Changeset 9 for trunk

Timestamp:

11/06/09 10:45:33 (15 years ago)

Author:

Kris Deugau

Message:

/trunk/dnsbl

Commit current working version of extract-data

File:

• trunk/dnsbl/extract-data (modified) (6 diffs)

trunk/dnsbl/extract-data

@@ -132 +132 @@
   # now, get the relay IP
 
+  my $stmsg = $status->get_message();
+  my @untrusted = @{$stmsg->{metadata}->{relays_untrusted}};
+
+  my $sa_intip = new NetAddr::IP $untrusted[0]->{ip};
+
+
   my %headerlist = %{$imap->parse_headers($msgs[$i], "Received")};
   my $recvnum = 0;
@@ -171 +177 @@
 #Received: from source ([208.95.48.65]) (using TLSv1) by
 # exprod5mx230.postini.com ([64.18.4.10]) with SMTP; Fri, 10 Jul 
-    my ($tmprelayip) = ($recv =~ /from source \(\[([\d.]+)\]\) (?:\(using TLSv1\) )?by exprod\dm[xo]b?\d+\.postini\.com/);
+    my ($tmprelayip) = ($recv =~ /from source \(\[([\d.]+)\]\) (?:\(using TLSv1\) )?by (?:exprod\dm[xo]b?|chipmx)\d+\.postini\.com/);
     $relayip = new NetAddr::IP $tmprelayip;
   } else {
@@ -177 +183 @@
     $relayip = new NetAddr::IP $tmprelayip;
   }
+
+print "SA vs manual extraction, relay IP mismatch: $sa_intip vs $relayip on\n\t$recv\n" if $sa_intip != $relayip;
 
 # Hotmail/Windows Live Mail may originate or relay spam, but we can't blacklist them
@@ -249 +257 @@
   my $yahoo13 = new NetAddr::IP "209.191.64.0/18";
   next if $relayip->within($yahoo13);
+ #route:          212.82.104.0/21
+  my $yahoo14 = new NetAddr::IP "212.82.104.0/21";
+  next if $relayip->within($yahoo14);
 
 # and the same goes for Bell Canada.  *le sigh*
@@ -270 +281 @@
   next if $relayip->within($craigslist1);
 
+# not gonna whitelist the whole enchilada... just the asmtpout0(11-30).mac.com
+# 17.148.16     011 -> 86       030 -> 105
+#IP-Network                    17.0.0.0/8
+#IP-Network-Block              017.000.000.000 - 017.255.255.255
+#Org-Name                      Apple Computer, Inc.
+  my $apple1 = new NetAddr::IP "17.148.16.64/26";
+  next if $relayip->within($apple1);
+
   $iplist{$relayip->addr}++ if $relayip;
 #  print "$recv\n";
@@ -297 +316 @@
 }
 foreach my $uri (sort keys %urilist) {
-  my @hout = qx { host $uri.multi.uribl.com; host $uri.uribl.company.com };
+  my @hout = qx { host '$uri.multi.uribl.com'; host '$uri.uribl.company.com' };
   if ($hout[0] =~ /NXDOMAIN/ && $hout[1] =~ /NXDOMAIN/) {
     if ($opts{u}) {