Re: [courier-users] Spam with Delivered-To header

On Friday 04 May 2007, Bob Kinney wrote:
> Pawel Tecza wrote:
> > Earl Kinney III <bkinney@hmdc.harvard.edu> writes:
> >> We started seeing these kinds of spam some time ago and in
> >> response wrote a custom perlfilter that rejects messages with a
> >> Delivered-To containing one of our hosted domains. So far it has
> >> not blocked anything it wasn't supposed to and we no longer see
> >> the bounces.
> >
> > Hello Earl,
> >
> > Could you please show us the code of your perlfilter, if it's not
> > a top secret, of course ;) I think it can be very interesting
> > for many Courier admins.
> >
> > My best regards,
> >
> > Pawel
>
> Using the perlfilter-example.pl as a basis you can modify the
> filterdata subroutine like so:
>
> sub filterdata
> {
> my $filename=shift;
>
> # get our domain list ($domains_file is the hosteddomains file)
> my $fh=new IO::File "< $domains_file";
> chomp(my @DOMAINS = <$fh>);
>
> # construct a portion of a regex
> my $domain_regex = '(' . join( '|', @DOMAINS ) . ')';

You may want to change this to the following version

my $domain_regex = '(?:' . join( '|', @DOMAINS ) . ')';

This version will avoid that unnecessary capture group.
I of course assume that you don't need this in some other re to capture
the matched domain.

> # Here's where the custom content filter is implemented. Use
> filehandles # so that cleanup's automatic.
>
> my $fh=new IO::File "< $filename";
>
> return "" unless defined $fh;
>
> my $line;
>
> while ( defined ($line=<$fh>))
> {
> chomp $line;
> last if $line eq ""; # End of headers
>
> return "500 Already have my Delivered-To header."
> if $line =~ /^Delivered-To:.*\@${domain_regex}/i;
> }
>
> return "";
> }



-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
courier-users mailing list
courier-users@lists.sourceforge.net
Unsubscribe: https://lists.sourceforge.net/lists/.../courier-users