procmail
[Top] [All Lists]

Re: Using Procmail for RBL Blacklists

2003-04-06 23:50:22

Hi Kim,

Sorry to totally rearrange this, but I don't think the scoring is even 
necessary. I would make use of the "E" flag though, for specifing "else if" 
like actions:


#If this line is even in the headers,
#then you can assume the IP you want is
#handing off to astro:
:0
* ^Received:.*from astro\.snellfamily\.com.*by jinx\.unknown\.nu
{ 
  
:0
* .*\[\/.*$?[   ]*by astro\.snell
{
  CHECK=${MATCH}
     
   :0
    *$  CHECK ?? .*\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
    { CHECKIP=${MATCH} }
 
}

#If the above didn't execute,
#then you can assume you need the IP
#hitting jinx:
:0 E
* .*\[\/.*$?[   ]*by jinx\.unknown\.nu
{
  CHECK=${MATCH}

  :0
  *$  CHECK ?? .*\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
  { CHECKIP=${MATCH} }

}

...i've used a lot of "greedy" matching (.*), but i think
it should work. The space inside the "[ ]" is
just a space character and hard tab. Also, I like to use
a specific regex for IPs. This defines one octet:

OCTET="([0-9]|[1-9][0-9]|1[0-9][0-9]|2([0-4][0-9]|5[0-5]))"

...so then your nested rule that extracts the IP could be:

   :0
   *$ CHECK ?? .*\/$OCTET\.$OCTET\.$OCTET\.$OCTET
   { CHECKIP=${MATCH} }

Regards,

Robert Arnold


On Sun, 06 Apr 2003 20:44:22 -0400 (EDT)
Kim Scarborough <lists(_at_)jinx(_dot_)unknown(_dot_)nu> wrote:

Thanks for the help! I'm getting closer to getting this to work. I
substituted this recipe for what I had, so now I'm using this to get the
originating IP:

:0
* 1^1 ^\/Received:.*
* ! MATCH  ?? from astro\.snellfamily\.com.*by jinx\.unknown\.nu
{
      CHECK=${MATCH}
      :0
      *$  CHECK ?? Received:.*\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
      { CHECKIP=${MATCH} }
}


The recipe above is grabbing 133.140.97.171, but I want it to get
200.165.206.19. Basically, I want to say "grab the received IP from the
line that says 'received by jinx.unknown.nu', unless that's the IP of
astro.snellfamily.org, in which case grab the IP of the machine that astro
received it from".

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail