code>custom_high</code>.</p>
+
+<p>Absence of this second parameter implies <code>discardable</code>. If a domain is not listed by a <code>adsp_override</code> directive nor does it explicitly publish any ADSP record, then <code>unknown</code> is implied for valid domains, and <code>nxdomain</code> for domains not existing in DNS. (Note: domain validity is only checked with versions of Mail::DKIM 0.37 or later (actually since 0.36_5), the <code>nxdomain</code> would never turn up with older versions).</p>
+
+<p>The strong setting <code>discardable</code> is useful for domains which are known to always sign their mail and to always send it directly to recipients (not to mailing lists), and are frequent targets of fishing attempts, such as financial institutions. The <code>discardable</code> is also appropriate for domains which are known never to send any mail.</p>
+
+<p>When a message does not contain a valid signature by the author's domain (the domain in a From header field), the signing practices pertaining to author's domain determine which of the following rules fire and contributes its score: DKIM_ADSP_NXDOMAIN, DKIM_ADSP_ALL, DKIM_ADSP_DISCARD, DKIM_ADSP_CUSTOM_LOW, DKIM_ADSP_CUSTOM_MED, DKIM_ADSP_CUSTOM_HIGH. Not more than one of these rules can fire for messages that have one author (but see below). The last three can only result from a 'signing-practices' as given in a <code>adsp_override</code> directive (not from a DNS lookup), and can serve as a convenient means of providing a different score if scores assigned to DKIM_ADSP_ALL or DKIM_ADSP_DISCARD are not considered suitable for some domains.</p>
+
+<p>RFC 5322 permits a message to have more than one author - multiple addresses may be listed in a single From header field. RFC 5617 defines that a message with multiple authors has multiple signing domain signing practices, but does not prescribe how these should be combined. In presence of multiple signing practices, more than one of the DKIM_ADSP_* rules may fire.</p>
+
+<p>As a precaution against firing DKIM_ADSP_* rules when there is a known local reason for a signature verification failure, the domain's ADSP is considered 'unknown' when DNS lookups are disabled or a DNS lookup encountered a temporary problem on fetching a public key from the author's domain. Similarly, ADSP is considered 'unknown' when this plugin did its own signature verification (signatures were not passed to SA by a caller) and a metarule __TRUNCATED was triggered, indicating the caller intentionally passed a truncated message to SpamAssassin, which was a likely reason for a signature verification failure.</p>
+
+<p>Example:</p>
+
+<pre><code> adsp_override *.mydomain.example.com discardable
+ adsp_override *.neversends.example.com discardable
+
+ adsp_override ebay.com
+ adsp_override *.ebay.com
+ adsp_override ebay.co.uk
+ adsp_override *.ebay.co.uk
+ adsp_override paypal.com
+ adsp_override *.paypal.com
+ adsp_override amazon.com
+ adsp_override ealerts.bankofamerica.com
+ adsp_override americangreetings.com
+ adsp_override egreetings.com
+ adsp_override bluemountain.com
+ adsp_override hallmark.com all
+ adsp_override *.hallmark.com all
+ adsp_override youtube.com custom_high
+ adsp_override google.com custom_low
+ adsp_override gmail.com custom_low
+ adsp_override googlemail.com custom_low
+ adsp_override yahoo.com custom_low
+ adsp_override yahoo.com.au custom_low
+ adsp_override yahoo.se custom_low
+
+ adsp_override junkmailerkbw0rr.com nxdomain
+ adsp_override junkmailerd2hlsg.com nxdomain
+
+ # effectively disables ADSP network DNS lookups for all other domains:
+ adsp_override * unknown
+
+ score DKIM_ADSP_ALL 2.5
+ score DKIM_ADSP_DISCARD 25
+ score DKIM_ADSP_NXDOMAIN 3
+
+ score DKIM_ADSP_CUSTOM_LOW 1
+ score DKIM_ADSP_CUSTOM_MED 3.5
+ score DKIM_ADSP_CUSTOM_HIGH 8</code></pre>
+
+</dd>
+<dt id="dkim_minimum_key_bits-n-default:-1024">dkim_minimum_key_bits n (default: 1024)</dt>
+<dd>
+
+<p>The smallest size of a signing key (in bits) for a valid signature to be considered for whitelisting. Additionally, the eval function check_dkim_valid() will return false on short keys when called with explicitly listed domains, and the eval function check_dkim_valid_author_sig() will return false on short keys (regardless of its arguments). Setting the option to 0 disables a key size check.</p>
+
+<p>Note that the option has no effect when the eval function check_dkim_valid() is called with no arguments (like in a rule DKIM_VALID). A mere presence of some valid signature on a message has no reputational value (without being associated with a particular domain), regardless of its key size - anyone can prepend its own signature on a copy of some third party mail and re-send it, which makes it no more trustworthy than without such signature. This is also a reason for a rule DKIM_VALID to have a near-zero score, i.e. a rule hit is only informational.</p>
+
+</dd>
+</dl>
+
+<h1 id="ADMINISTRATOR-SETTINGS">ADMINISTRATOR SETTINGS</h1>
+
+<dl>
+
+<dt id="dkim_timeout-n-default:-5">dkim_timeout n (default: 5)</dt>
+<dd>
+
+<p>How many seconds to wait for a DKIM query to complete, before scanning continues without the DKIM result. A numeric value is optionally suffixed by a time unit (s, m, h, d, w, indicating seconds (default), minutes, hours, days, weeks).</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DKIM.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,337 @@
+NAME
+ Mail::SpamAssassin::Plugin::DKIM - perform DKIM verification tests
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::DKIM [/path/to/DKIM.pm]
+
+ Taking into account signatures from any signing domains:
+
+ full DKIM_SIGNED eval:check_dkim_signed()
+ full DKIM_VALID eval:check_dkim_valid()
+ full DKIM_VALID_AU eval:check_dkim_valid_author_sig()
+ full DKIM_VALID_EF eval:check_dkim_valid_envelopefrom()
+
+ Taking into account signatures from specified signing domains only:
+ (quotes may be omitted on domain names consisting only of letters,
+ digits, dots, and minus characters)
+
+ full DKIM_SIGNED_MY1 eval:check_dkim_signed('dom1','dom2',...)
+ full DKIM_VALID_MY1 eval:check_dkim_valid('dom1','dom2',...)
+ full DKIM_VALID_AU_MY1 eval:check_dkim_valid_author_sig('d1','d2',...)
+
+ full __DKIM_DEPENDABLE eval:check_dkim_dependable()
+
+ Author Domain Signing Practices (ADSP) from any author domains:
+
+ header DKIM_ADSP_NXDOMAIN eval:check_dkim_adsp('N')
+ header DKIM_ADSP_ALL eval:check_dkim_adsp('A')
+ header DKIM_ADSP_DISCARD eval:check_dkim_adsp('D')
+ header DKIM_ADSP_CUSTOM_LOW eval:check_dkim_adsp('1')
+ header DKIM_ADSP_CUSTOM_MED eval:check_dkim_adsp('2')
+ header DKIM_ADSP_CUSTOM_HIGH eval:check_dkim_adsp('3')
+
+ Author Domain Signing Practices (ADSP) from specified author domains
+ only:
+
+ header DKIM_ADSP_MY1 eval:check_dkim_adsp('*','dom1','dom2',...)
+
+ describe DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid
+ describe DKIM_VALID Message has at least one valid DKIM or DK signature
+ describe DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain
+ describe DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain
+ describe __DKIM_DEPENDABLE A validation failure not attributable to truncation
+
+ describe DKIM_ADSP_NXDOMAIN Domain not in DNS and no valid author domain signature
+ describe DKIM_ADSP_ALL Domain signs all mail, no valid author domain signature
+ describe DKIM_ADSP_DISCARD Domain signs all mail and suggests discarding mail with no valid author domain signature, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_LOW adsp_override is CUSTOM_LOW, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_MED adsp_override is CUSTOM_MED, no valid author domain signature
+ describe DKIM_ADSP_CUSTOM_HIGH adsp_override is CUSTOM_HIGH, no valid author domain signature
+
+ For compatibility with pre-3.3.0 versions, the following are synonyms:
+
+ OLD: eval:check_dkim_verified = NEW: eval:check_dkim_valid
+ OLD: eval:check_dkim_signall = NEW: eval:check_dkim_adsp('A')
+ OLD: eval:check_dkim_signsome = NEW: redundant, semantically always true
+
+ The __DKIM_DEPENDABLE eval rule deserves an explanation. The rule yields
+ true when signatures are supplied by a caller, OR ELSE when signatures
+ are obtained by this plugin AND either there are no signatures OR a rule
+ __TRUNCATED was false. In other words: __DKIM_DEPENDABLE is true when
+ failed signatures can not be attributed to message truncation when
+ feeding a message to SpamAssassin. It can be consulted to prevent false
+ positives on large but truncated messages with poor man's implementation
+ of ADSP by hand-crafted rules.
+
+DESCRIPTION
+ This SpamAssassin plugin implements DKIM lookups as described by the RFC
+ 4871, as well as historical DomainKeys lookups, as described by RFC
+ 4870, thanks to the support for both types of signatures by newer
+ versions of module Mail::DKIM.
+
+ It requires the "Mail::DKIM" CPAN module to operate. Many thanks to
+ Jason Long for that module.
+
+TAGS
+ The following tags are added to the set, available for use in reports,
+ header fields, other plugins, etc.:
+
+ _DKIMIDENTITY_
+ Agent or User Identifier (AUID) (the 'i' tag) from valid signatures;
+
+ _DKIMDOMAIN_
+ Signing Domain Identifier (SDID) (the 'd' tag) from valid signatures;
+
+ _DKIMSELECTOR_
+ DKIM selector (the 's' tag) from valid signatures;
+
+ Identities and domains from signatures which failed verification are not
+ included in these tags. Duplicates are eliminated (e.g. when there are
+ two or more valid signatures from the same signer, only one copy makes
+ it into a tag). Note that there may be more than one signature in a
+ message - currently they are provided as a space-separated list,
+ although this behaviour may change.
+
+SEE ALSO
+ "Mail::DKIM", "Mail::SpamAssassin::Plugin"
+
+ http://jason.long.name/dkimproxy/
+ http://tools.ietf.org/rfc/rfc4871.txt
+ http://tools.ietf.org/rfc/rfc4870.txt
+ http://tools.ietf.org/rfc/rfc5617.txt
+ http://ietf.org/html.charters/dkim-charter.html
+
+USER SETTINGS
+ whitelist_from_dkim author@example.com [signing-domain]
+ Works similarly to whitelist_from, except that in addition to
+ matching an author address (From) to the pattern in the first
+ parameter, the message must also carry a valid Domain Keys
+ Identified Mail (DKIM) signature made by a signing domain (SDID,
+ i.e. the d= tag) that is acceptable to us.
+
+ Only one whitelist entry is allowed per line, as in
+ "whitelist_from_rcvd". Multiple "whitelist_from_dkim" lines are
+ allowed. File-glob style characters are allowed for the From address
+ (the first parameter), just like with "whitelist_from_rcvd".
+
+ The second parameter (the signing-domain) does not accept full
+ file-glob style wildcards, although a simple '*.' (or just a '.')
+ prefix to a domain name is recognized and implies any subdomain of
+ the specified domain (but not the domain itself).
+
+ If no signing-domain parameter is specified, the only acceptable
+ signature will be an Author Domain Signature (sometimes called
+ first-party signature) which is a signature where the signing domain
+ (SDID) of a signature matches the domain of the author's address
+ (i.e. the address in a From header field).
+
+ Since this whitelist requires a DKIM check to be made, network tests
+ must be enabled.
+
+ Examples of whitelisting based on an author domain signature
+ (first-party):
+
+ whitelist_from_dkim joe@example.com
+ whitelist_from_dkim *@corp.example.com
+ whitelist_from_dkim *@*.example.com
+
+ Examples of whitelisting based on third-party signatures:
+
+ whitelist_from_dkim jane@example.net example.org
+ whitelist_from_dkim rick@info.example.net example.net
+ whitelist_from_dkim *@info.example.net example.net
+ whitelist_from_dkim *@* mail7.remailer.example.com
+ whitelist_from_dkim *@* *.remailer.example.com
+
+ def_whitelist_from_dkim author@example.com [signing-domain]
+ Same as "whitelist_from_dkim", but used for the default whitelist
+ entries in the SpamAssassin distribution. The whitelist score is
+ lower, because these are often targets for abuse of public mailers
+ which sign their mail.
+
+ unwhitelist_from_dkim author@example.com [signing-domain]
+ Removes an email address with its corresponding signing-domain field
+ from def_whitelist_from_dkim and whitelist_from_dkim tables, if it
+ exists. Parameters to unwhitelist_from_dkim must exactly match the
+ parameters of a corresponding whitelist_from_dkim or
+ def_whitelist_from_dkim config option which created the entry, for
+ it to be removed (a domain name is matched case-insensitively); i.e.
+ if a signing-domain parameter was specified in a whitelisting
+ command, it must also be specified in the unwhitelisting command.
+
+ Useful for removing undesired default entries from a distributed
+ configuration by a local or site-specific configuration or by
+ "user_prefs".
+
+ adsp_override domain [signing-practices]
+ Currently few domains publish their signing practices (RFC 5617 -
+ ADSP), partly because the ADSP rfc is rather new, partly because
+ they think hardly any recipient bothers to check it, and partly for
+ fear that some recipients might lose mail due to problems in their
+ signature validation procedures or mail mangling by mailers beyond
+ their control.
+
+ Nevertheless, recipients could benefit by knowing signing practices
+ of a sending (author's) domain, for example to recognize forged mail
+ claiming to be from certain domains which are popular targets for
+ phishing, like financial institutions. Unfortunately, as signing
+ practices are seldom published or are weak, it is hardly justifiable
+ to look them up in DNS.
+
+ To overcome this chicken-or-the-egg problem, the "adsp_override"
+ mechanism allows recipients using SpamAssassin to override published
+ or defaulted ADSP for certain domains. This makes it possible to
+ manually specify a stronger (or weaker) signing practices than a
+ signing domain is willing to publish (explicitly or by default), and
+ also save on a DNS lookup.
+
+ Note that ADSP (published or overridden) is only consulted for
+ messages which do not contain a valid DKIM signature from the
+ author's domain.
+
+ According to RFC 5617, signing practices can be one of the
+ following: "unknown", "all" and "discardable".
+
+ "unknown": The domain might sign some or all email - messages from
+ the domain may or may not have an Author Domain Signature. This is a
+ default if a domain exists in DNS but no ADSP record is found.
+
+ "all": All mail from the domain is signed with an Author Domain
+ Signature.
+
+ "discardable": All mail from the domain is signed with an Author
+ Domain Signature. Furthermore, if a message arrives without a valid
+ Author Domain Signature, the domain encourages the recipient(s) to
+ discard it.
+
+ ADSP lookup can also determine that a domain is "out of scope",
+ i.e., the domain does not exist (NXDOMAIN) in the DNS.
+
+ To override domain's signing practices in a SpamAssassin
+ configuration file, specify an "adsp_override" directive for each
+ sending domain to be overridden.
+
+ Its first argument is a domain name. Author's domain is matched
+ against it, matching is case insensitive. This is not a regular
+ expression or a file-glob style wildcard, but limited wildcarding is
+ still available: if this argument starts by a "*." (or is a sole
+ "*"), author's domain matches if it is a subdomain (to one or more
+ levels) of the argument. Otherwise (with no leading asterisk) the
+ match must be exact (not a subdomain).
+
+ An optional second parameter is one of the following keywords
+ (case-insensitive): "nxdomain", "unknown", "all", "discardable",
+ "custom_low", "custom_med", "custom_high".
+
+ Absence of this second parameter implies "discardable". If a domain
+ is not listed by a "adsp_override" directive nor does it explicitly
+ publish any ADSP record, then "unknown" is implied for valid
+ domains, and "nxdomain" for domains not existing in DNS. (Note:
+ domain validity is only checked with versions of Mail::DKIM 0.37 or
+ later (actually since 0.36_5), the "nxdomain" would never turn up
+ with older versions).
+
+ The strong setting "discardable" is useful for domains which are
+ known to always sign their mail and to always send it directly to
+ recipients (not to mailing lists), and are frequent targets of
+ fishing attempts, such as financial institutions. The "discardable"
+ is also appropriate for domains which are known never to send any
+ mail.
+
+ When a message does not contain a valid signature by the author's
+ domain (the domain in a From header field), the signing practices
+ pertaining to author's domain determine which of the following rules
+ fire and contributes its score: DKIM_ADSP_NXDOMAIN, DKIM_ADSP_ALL,
+ DKIM_ADSP_DISCARD, DKIM_ADSP_CUSTOM_LOW, DKIM_ADSP_CUSTOM_MED,
+ DKIM_ADSP_CUSTOM_HIGH. Not more than one of these rules can fire for
+ messages that have one author (but see below). The last three can
+ only result from a 'signing-practices' as given in a "adsp_override"
+ directive (not from a DNS lookup), and can serve as a convenient
+ means of providing a different score if scores assigned to
+ DKIM_ADSP_ALL or DKIM_ADSP_DISCARD are not considered suitable for
+ some domains.
+
+ RFC 5322 permits a message to have more than one author - multiple
+ addresses may be listed in a single From header field. RFC 5617
+ defines that a message with multiple authors has multiple signing
+ domain signing practices, but does not prescribe how these should be
+ combined. In presence of multiple signing practices, more than one
+ of the DKIM_ADSP_* rules may fire.
+
+ As a precaution against firing DKIM_ADSP_* rules when there is a
+ known local reason for a signature verification failure, the
+ domain's ADSP is considered 'unknown' when DNS lookups are disabled
+ or a DNS lookup encountered a temporary problem on fetching a public
+ key from the author's domain. Similarly, ADSP is considered
+ 'unknown' when this plugin did its own signature verification
+ (signatures were not passed to SA by a caller) and a metarule
+ __TRUNCATED was triggered, indicating the caller intentionally
+ passed a truncated message to SpamAssassin, which was a likely
+ reason for a signature verification failure.
+
+ Example:
+
+ adsp_override *.mydomain.example.com discardable
+ adsp_override *.neversends.example.com discardable
+
+ adsp_override ebay.com
+ adsp_override *.ebay.com
+ adsp_override ebay.co.uk
+ adsp_override *.ebay.co.uk
+ adsp_override paypal.com
+ adsp_override *.paypal.com
+ adsp_override amazon.com
+ adsp_override ealerts.bankofamerica.com
+ adsp_override americangreetings.com
+ adsp_override egreetings.com
+ adsp_override bluemountain.com
+ adsp_override hallmark.com all
+ adsp_override *.hallmark.com all
+ adsp_override youtube.com custom_high
+ adsp_override google.com custom_low
+ adsp_override gmail.com custom_low
+ adsp_override googlemail.com custom_low
+ adsp_override yahoo.com custom_low
+ adsp_override yahoo.com.au custom_low
+ adsp_override yahoo.se custom_low
+
+ adsp_override junkmailerkbw0rr.com nxdomain
+ adsp_override junkmailerd2hlsg.com nxdomain
+
+ # effectively disables ADSP network DNS lookups for all other domains:
+ adsp_override * unknown
+
+ score DKIM_ADSP_ALL 2.5
+ score DKIM_ADSP_DISCARD 25
+ score DKIM_ADSP_NXDOMAIN 3
+
+ score DKIM_ADSP_CUSTOM_LOW 1
+ score DKIM_ADSP_CUSTOM_MED 3.5
+ score DKIM_ADSP_CUSTOM_HIGH 8
+
+ dkim_minimum_key_bits n (default: 1024)
+ The smallest size of a signing key (in bits) for a valid signature
+ to be considered for whitelisting. Additionally, the eval function
+ check_dkim_valid() will return false on short keys when called with
+ explicitly listed domains, and the eval function
+ check_dkim_valid_author_sig() will return false on short keys
+ (regardless of its arguments). Setting the option to 0 disables a
+ key size check.
+
+ Note that the option has no effect when the eval function
+ check_dkim_valid() is called with no arguments (like in a rule
+ DKIM_VALID). A mere presence of some valid signature on a message
+ has no reputational value (without being associated with a
+ particular domain), regardless of its key size - anyone can prepend
+ its own signature on a copy of some third party mail and re-send it,
+ which makes it no more trustworthy than without such signature. This
+ is also a reason for a rule DKIM_VALID to have a near-zero score,
+ i.e. a rule hit is only informational.
+
+ADMINISTRATOR SETTINGS
+ dkim_timeout n (default: 5)
+ How many seconds to wait for a DKIM query to complete, before
+ scanning continues without the DKIM result. A numeric value is
+ optionally suffixed by a time unit (s, m, h, d, w, indicating
+ seconds (default), minutes, hours, days, weeks).
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,37 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>DNSEVAL - look up URLs against DNS blocklists</p>
+
+<dl>
+
+<dt id="check_rbl_from_domain">check_rbl_from_domain</dt>
+<dd>
+
+<p>This checks all the from addrs domain names as an alternate to check_rbl_from_host. As of v3.4.1, it has been improved to include a subtest for a specific octet.</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_DNSEval.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,8 @@
+NAME
+ DNSEVAL - look up URLs against DNS blocklists
+
+ check_rbl_from_domain
+ This checks all the from addrs domain names as an alternate to
+ check_rbl_from_host. As of v3.4.1, it has been improved to include a
+ subtest for a specific octet.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,108 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#CONFIGURATION">CONFIGURATION</a></li>
+ <li><a href="#TAGS">TAGS</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>FromNameSpoof - perform various tests to detect spoof attempts using the From header name section</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<p>loadplugin Mail::SpamAssassin::Plugin::FromNameSpoof</p>
+
+<pre><code> # Does the From:name look like it contains an email address
+ header __PLUGIN_FROMNAME_EMAIL eval:check_fromname_contains_email()
+
+ # Is the From:name different to the From:addr header
+ header __PLUGIN_FROMNAME_DIFFERENT eval:check_fromname_different()
+
+ # From:name and From:addr owners differ
+ header __PLUGIN_FROMNAME_OWNERS_DIFFER eval:check_fromname_owners_differ()
+
+ # From:name domain differs to from header
+ header __PLUGIN_FROMNAME_DOMAIN_DIFFER eval:check_fromname_domain_differ()
+
+ # From:name and From:address don't match and owners differ
+ header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof()
+
+ # From:name address matches To:address
+ header __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>Perform various tests against From:name header to detect spoofing. Steps in place to ensure minimal FPs.</p>
+
+<h1 id="CONFIGURATION">CONFIGURATION</h1>
+
+<p>The plugin allows you to skip emails that have been DKIM signed by specific senders:</p>
+
+<pre><code> fns_ignore_dkim googlegroups.com</code></pre>
+
+<p>FromNameSpoof allows for a configurable closeness when matching the From:addr and From:name, the closeness can be adjusted with:</p>
+
+<pre><code> fns_extrachars 5</code></pre>
+
+<p><b>Note</b> that FromNameSpoof detects the "owner" of a domain by the following search:</p>
+
+<pre><code> <owner>.<tld></code></pre>
+
+<p>By default FromNameSpoof will ignore the TLD when testing if From:addr is spoofed. Default 1</p>
+
+<pre><code> dns_check 1</code></pre>
+
+<p>Check levels:</p>
+
+<pre><code> 0 - Strict checking of From:name != From:addr
+ 1 - Allow for different tlds
+ 2 - Allow for different aliases but same domain</code></pre>
+
+<h1 id="TAGS">TAGS</h1>
+
+<p>The following tags are added to the set if a spoof is detected. They are available for use in reports, header fields, other plugins, etc.:</p>
+
+<pre><code> _FNSFNAMEADDR_
+ Detected spoof address from From:name header
+
+ _FNSFNAMEDOMAIN_
+ Detected spoof domain from From:name header
+
+ _FNSFNAMEOWNER_
+ Detected spoof owner from From:name header
+
+ _FNSFADDRADDR_
+ Actual From:addr address
+
+ _FNSFADDRDOMAIN_
+ Actual From:addr domain
+
+ _FNSFADDROWNER_
+ Actual From:addr detected owner
+=head1 EXAMPLE </code></pre>
+
+<p>header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof() header __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()</p>
+
+<p>meta FROMNAME_SPOOF_EQUALS_TO (__PLUGIN_FROMNAME_SPOOF && __PLUGIN_FROMNAME_EQUALS_TO) describe FROMNAME_SPOOF_EQUALS_TO From:name is spoof to look like To: address score FROMNAME_SPOOF_EQUALS_TO 1.2</p>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_FromNameSpoof.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,86 @@
+NAME
+ FromNameSpoof - perform various tests to detect spoof attempts using the
+ From header name section
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::FromNameSpoof
+
+ # Does the From:name look like it contains an email address
+ header __PLUGIN_FROMNAME_EMAIL eval:check_fromname_contains_email()
+
+ # Is the From:name different to the From:addr header
+ header __PLUGIN_FROMNAME_DIFFERENT eval:check_fromname_different()
+
+ # From:name and From:addr owners differ
+ header __PLUGIN_FROMNAME_OWNERS_DIFFER eval:check_fromname_owners_differ()
+
+ # From:name domain differs to from header
+ header __PLUGIN_FROMNAME_DOMAIN_DIFFER eval:check_fromname_domain_differ()
+
+ # From:name and From:address don't match and owners differ
+ header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof()
+
+ # From:name address matches To:address
+ header __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()
+
+DESCRIPTION
+ Perform various tests against From:name header to detect spoofing. Steps
+ in place to ensure minimal FPs.
+
+CONFIGURATION
+ The plugin allows you to skip emails that have been DKIM signed by
+ specific senders:
+
+ fns_ignore_dkim googlegroups.com
+
+ FromNameSpoof allows for a configurable closeness when matching the
+ From:addr and From:name, the closeness can be adjusted with:
+
+ fns_extrachars 5
+
+ Note that FromNameSpoof detects the "owner" of a domain by the following
+ search:
+
+ <owner>.<tld>
+
+ By default FromNameSpoof will ignore the TLD when testing if From:addr
+ is spoofed. Default 1
+
+ dns_check 1
+
+ Check levels:
+
+ 0 - Strict checking of From:name != From:addr
+ 1 - Allow for different tlds
+ 2 - Allow for different aliases but same domain
+
+TAGS
+ The following tags are added to the set if a spoof is detected. They are
+ available for use in reports, header fields, other plugins, etc.:
+
+ _FNSFNAMEADDR_
+ Detected spoof address from From:name header
+
+ _FNSFNAMEDOMAIN_
+ Detected spoof domain from From:name header
+
+ _FNSFNAMEOWNER_
+ Detected spoof owner from From:name header
+
+ _FNSFADDRADDR_
+ Actual From:addr address
+
+ _FNSFADDRDOMAIN_
+ Actual From:addr domain
+
+ _FNSFADDROWNER_
+ Actual From:addr detected owner
+ =head1 EXAMPLE
+
+ header __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof() header
+ __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()
+
+ meta FROMNAME_SPOOF_EQUALS_TO (__PLUGIN_FROMNAME_SPOOF &&
+ __PLUGIN_FROMNAME_EQUALS_TO) describe FROMNAME_SPOOF_EQUALS_TO From:name
+ is spoof to look like To: address score FROMNAME_SPOOF_EQUALS_TO 1.2
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,39 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>HashBL - seearch email addresses in HashBL blocklists</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::HashBL
+ header HASHBL_EMAIL eval:check_hashbl_emails('ebl.msbl.org')
+ describe HASHBL_EMAIL Message contains email address found on EBL</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>The Email Blocklist (EBL) contains email addresses used to receive responses to spam emails. These email addresses are sometimes called contact email addresses or drop boxes. The initial target of this blocklist was "Nigerian" 419 Advance Fee Fraud spam. As time passed and more types of spam that used drop boxes was identified, these drop boxes also were listed. The EBL now lists significant numbers of drop boxes used in spam sent by Chinese manufacturers of high-tech and light industrial products, SEO/web development companies, direct spam services, list sellers, and a number of fraudulent or outright illegal products sold by botnets.</p>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_HashBL.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,20 @@
+NAME
+ HashBL - seearch email addresses in HashBL blocklists
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::HashBL
+ header HASHBL_EMAIL eval:check_hashbl_emails('ebl.msbl.org')
+ describe HASHBL_EMAIL Message contains email address found on EBL
+
+DESCRIPTION
+ The Email Blocklist (EBL) contains email addresses used to receive
+ responses to spam emails. These email addresses are sometimes called
+ contact email addresses or drop boxes. The initial target of this
+ blocklist was "Nigerian" 419 Advance Fee Fraud spam. As time passed and
+ more types of spam that used drop boxes was identified, these drop boxes
+ also were listed. The EBL now lists significant numbers of drop boxes
+ used in spam sent by Chinese manufacturers of high-tech and light
+ industrial products, SEO/web development companies, direct spam
+ services, list sellers, and a number of fraudulent or outright illegal
+ products sold by botnets.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,78 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#USER-SETTINGS">USER SETTINGS</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>Mail::SpamAssassin::Plugin::Hashcash - perform hashcash verification tests</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::Hashcash</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>Hashcash is a payment system for email where CPU cycles used as the basis for an e-cash system. This plugin makes it possible to use valid hashcash tokens added by mail programs as a bonus for messages.</p>
+
+<h1 id="USER-SETTINGS">USER SETTINGS</h1>
+
+<dl>
+
+<dt id="use_hashcash-1-0-default:-1">use_hashcash { 1 | 0 } (default: 1)</dt>
+<dd>
+
+<p>Whether to use hashcash, if it is available.</p>
+
+</dd>
+<dt id="hashcash_accept-user-example.com">hashcash_accept user@example.com ...</dt>
+<dd>
+
+<p>Used to specify addresses that we accept HashCash tokens for. You should set it to match all the addresses that you may receive mail at.</p>
+
+<p>Like whitelist and blacklist entries, the addresses are file-glob-style patterns, so <code>friend@somewhere.com</code>, <code>*@isp.com</code>, or <code>*.domain.net</code> will all work. Specifically, <code>*</code> and <code>?</code> are allowed, but all other metacharacters are not. Regular expressions are not used for security reasons.</p>
+
+<p>The sequence <code>%u</code> is replaced with the current user's username, which is useful for ISPs or multi-user domains.</p>
+
+<p>Multiple addresses per line, separated by spaces, is OK. Multiple <code>hashcash_accept</code> lines is also OK.</p>
+
+</dd>
+<dt id="hashcash_doublespend_path-path-to-file-default:-.spamassassin-hashcash_seen">hashcash_doublespend_path /path/to/file (default: ~/.spamassassin/hashcash_seen)</dt>
+<dd>
+
+<p>Path for HashCash double-spend database. HashCash tokens are only usable once, so their use is tracked in this database to avoid providing a loophole.</p>
+
+<p>By default, each user has their own, in their <code>~/.spamassassin</code> directory with mode 0700/0600. Note that once a token is 'spent' it is written to this file, and double-spending of a hashcash token makes it invalid, so this is not suitable for sharing between multiple users.</p>
+
+</dd>
+<dt id="hashcash_doublespend_file_mode-default:-0700">hashcash_doublespend_file_mode (default: 0700)</dt>
+<dd>
+
+<p>The file mode bits used for the HashCash double-spend database file.</p>
+
+<p>Make sure you specify this using the 'x' mode bits set, as it may also be used to create directories. However, if a file is created, the resulting file will not have any execute bits set (the umask is set to 111).</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Hashcash.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,53 @@
+NAME
+ Mail::SpamAssassin::Plugin::Hashcash - perform hashcash verification
+ tests
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::Hashcash
+
+DESCRIPTION
+ Hashcash is a payment system for email where CPU cycles used as the
+ basis for an e-cash system. This plugin makes it possible to use valid
+ hashcash tokens added by mail programs as a bonus for messages.
+
+USER SETTINGS
+ use_hashcash { 1 | 0 } (default: 1)
+ Whether to use hashcash, if it is available.
+
+ hashcash_accept user@example.com ...
+ Used to specify addresses that we accept HashCash tokens for. You
+ should set it to match all the addresses that you may receive mail
+ at.
+
+ Like whitelist and blacklist entries, the addresses are
+ file-glob-style patterns, so "friend@somewhere.com", "*@isp.com", or
+ "*.domain.net" will all work. Specifically, "*" and "?" are allowed,
+ but all other metacharacters are not. Regular expressions are not
+ used for security reasons.
+
+ The sequence %u is replaced with the current user's username, which
+ is useful for ISPs or multi-user domains.
+
+ Multiple addresses per line, separated by spaces, is OK. Multiple
+ "hashcash_accept" lines is also OK.
+
+ hashcash_doublespend_path /path/to/file (default:
+ ~/.spamassassin/hashcash_seen)
+ Path for HashCash double-spend database. HashCash tokens are only
+ usable once, so their use is tracked in this database to avoid
+ providing a loophole.
+
+ By default, each user has their own, in their "~/.spamassassin"
+ directory with mode 0700/0600. Note that once a token is 'spent' it
+ is written to this file, and double-spending of a hashcash token
+ makes it invalid, so this is not suitable for sharing between
+ multiple users.
+
+ hashcash_doublespend_file_mode (default: 0700)
+ The file mode bits used for the HashCash double-spend database file.
+
+ Make sure you specify this using the 'x' mode bits set, as it may
+ also be used to create directories. However, if a file is created,
+ the resulting file will not have any execute bits set (the umask is
+ set to 111).
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,94 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>MIMEEval - perform various tests against MIME structure and body</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::MIMEEval
+
+ body NAME_OF_RULE eval:check_for_mime
+ body NAME_OF_RULE eval:check_for_mime_html
+ body NAME_OF_RULE eval:check_for_mime_html_only
+ body NAME_OF_RULE eval:check_mime_multipart_ratio
+ body NAME_OF_RULE eval:check_msg_parse_flags
+ body NAME_OF_RULE eval:check_for_ascii_text_illegal
+ body NAME_OF_RULE eval:check_abundant_unicode_ratio
+ body NAME_OF_RULE eval:check_for_faraway_charset
+ body NAME_OF_RULE eval:check_for_uppercase
+ body NAME_OF_RULE eval:check_ma_non_text
+ body NAME_OF_RULE eval:check_base64_length
+ body NAME_OF_RULE eval:check_qp_ratio</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>Perform various tests against MIME structure and body.</p>
+
+<dl>
+
+<dt id="has_check_for_ascii_text_illegal">has_check_for_ascii_text_illegal</dt>
+<dd>
+
+<p>Adds capability check for "if can()" for check_for_ascii_text_illegal</p>
+
+</dd>
+<dt id="check_for_ascii_text_illegal">check_for_ascii_text_illegal</dt>
+<dd>
+
+<p>If a MIME part claims to be text/plain or text/plain;charset=us-ascii and the Content-Transfer-Encoding is 7bit (either explicitly or by default), then we should enforce the actual text being only TAB, NL, SPACE through TILDE, i.e. all 7bit characters excluding NO-WS-CTL (per RFC-2822).</p>
+
+<p>All mainstream MTA's get this right.</p>
+
+</dd>
+<dt id="has_check_abundant_unicode_ratio">has_check_abundant_unicode_ratio</dt>
+<dd>
+
+<p>Adds capability check for "if can()" for check_abundant_unicode_ratio</p>
+
+</dd>
+<dt id="check_abundant_unicode_ratio">check_abundant_unicode_ratio</dt>
+<dd>
+
+<p>A MIME part claiming to be text/plain and containing Unicode characters must be encoded as quoted-printable or base64, or use UTF data coding (typically with 8bit encoding). Any message in 7bit or 8bit encoding containing (HTML) Unicode entities will not render them as Unicode, but literally.</p>
+
+<p>Thus a few such sequences might occur on a mailing list of developers discussing such characters, but a message with a high density of such characters is likely spam.</p>
+
+</dd>
+<dt id="has_check_qp_ratio">has_check_qp_ratio</dt>
+<dd>
+
+<p>Adds capability check for "if can()" for check_qp_ratio</p>
+
+</dd>
+<dt id="check_qp_ratio">check_qp_ratio</dt>
+<dd>
+
+<p>Takes a min ratio to use in eval to see if there is an spamminess to the ratio of quoted printable to total bytes in an email.</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEEval.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,57 @@
+NAME
+ MIMEEval - perform various tests against MIME structure and body
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::MIMEEval
+
+ body NAME_OF_RULE eval:check_for_mime
+ body NAME_OF_RULE eval:check_for_mime_html
+ body NAME_OF_RULE eval:check_for_mime_html_only
+ body NAME_OF_RULE eval:check_mime_multipart_ratio
+ body NAME_OF_RULE eval:check_msg_parse_flags
+ body NAME_OF_RULE eval:check_for_ascii_text_illegal
+ body NAME_OF_RULE eval:check_abundant_unicode_ratio
+ body NAME_OF_RULE eval:check_for_faraway_charset
+ body NAME_OF_RULE eval:check_for_uppercase
+ body NAME_OF_RULE eval:check_ma_non_text
+ body NAME_OF_RULE eval:check_base64_length
+ body NAME_OF_RULE eval:check_qp_ratio
+
+DESCRIPTION
+ Perform various tests against MIME structure and body.
+
+ has_check_for_ascii_text_illegal
+ Adds capability check for "if can()" for
+ check_for_ascii_text_illegal
+
+ check_for_ascii_text_illegal
+ If a MIME part claims to be text/plain or
+ text/plain;charset=us-ascii and the Content-Transfer-Encoding is
+ 7bit (either explicitly or by default), then we should enforce the
+ actual text being only TAB, NL, SPACE through TILDE, i.e. all 7bit
+ characters excluding NO-WS-CTL (per RFC-2822).
+
+ All mainstream MTA's get this right.
+
+ has_check_abundant_unicode_ratio
+ Adds capability check for "if can()" for
+ check_abundant_unicode_ratio
+
+ check_abundant_unicode_ratio
+ A MIME part claiming to be text/plain and containing Unicode
+ characters must be encoded as quoted-printable or base64, or use UTF
+ data coding (typically with 8bit encoding). Any message in 7bit or
+ 8bit encoding containing (HTML) Unicode entities will not render
+ them as Unicode, but literally.
+
+ Thus a few such sequences might occur on a mailing list of
+ developers discussing such characters, but a message with a high
+ density of such characters is likely spam.
+
+ has_check_qp_ratio
+ Adds capability check for "if can()" for check_qp_ratio
+
+ check_qp_ratio
+ Takes a min ratio to use in eval to see if there is an spamminess to
+ the ratio of quoted printable to total bytes in an email.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,57 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#RULE-DEFINITIONS-AND-PRIVILEGED-SETTINGS">RULE DEFINITIONS AND PRIVILEGED SETTINGS</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>MIMEHeader - perform regexp tests against MIME headers</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader NAME_OF_RULE Content-Id =~ /foo/</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>This plugin allows regexp rules to be written against MIME headers in the message.</p>
+
+<h1 id="RULE-DEFINITIONS-AND-PRIVILEGED-SETTINGS">RULE DEFINITIONS AND PRIVILEGED SETTINGS</h1>
+
+<dl>
+
+<dt id="mimeheader-NAME_OF_RULE-Header-Name-pattern-modifiers">mimeheader NAME_OF_RULE Header-Name =~ /pattern/modifiers</dt>
+<dd>
+
+<p>Specify a rule. <code>NAME_OF_RULE</code> is the name of the rule to be used, <code>Header-Name</code> is the name of the MIME header to check, and <code>/pattern/modifiers</code> is the Perl regular expression to match against this.</p>
+
+<p>Note that in a message of multiple parts, each header will be checked against the pattern separately. In other words, if multiple parts have a 'Content-Type' header, each header's value will be tested individually as a separate string.</p>
+
+<p>Header names are considered case-insensitive.</p>
+
+<p>The header values are normally cleaned up a little; for example, whitespace around the newline character in "folded" headers will be replaced with a single space. Append <code>:raw</code> to the header name to retrieve the raw, undecoded value, including pristine whitespace, instead.</p>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_MIMEHeader.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,31 @@
+NAME
+ MIMEHeader - perform regexp tests against MIME headers
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::MIMEHeader
+ mimeheader NAME_OF_RULE Content-Id =~ /foo/
+
+DESCRIPTION
+ This plugin allows regexp rules to be written against MIME headers in
+ the message.
+
+RULE DEFINITIONS AND PRIVILEGED SETTINGS
+ mimeheader NAME_OF_RULE Header-Name =~ /pattern/modifiers
+ Specify a rule. "NAME_OF_RULE" is the name of the rule to be used,
+ "Header-Name" is the name of the MIME header to check, and
+ "/pattern/modifiers" is the Perl regular expression to match against
+ this.
+
+ Note that in a message of multiple parts, each header will be
+ checked against the pattern separately. In other words, if multiple
+ parts have a 'Content-Type' header, each header's value will be
+ tested individually as a separate string.
+
+ Header names are considered case-insensitive.
+
+ The header values are normally cleaned up a little; for example,
+ whitespace around the newline character in "folded" headers will be
+ replaced with a single space. Append ":raw" to the header name to
+ retrieve the raw, undecoded value, including pristine whitespace,
+ instead.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,27 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>Mail::SpamAssassin::Plugin::OneLineBodyRuleType - spamassassin body test plugin</p>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_OneLineBodyRuleType.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,4 @@
+NAME
+ Mail::SpamAssassin::Plugin::OneLineBodyRuleType - spamassassin body test
+ plugin
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,146 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>Mail::SpamAssassin::Plugin::PDFInfo - PDFInfo Plugin for SpamAssassin</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::PDFInfo</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>This plugin helps detected spam using attached PDF files</p>
+
+<dl>
+
+<dt id="See-Usage:-below---more-documentation-see-20_pdfinfo.cf">See "Usage:" below - more documentation see 20_pdfinfo.cf</dt>
+<dd>
+
+<pre><code> Original info kept for history. For later changes see SVN repo
+ -------------------------------------------------------
+ PDFInfo Plugin for SpamAssassin
+ Version: 0.8
+ Info: $Id: PDFInfo.pm 904 2007-08-12 01:36:23Z root $
+ Created: 2007-08-10
+ Modified: 2007-08-10
+ By: Dallas Engelken
+
+ Changes:
+ 0.8 - added .fdf detection (thanks John Lundin) [axb]
+ 0.7 - fixed empty body/pdf count buglet(thanks Jeremy) [axb]
+ 0.6 - added support for tags - PDFCOUNT, PDFVERSION, PDFPRODUCER, etc.
+ - fixed issue on perl 5.6.1 where pdf_match_details() failed to call
+ _find_pdf_mime_parts(), resulting in no detection of pdf mime parts.
+ - quoted-printable support - requires MIME::QuotedPrint (which should be in everyones
+ install as a part of the MIME-Base64 package which is a SA req)
+ - added simple pdf_is_empty_body() function with counts the body bytes minus the
+ subject line. can add optional <bytes> param if you need to allow for a few bytes.
+ 0.5 - fix warns for undef $pdf_tags
+ - remove { } and \ before running eval in pdf_match_details to avoid eval error
+ 0.4 - added pdf_is_encrypted() function
+ - added option to look for image HxW on same line
+ 0.3 - added 2nd fuzzy md5 which uses pdf tag layout as data
+ - renamed pdf_image_named() to pdf_named()
+ - PDF images are encapsulated and have no names. We are matching the PDF file name.
+ - renamed pdf_image_name_regex() to pdf_name_regex()
+ - PDF images are encapsulated and have no names. We are matching the PDF file name.
+ - changed pdf_image_count() a bit and added pdf_count().
+ - pdf_count() checks how many pdf attachments there are on the mail
+ - pdf_image_count() checks how many images are found within all pdfs in the mail.
+ - removed the restriction of the pdf containing an image in order to md5 it.
+ - added pdf_match_details() function to check the following 'details'
+ - author: Author of PDF if specified
+ - producer: Software used to produce PDF
+ - creator: Software used to produce PDF, usually similar to producer
+ - title: Title of PDF
+ - created: Creation Date
+ - modified: Last Modified
+ 0.2 - support PDF octet-stream
+ 0.1 - just ported over the imageinfo code, and renamed to pdfinfo.
+ - removed all support for png, gif, and jpg from the code.
+ - prepended pdf_ to all function names to avoid conflicts with ImageInfo in SA 3.2.
+
+ Usage:
+
+ pdf_count()
+
+ body RULENAME eval:pdf_count(<min>,[max])
+ min: required, message contains at least x pdf mime parts
+ max: optional, if specified, must not contain more than x pdf mime parts
+
+ pdf_image_count()
+
+ body RULENAME eval:pdf_image_count(<min>,[max])
+ min: required, message contains at least x images in pdf attachments.
+ max: optional, if specified, must not contain more than x pdf images
+
+ pdf_pixel_coverage()
+
+ body RULENAME eval:pdf_pixel_coverage(<min>,[max])
+ min: required, message contains at least this much pixel area
+ max: optional, if specified, message must not contain more than this much pixel area
+
+ pdf_named()
+
+ body RULENAME eval:pdf_named(<string>)
+ string: exact file name match, if you need partial match, see pdf_name_regex()
+
+ pdf_name_regex()
+
+ body RULENAME eval:pdf_name_regex(<regex>)
+ regex: regular expression, see examples in ruleset
+
+ pdf_match_md5()
+
+ body RULENAME eval:pdf_match_md5(<string>)
+ string: 32-byte md5 hex
+
+ pdf_match_fuzzy_md5()
+
+ body RULENAME eval:pdf_match_md5(<string>)
+ string: 32-byte md5 hex - see ruleset for obtaining the fuzzy md5
+
+ pdf_match_details()
+
+ body RULENAME eval:pdf_match_details(<detail>,<regex>);
+ detail: author, creator, created, modified, producer, title
+ regex: regular expression, see examples in ruleset
+
+ pdf_is_encrypted()
+
+ body RULENAME eval:pdf_is_encrypted()
+
+ pdf_is_empty_body()
+
+ body RULENAME eval:pdf_is_empty_body(<bytes>)
+ bytes: maximum byte count to allow and still consider it empty
+
+ NOTE: See the ruleset for more examples that are not documented here.</code></pre>
+
+</dd>
+</dl>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PDFInfo.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,111 @@
+NAME
+ Mail::SpamAssassin::Plugin::PDFInfo - PDFInfo Plugin for SpamAssassin
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::PDFInfo
+
+DESCRIPTION
+ This plugin helps detected spam using attached PDF files
+
+ See "Usage:" below - more documentation see 20_pdfinfo.cf
+ Original info kept for history. For later changes see SVN repo
+ -------------------------------------------------------
+ PDFInfo Plugin for SpamAssassin
+ Version: 0.8
+ Info: $Id: PDFInfo.pm 904 2007-08-12 01:36:23Z root $
+ Created: 2007-08-10
+ Modified: 2007-08-10
+ By: Dallas Engelken
+
+ Changes:
+ 0.8 - added .fdf detection (thanks John Lundin) [axb]
+ 0.7 - fixed empty body/pdf count buglet(thanks Jeremy) [axb]
+ 0.6 - added support for tags - PDFCOUNT, PDFVERSION, PDFPRODUCER, etc.
+ - fixed issue on perl 5.6.1 where pdf_match_details() failed to call
+ _find_pdf_mime_parts(), resulting in no detection of pdf mime parts.
+ - quoted-printable support - requires MIME::QuotedPrint (which should be in everyones
+ install as a part of the MIME-Base64 package which is a SA req)
+ - added simple pdf_is_empty_body() function with counts the body bytes minus the
+ subject line. can add optional <bytes> param if you need to allow for a few bytes.
+ 0.5 - fix warns for undef $pdf_tags
+ - remove { } and \ before running eval in pdf_match_details to avoid eval error
+ 0.4 - added pdf_is_encrypted() function
+ - added option to look for image HxW on same line
+ 0.3 - added 2nd fuzzy md5 which uses pdf tag layout as data
+ - renamed pdf_image_named() to pdf_named()
+ - PDF images are encapsulated and have no names. We are matching the PDF file name.
+ - renamed pdf_image_name_regex() to pdf_name_regex()
+ - PDF images are encapsulated and have no names. We are matching the PDF file name.
+ - changed pdf_image_count() a bit and added pdf_count().
+ - pdf_count() checks how many pdf attachments there are on the mail
+ - pdf_image_count() checks how many images are found within all pdfs in the mail.
+ - removed the restriction of the pdf containing an image in order to md5 it.
+ - added pdf_match_details() function to check the following 'details'
+ - author: Author of PDF if specified
+ - producer: Software used to produce PDF
+ - creator: Software used to produce PDF, usually similar to producer
+ - title: Title of PDF
+ - created: Creation Date
+ - modified: Last Modified
+ 0.2 - support PDF octet-stream
+ 0.1 - just ported over the imageinfo code, and renamed to pdfinfo.
+ - removed all support for png, gif, and jpg from the code.
+ - prepended pdf_ to all function names to avoid conflicts with ImageInfo in SA 3.2.
+
+ Usage:
+
+ pdf_count()
+
+ body RULENAME eval:pdf_count(<min>,[max])
+ min: required, message contains at least x pdf mime parts
+ max: optional, if specified, must not contain more than x pdf mime parts
+
+ pdf_image_count()
+
+ body RULENAME eval:pdf_image_count(<min>,[max])
+ min: required, message contains at least x images in pdf attachments.
+ max: optional, if specified, must not contain more than x pdf images
+
+ pdf_pixel_coverage()
+
+ body RULENAME eval:pdf_pixel_coverage(<min>,[max])
+ min: required, message contains at least this much pixel area
+ max: optional, if specified, message must not contain more than this much pixel area
+
+ pdf_named()
+
+ body RULENAME eval:pdf_named(<string>)
+ string: exact file name match, if you need partial match, see pdf_name_regex()
+
+ pdf_name_regex()
+
+ body RULENAME eval:pdf_name_regex(<regex>)
+ regex: regular expression, see examples in ruleset
+
+ pdf_match_md5()
+
+ body RULENAME eval:pdf_match_md5(<string>)
+ string: 32-byte md5 hex
+
+ pdf_match_fuzzy_md5()
+
+ body RULENAME eval:pdf_match_md5(<string>)
+ string: 32-byte md5 hex - see ruleset for obtaining the fuzzy md5
+
+ pdf_match_details()
+
+ body RULENAME eval:pdf_match_details(<detail>,<regex>);
+ detail: author, creator, created, modified, producer, title
+ regex: regular expression, see examples in ruleset
+
+ pdf_is_encrypted()
+
+ body RULENAME eval:pdf_is_encrypted()
+
+ pdf_is_empty_body()
+
+ body RULENAME eval:pdf_is_empty_body(<bytes>)
+ bytes: maximum byte count to allow and still consider it empty
+
+ NOTE: See the ruleset for more examples that are not documented here.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,79 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+ <li><a href="#OPTIONS">OPTIONS</a></li>
+ <li><a href="#DOWNLOAD">DOWNLOAD</a></li>
+ <li><a href="#SEE-ALSO">SEE ALSO</a></li>
+ <li><a href="#AUTHOR">AUTHOR</a></li>
+ <li><a href="#COPYRIGHT-AND-LICENSE">COPYRIGHT AND LICENSE</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>PhishTag - SpamAssassin plugin for redirecting links in incoming emails.</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::PhishTag
+
+ trigger_ratio 0.1
+ trigger_target RULE_NAME http://www.antiphishing.org/consumer_recs.html</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>PhishTag enables administrators to rewrite links in emails that trigger certain tests, preferably anti-phishing blacklist tests. The plugin will inhibit the blocking of a portion of the emails that trigger the test by SpamAssassin, and let them pass to the users' inbox after the rewrite. It is useful in providing training to email users about company policies and general email usage.</p>
+
+<h1 id="OPTIONS">OPTIONS</h1>
+
+<p>The following options can be set by modifying the configuration file.</p>
+
+<ul>
+
+<li><p>trigger_ratio percentage_value</p>
+
+<p>Sets the probability in percentage that a positive test will trigger the email rewrite, e.g. 0.1 will rewrite on the average 1 in 1000 emails that match the trigger.</p>
+
+</li>
+<li><p>trigger_target RULE_NAME http_url</p>
+
+<p>The name of the test which would trigger the email rewrite; all the URLs will be replaced by http_url.</p>
+
+</li>
+</ul>
+
+<h1 id="DOWNLOAD">DOWNLOAD</h1>
+
+<p>The source of this plugin is available at: http://umut.topkara.org/PhishTag/PhishTag.pm a sample configuration file is also available: http://umut.topkara.org/PhishTag/PhishTag.cf</p>
+
+<h1 id="SEE-ALSO">SEE ALSO</h1>
+
+<p>Check the list of tests performed by SpamAssassin to modify the configuration file to match your needs from http://spamassassin.apache.org/tests.html</p>
+
+<h1 id="AUTHOR">AUTHOR</h1>
+
+<p>Umut Topkara, 2008, <umut@topkara.org> http://umut.topkara.org</p>
+
+<h1 id="COPYRIGHT-AND-LICENSE">COPYRIGHT AND LICENSE</h1>
+
+<p>This plugin is free software; you can redistribute it and/or modify it under the same terms as SpamAssassin itself, either version 3.2.4 or, at your option, any later version of SpamAssassin you may have available.</p>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_PhishTag.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,49 @@
+NAME
+ PhishTag - SpamAssassin plugin for redirecting links in incoming emails.
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::PhishTag
+
+ trigger_ratio 0.1
+ trigger_target RULE_NAME http://www.antiphishing.org/consumer_recs.html
+
+DESCRIPTION
+ PhishTag enables administrators to rewrite links in emails that trigger
+ certain tests, preferably anti-phishing blacklist tests. The plugin will
+ inhibit the blocking of a portion of the emails that trigger the test by
+ SpamAssassin, and let them pass to the users' inbox after the rewrite.
+ It is useful in providing training to email users about company policies
+ and general email usage.
+
+OPTIONS
+ The following options can be set by modifying the configuration file.
+
+ * trigger_ratio percentage_value
+
+ Sets the probability in percentage that a positive test will trigger
+ the email rewrite, e.g. 0.1 will rewrite on the average 1 in 1000
+ emails that match the trigger.
+
+ * trigger_target RULE_NAME http_url
+
+ The name of the test which would trigger the email rewrite; all the
+ URLs will be replaced by http_url.
+
+DOWNLOAD
+ The source of this plugin is available at:
+ http://umut.topkara.org/PhishTag/PhishTag.pm a sample configuration file
+ is also available: http://umut.topkara.org/PhishTag/PhishTag.cf
+
+SEE ALSO
+ Check the list of tests performed by SpamAssassin to modify the
+ configuration file to match your needs from
+ http://spamassassin.apache.org/tests.html
+
+AUTHOR
+ Umut Topkara, 2008, <um...@topkara.org> http://umut.topkara.org
+
+COPYRIGHT AND LICENSE
+ This plugin is free software; you can redistribute it and/or modify it
+ under the same terms as SpamAssassin itself, either version 3.2.4 or, at
+ your option, any later version of SpamAssassin you may have available.
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.html
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.html?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.html (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.html Sun Sep 16 14:36:10 2018
@@ -0,0 +1,48 @@
+<?xml version="1.0" ?>
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+<title></title>
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<link rev="made" href="mailto:root@localhost" />
+</head>
+
+<body style="background-color: white">
+
+
+
+<ul id="index">
+ <li><a href="#NAME">NAME</a></li>
+ <li><a href="#SYNOPSIS">SYNOPSIS</a></li>
+ <li><a href="#DESCRIPTION">DESCRIPTION</a></li>
+</ul>
+
+<h1 id="NAME">NAME</h1>
+
+<p>Mail::SpamAssassin::Plugin::Phishing - check uris against phishing feed</p>
+
+<h1 id="SYNOPSIS">SYNOPSIS</h1>
+
+<pre><code> loadplugin Mail::SpamAssassin::Plugin::Phishing
+
+ ifplugin Mail::SpamAssassin::Plugin::Phishing
+ phishing_openphish_feed /etc/mail/spamassassin/openphish-feed.txt
+ phishing_phishtank_feed /etc/mail/spamassassin/phishtank-feed.csv
+ body URI_PHISHING eval:check_phishing()
+ describe URI_PHISHING Url match phishing in feed
+ endif</code></pre>
+
+<h1 id="DESCRIPTION">DESCRIPTION</h1>
+
+<p>This plugin finds uris used in phishing campaigns detected by OpenPhish or PhishTank feeds.</p>
+
+<p>The Openphish free feed is updated every 6 hours and can be downloaded from https://openphish.com/feed.txt. The Premium Openphish feed is not currently supported.</p>
+
+<p>The PhishTank free feed is updated every 1 hours and can be downloaded from http://data.phishtank.com/data/online-valid.csv. To avoid download limits a registration is required.</p>
+
+
+</body>
+
+</html>
+
+
Added: spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.txt
URL: http://svn.apache.org/viewvc/spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.txt?rev=1841017&view=auto
==============================================================================
--- spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.txt (added)
+++ spamassassin/site/full/3.4.x/doc/Mail_SpamAssassin_Plugin_Phishing.txt Sun Sep 16 14:36:10 2018
@@ -0,0 +1,25 @@
+NAME
+ Mail::SpamAssassin::Plugin::Phishing - check uris against phishing feed
+
+SYNOPSIS
+ loadplugin Mail::SpamAssassin::Plugin::Phishing
+
+ ifplugin Mail::SpamAssassin::Plugin::Phishing
+ phishing_openphish_feed /etc/mail/spamassassin/openphish-feed.txt
+ phishing_phishtank_feed /etc/mail/spamassassin/phishtank-feed.csv
+ body URI_PHISHING eval:check_phishing()
+ describe URI_PHISHING Url match phishing in feed
+ endif
+
+DESCRIPTION
+ This plugin finds uris used in phishing campaigns detected by OpenPhish
+ or PhishTank feeds.
+
+ The Openphish free feed is updated every 6 hours and can be downloaded
+ from https://openphish.com/feed.txt. The Premium Openphish feed is not
+ currently supported.
+
+ The PhishTank free feed is updated every 1 hours and can be downloaded
+ from http://data.phishtank.com/data/online-valid.csv. To avoid download
+ limits a registration is required.
+