home *** CD-ROM | disk | FTP | other *** search
/ ftp.f-secure.com / 2014.06.ftp.f-secure.com.tar / ftp.f-secure.com / support / hotfix / fsis / IS-SpamControl.fsfix / iufssc / rules / 96_fs-dyndns.cf < prev    next >
Text File  |  2006-11-29  |  12KB  |  315 lines
  1. # 96_fs-dyndns.cf -- era Mon May 23 11:05:26 2005
  2. # Copyright (C) 2005-2006 F-Secure Corporation
  3. # $Id: 96_fs-dyndns.cf 4051 2006-10-26 10:20:32Z eriker $
  4.  
  5.  
  6. ifplugin FS::MsgStructure
  7.  
  8.  
  9. # Tests rely on X-Spam-Relays-Untrusted: header --> require DNS --> tflags net
  10.  
  11.  
  12. # rule: RDNS_DYNAMIC_HEX_IP
  13. # added 2005-05-17
  14. # test: ######## TODO: add test case
  15.  
  16. loadplugin   FS::FSEvalTests
  17.  
  18. header   RDNS_DYNAMIC_HEX_IP eval:rdns_dynamic_hex_ip()
  19. describe RDNS_DYNAMIC_HEX_IP Injection point's RDNS has IP address in hex
  20. tflags     RDNS_DYNAMIC_HEX_IP net
  21. score    RDNS_DYNAMIC_HEX_IP 1
  22.  
  23.  
  24.  
  25. # rule: __RDNS_DYNAMIC_IP_4
  26. # added 2005-05-12
  27. # edit 2005-05-16: fix error, relax regex somewhat
  28. # edit 2005-05-19: allow leading zeros
  29. # test: spam-2005-05-16/df-2005-05-16-007309.txt
  30. # test: spam-2005-05-19/df-2005-05-19-004112.txt
  31.  
  32. header      __RDNS_DYNAMIC_IP_4 X-Spam-Relays-Untrusted =~ /^\[ ip=(\d+)\.(\d+)\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\1.(?:00?)?\2.(?:00?)?\3.(?:00?)?\4[-.]/
  33. describe __RDNS_DYNAMIC_IP_4 Reverse DNS contains IP address
  34. tflags     __RDNS_DYNAMIC_IP_4 net
  35.  
  36.  
  37. # rule: __RDNS_DYNAMIC_IP_4CRASH
  38. # added 2005-05-12
  39. # edit 2005-05-18: relax bounding regex
  40. # edit 2005-05-19: allow double leading zeros
  41. # test: spam-2005-05-12/df-2005-05-12-000584.txt
  42.  
  43. header      __RDNS_DYNAMIC_IP_4CRASH X-Spam-Relays-Untrusted =~ /^\[ ip=(\d+)\.(\d+)\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\1(?:00?)?\2(?:00?)?\3(?:00?)?\4[-.]/
  44. describe __RDNS_DYNAMIC_IP_4CRASH Reverse DNS contains IP address without separators
  45. tflags     __RDNS_DYNAMIC_IP_4CRASH net
  46.  
  47.  
  48. # rule: __RDNS_DYNAMIC_IP_4REVERSE
  49. # added 2005-05-12
  50. # edit 2005-05-18: relax bounding regex
  51. # edit 2005-05-19: allow leading zeros
  52. # test: ######## TODO: fill in
  53.  
  54. header      __RDNS_DYNAMIC_IP_4REVERSE X-Spam-Relays-Untrusted =~ /^\[ ip=(\d+)\.(\d+)\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\4.(?:00?)?\3.(?:00?)?\2\.(?:00?)?1[-.]/
  55. describe __RDNS_DYNAMIC_IP_4REVERSE Reverse DNS contains reverse IP address
  56. tflags     __RDNS_DYNAMIC_IP_4REVERSE net
  57.  
  58.  
  59. # rule: RDNS_DYNAMIC_IP_4
  60.  
  61. meta RDNS_DYNAMIC_IP_4 (__RDNS_DYNAMIC_IP_4 || __RDNS_DYNAMIC_IP_4CRASH || __RDNS_DYNAMIC_IP_4REVERSE)
  62. describe RDNS_DYNAMIC_IP_4 Reverse DNS contains full IP address
  63. tflags     RDNS_DYNAMIC_IP_4 net
  64. score     RDNS_DYNAMIC_IP_4 1
  65.  
  66.  
  67.  
  68. # rule: __RDNS_DYNAMIC_IP_3
  69. # added 2005-05-12
  70. # edit 2005-05-18: relax bounding regex
  71. # edit 2005-05-19: allow leading zeros
  72. # test: ######## TODO: fill in
  73.  
  74. header      __RDNS_DYNAMIC_IP_3 X-Spam-Relays-Untrusted =~ /^\[ ip=\d+\.(\d+)\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\1.(?:00?)?\2.(?:00?)?\3[-.]/
  75. describe __RDNS_DYNAMIC_IP_3 Reverse DNS contains 3 octets of IP address
  76. tflags     __RDNS_DYNAMIC_IP_3 net
  77.  
  78.  
  79. # rule: __RDNS_DYNAMIC_IP_3C
  80. # added 2005-05-12
  81. # edit 2005-05-18: relax bounding regex
  82. # edit 2005-05-19: allow double leading zeros
  83. # test: spam-2005-05-12/df-2005-05-12-000584.txt
  84.  
  85. header      __RDNS_DYNAMIC_IP_3C X-Spam-Relays-Untrusted =~ /^\[ ip=\d+\.(\d+)\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\1(?:00?)?\2(?:00?)?\3[-.]/
  86. describe __RDNS_DYNAMIC_IP_3C Reverse DNS has 3 octets of IP without separator
  87. tflags     __RDNS_DYNAMIC_IP_3C net
  88.  
  89.  
  90. # rule: __RDNS_DYNAMIC_IP_3R
  91. # added 2005-05-12
  92. # edit 2005-05-18: relax bounding regex
  93. # edit 2005-05-19: allow leading zeros
  94. # test: ######## TODO: fill in
  95.  
  96. header      __RDNS_DYNAMIC_IP_3R X-Spam-Relays-Untrusted =~ /^\[ ip=\d+\.(\d+)\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\3.(?:00?)?\2.(?:00?)?\1[-.]/
  97. describe __RDNS_DYNAMIC_IP_3R Reverse DNS has reversed 3 last octets of IP
  98. tflags     __RDNS_DYNAMIC_IP_3R net
  99.  
  100.  
  101. # rule: RDNS_DYNAMIC_IP_3
  102.  
  103. meta RDNS_DYNAMIC_IP_3 (!RDNS_DYNAMIC_IP_4 && (__RDNS_DYNAMIC_IP_3 || __RDNS_DYNAMIC_IP_3C || __RDNS_DYNAMIC_IP_3C))
  104. describe RDNS_DYNAMIC_IP_3 Reverse DNS contains last 3 octets of IP address
  105. tflags     RDNS_DYNAMIC_IP_3 net
  106. score     RDNS_DYNAMIC_IP_3 0.5
  107.  
  108.  
  109.  
  110. # rule: __RDNS_DYNAMIC_IP_2
  111. # added 2005-05-12
  112. # edit 2005-05-18: relax bounding regex
  113. # edit 2005-05-19: allow leading zeros
  114. # test: spam-2005-05-18/df-2005-05-18-001604.txt
  115.  
  116. header      __RDNS_DYNAMIC_IP_2 X-Spam-Relays-Untrusted =~ /^\[ ip=\d+\.\d+\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\1.(?:00?)?\2[-.]/
  117. describe __RDNS_DYNAMIC_IP_2 Reverse DNS contains last 2 octets of IP address
  118. tflags     __RDNS_DYNAMIC_IP_2 net
  119.  
  120.  
  121. # rule: __RDNS_DYNAMIC_IP_2R
  122. # added 2005-05-12
  123. # edit 2005-05-18: relax bounding regex
  124. # edit 2005-05-19: allow leading zeros
  125. # test: spam-2005-05-12/df-2005-05-12-003187.txt
  126.  
  127. header      __RDNS_DYNAMIC_IP_2R X-Spam-Relays-Untrusted =~ /^\[ ip=\d+\.\d+\.(\d+)\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\2.(?:00?)?\1[-.]/
  128. describe __RDNS_DYNAMIC_IP_2R Reverse DNS has reversed 2 last octets of IP
  129. tflags     __RDNS_DYNAMIC_IP_2R net
  130.  
  131.  
  132. # rule: RDNS_DYNAMIC_IP_2
  133.  
  134. meta RDNS_DYNAMIC_IP_2 (!RDNS_DYNAMIC_IP_4 && !RDNS_DYNAMIC_IP_3 && (__RDNS_DYNAMIC_IP_2 || __RDNS_DYNAMIC_IP_2R))
  135. describe RDNS_DYNAMIC_IP_2 Reverse DNS contains last 2 octets of IP address
  136. score     RDNS_DYNAMIC_IP_2 0.2
  137. tflags     RDNS_DYNAMIC_IP_2 net
  138.  
  139.  
  140.  
  141. # rule: __RDNS_DYNAMIC_IP_1
  142. # added 2005-05-19
  143. # test: spam-2005-05-19/df-2005-05-19-002431.txt
  144.  
  145. header      __RDNS_DYNAMIC_IP_1 X-Spam-Relays-Untrusted =~ /^\[ ip=\d+\.\d+\.\d+\.(\d+) rdns=(?:[-A-Za-z0-9.]*[^0-9 ])?(?:00?)?\1[-.]/
  146. describe __RDNS_DYNAMIC_IP_1 Reverse DNS contains last octet of IP address
  147. tflags     __RDNS_DYNAMIC_IP_1 net
  148.  
  149.  
  150. # rule: RDNS_DYNAMIC_IP_1
  151.  
  152. meta     RDNS_DYNAMIC_IP_1 (!RDNS_DYNAMIC_IP_4 && !RDNS_DYNAMIC_IP_3 && !RDNS_DYNAMIC_IP_2 && __RDNS_DYNAMIC_IP_1)
  153. describe RDNS_DYNAMIC_IP_1 Reverse DNS contains last octet of IP address
  154. tflags     RDNS_DYNAMIC_IP_1 net
  155. score     RDNS_DYNAMIC_IP_1 0.1
  156.  
  157.  
  158. # rule: RDNS_DYNAMIC_BIGINT
  159. # added 2005-05-19
  160. # edit 2005-05-20: special exemption for webnnnn.mail.yahoo.com
  161. # test: spam-2005-05-19/df-2005-05-19-004271.txt
  162. # test: spam-2005-05-19/df-2005-05-19-004361.txt
  163. # fail: reference/yahoo-sample-0001.eml
  164.  
  165. header RDNS_DYNAMIC_BIGINT X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=(?!web\d+\.mail\.yahoo\.com )[-A-Za-z0-9]*[-A-Za-z.]\d{4,20}[-.]/
  166. describe RDNS_DYNAMIC_BIGINT Reverse DNS contains a big number
  167. tflags     RDNS_DYNAMIC_BIGINT net
  168. score     RDNS_DYNAMIC_BIGINT 1
  169.  
  170.  
  171. # rule: RDNS_DYNAMIC_BIGHEX
  172. # added 2005-05-19
  173. # test: spam-2005-05-19/df-2005-05-19-007985.txt
  174.  
  175. header RDNS_DYNAMIC_BIGHEX X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=[-A-Za-z0-9]*[-A-Za-z.][0-9A-Fa-f]{8}[-.]/
  176. describe RDNS_DYNAMIC_BIGHEX Reverse DNS contains a big hex number
  177. tflags     RDNS_DYNAMIC_BIGHEX net
  178. score     RDNS_DYNAMIC_BIGHEX 1
  179.  
  180.  
  181.  
  182.  
  183. # rule: __RDNS_DYNAMIC_IP
  184. # added 2005-05-18
  185. # edit 2005-12-20: corrected references to RDNS_DYNAMIC_* rules
  186. # edit 2006-10-26: add underscores to name, remove score
  187.  
  188. meta     __RDNS_DYNAMIC_IP (RDNS_DYNAMIC_HEX_IP || RDNS_DYNAMIC_IP_4 || RDNS_DYNAMIC_IP_3 || RDNS_DYNAMIC_IP_2 || RDNS_DYNAMIC_IP_1 || RDNS_DYNAMIC_BIGINT || RDNS_DYNAMIC_BIGHEX)
  189. describe __RDNS_DYNAMIC_IP One of the RDNS_DYNAMIC_* rules matches
  190. tflags     __RDNS_DYNAMIC_IP net
  191.  
  192.  
  193. ######## TODO: add more provider-specific dynamic RDNS patterns
  194. # test: spam-2005-05-18/df-2005-05-18-001689.txt
  195. # test: spam-2005-05-18/df-2005-05-18-001579.txt
  196. # test: spam-2005-05-18/df-2005-05-18-001464.txt
  197. # test: spam-2005-05-18/df-2005-05-18-001494.txt
  198. # test: spam-2005-05-18/df-2005-05-18-001662.txt
  199. # test: spam-2005-05-18/df-2005-05-18-001687.txt
  200. # test: spam-2005-05-18/df-2005-05-18-001630.txt
  201. # test: spam-2005-05-18/df-2005-05-18-001657.txt
  202. # test: spam-2005-05-18/df-2005-05-18-001710.txt
  203. # test: spam-2005-05-18/df-2005-05-18-001476.txt
  204. # test: spam-2005-05-18/df-2005-05-18-001678.txt
  205. # test: spam-2005-05-18/df-2005-05-18-001551.txt
  206. # test: spam-2005-05-18/df-2005-05-18-001558.txt
  207. # test: spam-2005-05-18/df-2005-05-18-001643.txt
  208. # test: spam-2005-05-18/df-2005-05-18-001700.txt
  209. # test: spam-2005-05-18/df-2005-05-18-001500.txt
  210. # test: spam-2005-05-18/df-2005-05-18-001576.txt
  211. # test: spam-2005-05-18/df-2005-05-18-001572.txt
  212. # test: spam-2005-05-18/df-2005-05-18-001501.txt
  213. # test: spam-2005-05-18/df-2005-05-18-001475.txt
  214. # test: spam-2005-05-18/df-2005-05-18-001487.txt
  215. # test: spam-2005-05-18/df-2005-05-18-001393.txt
  216. # test: spam-2005-05-18/df-2005-05-18-001620.txt
  217. # test: spam-2005-05-18/df-2005-05-18-001556.txt
  218. # test: spam-2005-05-18/df-2005-05-18-001483.txt
  219. # test: spam-2005-05-18/df-2005-05-18-001486.txt
  220. # test: spam-2005-05-18/df-2005-05-18-001535.txt
  221. # test: spam-2005-05-18/df-2005-05-18-001636.txt
  222. # test: spam-2005-05-18/df-2005-05-18-001409.txt
  223. # test: spam-2005-05-18/df-2005-05-18-001544.txt
  224. # test: spam-2005-05-18/df-2005-05-18-001478.txt
  225. # test: spam-2005-05-18/df-2005-05-18-001578.txt
  226. # test: spam-2005-05-18/df-2005-05-18-001484.txt
  227. # test: spam-2005-05-18/df-2005-05-18-001561.txt
  228. # test: spam-2005-05-18/df-2005-05-18-001580.txt
  229. # test: spam-2005-05-18/df-2005-05-18-001664.txt
  230. # test: spam-2005-05-18/df-2005-05-18-001396.txt
  231. # test: spam-2005-05-18/df-2005-05-18-001655.txt
  232. # test: spam-2005-05-18/df-2005-05-18-001613.txt
  233. # test: spam-2005-05-18/df-2005-05-18-001564.txt
  234. # test: spam-2005-05-18/df-2005-05-18-001528.txt
  235. # test: spam-2005-05-18/df-2005-05-18-001615.txt
  236. # test: spam-2005-05-18/df-2005-05-18-001398.txt
  237.  
  238.  
  239.  
  240. # rule: DIRECT_MX_FORGED_RECEIVED
  241. # added 2005-05-19
  242. # edit 2005-05-27: __UNTRUSTED_TAIL_PRIV case
  243. # test: spam-2005-05-19/df-2005-05-19-007196.txt
  244.  
  245. header __MULTIPLE_UNTRUSTED_RELAYS X-Spam-Relays-Untrusted =~ /\] \[/
  246. ######## FIXME: modularize to use reserved range from Constants.pm
  247. header __UNTRUSTED_TAIL_PRIV X-Spam-Relays-Untrusted =~ /^[^\]]+\]( \[ ip=(192\.168|172.(1[6-9]|2[0-9]|3[01])|169.254\|127|10)\.[^\]]+\])+$/
  248.  
  249. meta DIRECT_MX_FORGED_RECEIVED (__MULTIPLE_UNTRUSTED_RELAYS && !__UNTRUSTED_TAIL_PRIV && __RDNS_DYNAMIC_IP)
  250. describe DIRECT_MX_FORGED_RECEIVED Multiple Received: lines in direct-to-MX
  251. tflags     DIRECT_MX_FORGED_RECEIVED net
  252. score     DIRECT_MX_FORGED_RECEIVED 0
  253.  
  254.  
  255.  
  256. # rule: FIRST_UNTRUSTED_NO_RDNS
  257. # added 2005-05-19
  258. # test: spam-2005-05-19/df-2005-05-19-007196.txt
  259.  
  260. header FIRST_UNTRUSTED_NO_RDNS X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns= [^\]]+\] \[/
  261. describe FIRST_UNTRUSTED_NO_RDNS First untrusted relay of >=2 has no rdns
  262. tflags     FIRST_UNTRUSTED_NO_RDNS net
  263. score     FIRST_UNTRUSTED_NO_RDNS 0.5
  264.  
  265.  
  266. # rule: FIRST_UNTRUSTED_MANY_NO_RDNS
  267. # added 2005-05-19
  268. # test: spam-2005-05-19/df-2005-05-19-007196.txt
  269.  
  270. header FIRST_UNTRUSTED_MANY_NO_RDNS X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns= [^\]]+\] \[[^\]]+\] \[/
  271. describe FIRST_UNTRUSTED_MANY_NO_RDNS First untrusted relay of > 2 has no rdns
  272. tflags     FIRST_UNTRUSTED_MANY_NO_RDNS net
  273. score     FIRST_UNTRUSTED_MANY_NO_RDNS 0.5
  274.  
  275.  
  276.  
  277. # rule: DIRECT_MX_FORGED_CCTLD
  278. # added 2005-05-18
  279. # test: spam-2005-05-18/df-2005-05-18-001520.txt
  280. # test: spam-2005-05-18/df-2005-05-18-001689.txt
  281.  
  282.  
  283. # Forger claims to be google.fr (just domain name, no host part) or moo.org.ni
  284. ######## FIXME: should use canned regex for what is a toplevel ccTLD
  285. # (I cheated and did not list quite all the ones we have in M::SA::Conf.pm)
  286. header DIRECT_MX_FORGED_CCTLD X-Spam-Relays-Untrusted =~ /^[^]]+ helo=[0-9a-zA-Z][-0-9A-Za-z]*\.(?:(?:ac|atts?|biz|com?|edu?|fi(?:rm)?|go[bv]?|gv|in(?:tl?|fo?)?|k12|ltd|med?|mil?|net?|nic|nom|org?|pages?|pp|pro|rec|sa|sch|web)\.)?[A-Za-z][A-Za-z] [^][]+\]$/i
  287. describe DIRECT_MX_FORGED_CCTLD Apparent injection point claims toplevel ccTLD
  288. tflags     DIRECT_MX_FORGED_CCTLD net
  289. score     DIRECT_MX_FORGED_CCTLD 0.5
  290.  
  291.  
  292. # rule: DIRECT_MX_NO_RDNS
  293. # added 2005-05-12
  294. # test: spam-2005-05-18/df-2005-05-18-001445.txt
  295.  
  296. header     DIRECT_MX_NO_RDNS X-Spam-Relays-Untrusted =~ /^[^]]+ rdns= [^][]+\]$/
  297. describe DIRECT_MX_NO_RDNS Apparent injection point has no reverse DNS
  298. tflags     DIRECT_MX_NO_RDNS net
  299. score     DIRECT_MX_NO_RDNS 1
  300.  
  301.  
  302. # rule: RATWARE_BASE64_DIRECT_MX
  303. # added 2005-05-18
  304. # test: spam-2005-05-18/df-2005-05-18-001520.txt
  305.  
  306. header __RATWARE_BASE64_DIRECT_MX_DATE_TZ0000 Date =~ / \+0000$/
  307.  
  308. meta RATWARE_BASE64_DIRECT_MX (__RATWARE_BASE64_DIRECT_MX_DATE_TZ0000 && MSGSTRUCT_ASCII_BASE64 && DIRECT_MX_FORGED_CCTLD && (__RDNS_DYNAMIC_IP || DIRECT_MX_NO_RDNS))
  309. describe RATWARE_BASE64_DIRECT_MX Curious combination of not so innocent cues
  310. tflags     RATWARE_BASE64_DIRECT_MX net
  311. score     RATWARE_BASE64_DIRECT_MX 9
  312.  
  313.  
  314. endif
  315.