Lines 580-585
Link Here
|
580 |
# bandwidth-pigs |
580 |
# bandwidth-pigs |
581 |
header T_FROM_IN_PIGS rbleval:check_rbl_from('pigs', 'bandwidth-pigs.monkeys.com.') |
581 |
header T_FROM_IN_PIGS rbleval:check_rbl_from('pigs', 'bandwidth-pigs.monkeys.com.') |
582 |
tflags T_FROM_IN_PIGS net |
582 |
tflags T_FROM_IN_PIGS net |
|
|
583 |
# in.dnsbl.org |
584 |
header T_FROM_IN_IN_DNSBL rbleval:check_rbl_from('in-dnsbl', 'in.dnsbl.org.') |
585 |
tflags T_FROM_IN_IN_DNSBL net |
586 |
|
587 |
# temporary |
588 |
header T_FROM_IN_RFCI_ABUSE rbleval:check_rbl_from('rfci-abuse', 'abuse.rfc-ignorant.org.') |
589 |
header T_FROM_IN_RFCI_POSTMASTER rbleval:check_rbl_from('rfci-postmaster', 'postmaster.rfc-ignorant.org.') |
590 |
header T_FROM_IN_RFCI_WHOIS rbleval:check_rbl_from('rfci-whois', 'whois.rfc-ignorant.org.') |
591 |
|
592 |
# bug 1375: do RBL look-ups on URLs |
593 |
header T_URI_IN_RFCI_ABUSE rbleval:check_rbl_uris('rfci-abuse', 'abuse.rfc-ignorant.org.') |
594 |
header T_URI_IN_RFCI_DSN rbleval:check_rbl_uris('rfci-dsn', 'dsn.rfc-ignorant.org.') |
595 |
header T_URI_IN_RFCI_POSTMASTER rbleval:check_rbl_uris('rfci-postmaster', 'postmaster.rfc-ignorant.org.') |
596 |
header T_URI_IN_RFCI_WHOIS rbleval:check_rbl_uris('rfci-whois', 'whois.rfc-ignorant.org.') |
597 |
tflags T_URI_IN_RFCI_ABUSE net |
598 |
tflags T_URI_IN_RFCI_DSN net |
599 |
tflags T_URI_IN_RFCI_POSTMASTER net |
600 |
tflags T_URI_IN_RFCI_WHOIS net |
601 |
|
602 |
header T_URI_IN_DEADBEEF rbleval:check_rbl_uris('deadbeef', 'bl.deadbeef.com.') |
603 |
header T_URI_IN_IN_DNSBL rbleval:check_rbl_uris('in-dnsbl', 'in.dnsbl.org.') |
604 |
header T_URI_IN_PIGS rbleval:check_rbl_uris('pigs', 'bandwidth-pigs.monkeys.com.') |
605 |
tflags T_URI_IN_DEADBEEF net |
606 |
tflags T_URI_IN_IN_DNSBL net |
607 |
tflags T_URI_IN_PIGS net |
608 |
|
609 |
meta T_RFC_IGNORANT_A1 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS > 1) |
610 |
meta T_RFC_IGNORANT_A2 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS > 2) |
611 |
meta T_RFC_IGNORANT_A3 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS > 3) |
612 |
|
613 |
meta T_RFC_IGNORANT_B1 (T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 1) |
614 |
meta T_RFC_IGNORANT_B2 (T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 2) |
615 |
meta T_RFC_IGNORANT_B3 (T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 3) |
616 |
|
617 |
meta T_RFC_IGNORANT_C1 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS + T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 1) |
618 |
meta T_RFC_IGNORANT_C2 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS + T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 2) |
619 |
meta T_RFC_IGNORANT_C3 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS + T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 3) |
620 |
meta T_RFC_IGNORANT_C4 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS + T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 4) |
621 |
meta T_RFC_IGNORANT_C5 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS + T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 5) |
622 |
meta T_RFC_IGNORANT_C6 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS + T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 6) |
623 |
meta T_RFC_IGNORANT_C7 (T_URI_IN_RFCI_ABUSE + T_URI_IN_RFCI_DSN + T_URI_IN_RFCI_POSTMASTER + T_URI_IN_RFCI_WHOIS + T_FROM_IN_RFCI_ABUSE + T_FROM_IN_RFCI_DSN + T_FROM_IN_RFCI_POSTMASTER + T_FROM_IN_RFCI_WHOIS > 7) |
583 |
|
624 |
|
584 |
# OK, a whole batch of faked-HELO detection rules. These work by checking |
625 |
# OK, a whole batch of faked-HELO detection rules. These work by checking |
585 |
# for hosts HELOing in a certain domain, but without rDNS matching that. |
626 |
# for hosts HELOing in a certain domain, but without rDNS matching that. |