Author: quinlan
Date: Mon May 9 14:35:31 2005
New Revision: 169364
URL: http://svn.apache.org/viewcvs?rev=169364&view=rev
Log:
promote new HELO_DYNAMIC* rules - same efficacy in nightly, should be fine
Modified:
spamassassin/trunk/rules/20_fake_helo_tests.cf
spamassassin/trunk/rules/70_testing.cf
Modified: spamassassin/trunk/rules/20_fake_helo_tests.cf
URL: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/20_fake_helo_tests.cf?rev=169364&r1=169363&r2=169364&view=diff
==============================================================================
--- spamassassin/trunk/rules/20_fake_helo_tests.cf (original)
+++ spamassassin/trunk/rules/20_fake_helo_tests.cf Mon May 9 14:35:31 2005
@@ -83,7 +83,7 @@
# 74.67-201-80.adsl.skynet.be [80.201.67.74]
# 12-218-225-223.client.mchsi.com [12.218.225.223]
# (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise)
-header HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+/i
+header HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
describe HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
# dhcp024-210-034-053.columbus.rr.com [24.210.34.53]
@@ -91,21 +91,21 @@
# node-c-8b22.a2000.nl
# cm89.omega139.maxonline.com.sg
# cm114.gamma208.maxonline.com.sg
-header HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+/i
+header HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
describe HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
# fia83-8.dsl.hccnet.nl [62.251.8.83]
# fia160-115-100.dsl.hccnet.nl [80.100.115.160]
-header HELO_DYNAMIC_HCC X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\./i
+header HELO_DYNAMIC_HCC X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\.[^\]]+ auth= /i
describe HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
# h0002a5d76857.ne.client2.attbi.com [65.96.12.59]
-header HELO_DYNAMIC_ATTBI X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+\S+\.client2\.attbi\.com/i
+header HELO_DYNAMIC_ATTBI X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+\S+\.client2\.attbi\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_ATTBI Relay HELO'd using suspicious hostname (ATTBI.com)
# CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com
# CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140]
-header HELO_DYNAMIC_ROGERS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com/i
+header HELO_DYNAMIC_ROGERS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers)
# ca-morpark-cuda1-zone7-b-159.vnnyca.adelphia.net[67.23.129.159]
@@ -113,7 +113,7 @@
# ky-richmond2a-123.rhmdky.adelphia.net [68.71.36.123]
# ny-lackawannacadent4-chtwga3a-b-117.buf.adelphia.net [68.71.205.117]
# fl-edel-u2-c3c-233.pbc.adelphia.net [68.64.89.233]
-header HELO_DYNAMIC_ADELPHIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net/i
+header HELO_DYNAMIC_ADELPHIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net[^\]]+ auth= /i
describe HELO_DYNAMIC_ADELPHIA Relay HELO'd using suspicious hostname (Adelphia)
# pD9E4F89F.dip.t-dialin.net [217.228.248.159]
@@ -130,67 +130,65 @@
describe HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP)
# YahooBB219173000034.bbtec.net [219.173.0.34]
-header HELO_DYNAMIC_YAHOOBB X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=YahooBB/i
+header HELO_DYNAMIC_YAHOOBB X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=YahooBB[^\]]+ auth= /i
describe HELO_DYNAMIC_YAHOOBB Relay HELO'd using suspicious hostname (YahooBB)
# ool-18be1aaf.dyn.optonline.net [24.190.26.175]
header HELO_DYNAMIC_OOL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.dyn\.optonline\.net/
describe HELO_DYNAMIC_OOL Relay HELO'd using suspicious hostname (OptOnline)
-header HELO_DYNAMIC_IPADDR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+/i
+header HELO_DYNAMIC_IPADDR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
describe HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2)
# wiley-170-10231.roadrunner.nf.net [205.251.210.249]
-header HELO_DYNAMIC_RR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner/i
+header HELO_DYNAMIC_RR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner[^\]]+ auth= /i
describe HELO_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (RR 2)
# pcp04024417pcs.toresd01.pa.comcast.net [68.86.206.126]
# bgp542174bgs.ewndsr01.nj.comcast.net[68.38.144.91]
# Computer-udp135632uds.union01.nj.comcast.net [68.39.99.32]
-header HELO_DYNAMIC_COMCAST X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast/i
+header HELO_DYNAMIC_COMCAST X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast[^\]]+ auth= /i
describe HELO_DYNAMIC_COMCAST Relay HELO'd using suspicious hostname (Comcast)
# h234n2fls32o895.telia.com [217.208.73.234]
# h53n2fls32o828.telia.com
# h116n2fls32o1111.telia.com
# h29n1fls306o1003.telia.com
-header HELO_DYNAMIC_TELIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=h\d+n\d+fls\S+\.telia\.com/i
+header HELO_DYNAMIC_TELIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=h\d+n\d+fls\S+\.telia\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_TELIA Relay HELO'd using suspicious hostname (Telia)
# CM-vina5-168-207.cm.vtr.net [200.104.168.207]
# CM-anto1-98-153.cm.vtr.net [200.104.98.153]
-header HELO_DYNAMIC_VTR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr/i
+header HELO_DYNAMIC_VTR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr[^\]]+ auth= /i
describe HELO_DYNAMIC_VTR Relay HELO'd using suspicious hostname (VTR)
# ec9z5l.cm.chello.no
-header HELO_DYNAMIC_CHELLO_NO X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.cm\.chello\.no/i
+header HELO_DYNAMIC_CHELLO_NO X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.cm\.chello\.no[^\]]+ auth= /i
describe HELO_DYNAMIC_CHELLO_NO Relay HELO'd using suspicious hostname (Chello.no)
# g225174.upc-g.chello.nl
# a151145.upc-a.chello.nl
# a96134.upc-a.chello.nl
-header HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl/i
+header HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl[^\]]+ auth= /i
describe HELO_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl)
# MG001182.user.veloxzone.com.br
# ba199058073.user.veloxzone.com.br
-header HELO_DYNAMIC_VELOX X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\./i
+header HELO_DYNAMIC_VELOX X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\.[^\]]+ auth= /i
describe HELO_DYNAMIC_VELOX Relay HELO'd using suspicious hostname (Veloxzone)
# public4-seve6-5-cust173.lond.broadband.ntl.com
# spr1-bolt5-5-0-cust9.manc.broadband.ntl.com
# spc1-lewi4-6-0-cust190.lond.broadband.ntl.com
-header HELO_DYNAMIC_NTL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com/i
+header HELO_DYNAMIC_NTL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_NTL Relay HELO'd using suspicious hostname (NTL)
# cp160000-a.mill1.nb.home.nl
# cp341468-b.venra1.lb.home.nl
-header HELO_DYNAMIC_HOME_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl/i
+header HELO_DYNAMIC_HOME_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i
describe HELO_DYNAMIC_HOME_NL Relay HELO'd using suspicious hostname (Home.nl)
-
# (I'm quite sure these may be a good spamsign in future)
# nwblwi-nrp3-l10-a671.nwblwi.tds.net
#header HELO_DYNAMIC_TDS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+-[a-z]\d+\.[a-z]{6}\.tds\.net/i
#header HELO_DYNAMIC_VIRTUA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+\.cps\./i
-
Modified: spamassassin/trunk/rules/70_testing.cf
URL: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/70_testing.cf?rev=169364&r1=169363&r2=169364&view=diff
==============================================================================
--- spamassassin/trunk/rules/70_testing.cf (original)
+++ spamassassin/trunk/rules/70_testing.cf Mon May 9 14:35:31 2005
@@ -26,21 +26,3 @@
#
########################################################################
-# replacement HELO_DYNAMIC rules which fix the "HELO_DYNAMIC rules firing on authenticated handovers" bug
-header T_HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
-header T_HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
-header T_HELO_DYNAMIC_HCC X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\.[^\]]+ auth= /i
-header T_HELO_DYNAMIC_ATTBI X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+\S+\.client2\.attbi\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_ROGERS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_ADELPHIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net[^\]]+ auth= /i
-header T_HELO_DYNAMIC_YAHOOBB X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=YahooBB[^\]]+ auth= /i
-header T_HELO_DYNAMIC_IPADDR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
-header T_HELO_DYNAMIC_RR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner[^\]]+ auth= /i
-header T_HELO_DYNAMIC_COMCAST X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast[^\]]+ auth= /i
-header T_HELO_DYNAMIC_TELIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=h\d+n\d+fls\S+\.telia\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_VTR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr[^\]]+ auth= /i
-header T_HELO_DYNAMIC_CHELLO_NO X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.cm\.chello\.no[^\]]+ auth= /i
-header T_HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl[^\]]+ auth= /i
-header T_HELO_DYNAMIC_VELOX X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\.[^\]]+ auth= /i
-header T_HELO_DYNAMIC_NTL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_HOME_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i
Date: Mon May 9 14:35:31 2005
New Revision: 169364
URL: http://svn.apache.org/viewcvs?rev=169364&view=rev
Log:
promote new HELO_DYNAMIC* rules - same efficacy in nightly, should be fine
Modified:
spamassassin/trunk/rules/20_fake_helo_tests.cf
spamassassin/trunk/rules/70_testing.cf
Modified: spamassassin/trunk/rules/20_fake_helo_tests.cf
URL: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/20_fake_helo_tests.cf?rev=169364&r1=169363&r2=169364&view=diff
==============================================================================
--- spamassassin/trunk/rules/20_fake_helo_tests.cf (original)
+++ spamassassin/trunk/rules/20_fake_helo_tests.cf Mon May 9 14:35:31 2005
@@ -83,7 +83,7 @@
# 74.67-201-80.adsl.skynet.be [80.201.67.74]
# 12-218-225-223.client.mchsi.com [12.218.225.223]
# (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise)
-header HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+/i
+header HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
describe HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
# dhcp024-210-034-053.columbus.rr.com [24.210.34.53]
@@ -91,21 +91,21 @@
# node-c-8b22.a2000.nl
# cm89.omega139.maxonline.com.sg
# cm114.gamma208.maxonline.com.sg
-header HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+/i
+header HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
describe HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
# fia83-8.dsl.hccnet.nl [62.251.8.83]
# fia160-115-100.dsl.hccnet.nl [80.100.115.160]
-header HELO_DYNAMIC_HCC X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\./i
+header HELO_DYNAMIC_HCC X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\.[^\]]+ auth= /i
describe HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
# h0002a5d76857.ne.client2.attbi.com [65.96.12.59]
-header HELO_DYNAMIC_ATTBI X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+\S+\.client2\.attbi\.com/i
+header HELO_DYNAMIC_ATTBI X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+\S+\.client2\.attbi\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_ATTBI Relay HELO'd using suspicious hostname (ATTBI.com)
# CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com
# CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140]
-header HELO_DYNAMIC_ROGERS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com/i
+header HELO_DYNAMIC_ROGERS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers)
# ca-morpark-cuda1-zone7-b-159.vnnyca.adelphia.net[67.23.129.159]
@@ -113,7 +113,7 @@
# ky-richmond2a-123.rhmdky.adelphia.net [68.71.36.123]
# ny-lackawannacadent4-chtwga3a-b-117.buf.adelphia.net [68.71.205.117]
# fl-edel-u2-c3c-233.pbc.adelphia.net [68.64.89.233]
-header HELO_DYNAMIC_ADELPHIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net/i
+header HELO_DYNAMIC_ADELPHIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net[^\]]+ auth= /i
describe HELO_DYNAMIC_ADELPHIA Relay HELO'd using suspicious hostname (Adelphia)
# pD9E4F89F.dip.t-dialin.net [217.228.248.159]
@@ -130,67 +130,65 @@
describe HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP)
# YahooBB219173000034.bbtec.net [219.173.0.34]
-header HELO_DYNAMIC_YAHOOBB X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=YahooBB/i
+header HELO_DYNAMIC_YAHOOBB X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=YahooBB[^\]]+ auth= /i
describe HELO_DYNAMIC_YAHOOBB Relay HELO'd using suspicious hostname (YahooBB)
# ool-18be1aaf.dyn.optonline.net [24.190.26.175]
header HELO_DYNAMIC_OOL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.dyn\.optonline\.net/
describe HELO_DYNAMIC_OOL Relay HELO'd using suspicious hostname (OptOnline)
-header HELO_DYNAMIC_IPADDR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+/i
+header HELO_DYNAMIC_IPADDR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
describe HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2)
# wiley-170-10231.roadrunner.nf.net [205.251.210.249]
-header HELO_DYNAMIC_RR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner/i
+header HELO_DYNAMIC_RR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner[^\]]+ auth= /i
describe HELO_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (RR 2)
# pcp04024417pcs.toresd01.pa.comcast.net [68.86.206.126]
# bgp542174bgs.ewndsr01.nj.comcast.net[68.38.144.91]
# Computer-udp135632uds.union01.nj.comcast.net [68.39.99.32]
-header HELO_DYNAMIC_COMCAST X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast/i
+header HELO_DYNAMIC_COMCAST X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast[^\]]+ auth= /i
describe HELO_DYNAMIC_COMCAST Relay HELO'd using suspicious hostname (Comcast)
# h234n2fls32o895.telia.com [217.208.73.234]
# h53n2fls32o828.telia.com
# h116n2fls32o1111.telia.com
# h29n1fls306o1003.telia.com
-header HELO_DYNAMIC_TELIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=h\d+n\d+fls\S+\.telia\.com/i
+header HELO_DYNAMIC_TELIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=h\d+n\d+fls\S+\.telia\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_TELIA Relay HELO'd using suspicious hostname (Telia)
# CM-vina5-168-207.cm.vtr.net [200.104.168.207]
# CM-anto1-98-153.cm.vtr.net [200.104.98.153]
-header HELO_DYNAMIC_VTR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr/i
+header HELO_DYNAMIC_VTR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr[^\]]+ auth= /i
describe HELO_DYNAMIC_VTR Relay HELO'd using suspicious hostname (VTR)
# ec9z5l.cm.chello.no
-header HELO_DYNAMIC_CHELLO_NO X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.cm\.chello\.no/i
+header HELO_DYNAMIC_CHELLO_NO X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.cm\.chello\.no[^\]]+ auth= /i
describe HELO_DYNAMIC_CHELLO_NO Relay HELO'd using suspicious hostname (Chello.no)
# g225174.upc-g.chello.nl
# a151145.upc-a.chello.nl
# a96134.upc-a.chello.nl
-header HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl/i
+header HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl[^\]]+ auth= /i
describe HELO_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl)
# MG001182.user.veloxzone.com.br
# ba199058073.user.veloxzone.com.br
-header HELO_DYNAMIC_VELOX X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\./i
+header HELO_DYNAMIC_VELOX X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\.[^\]]+ auth= /i
describe HELO_DYNAMIC_VELOX Relay HELO'd using suspicious hostname (Veloxzone)
# public4-seve6-5-cust173.lond.broadband.ntl.com
# spr1-bolt5-5-0-cust9.manc.broadband.ntl.com
# spc1-lewi4-6-0-cust190.lond.broadband.ntl.com
-header HELO_DYNAMIC_NTL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com/i
+header HELO_DYNAMIC_NTL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com[^\]]+ auth= /i
describe HELO_DYNAMIC_NTL Relay HELO'd using suspicious hostname (NTL)
# cp160000-a.mill1.nb.home.nl
# cp341468-b.venra1.lb.home.nl
-header HELO_DYNAMIC_HOME_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl/i
+header HELO_DYNAMIC_HOME_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i
describe HELO_DYNAMIC_HOME_NL Relay HELO'd using suspicious hostname (Home.nl)
-
# (I'm quite sure these may be a good spamsign in future)
# nwblwi-nrp3-l10-a671.nwblwi.tds.net
#header HELO_DYNAMIC_TDS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+-[a-z]\d+\.[a-z]{6}\.tds\.net/i
#header HELO_DYNAMIC_VIRTUA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+\.cps\./i
-
Modified: spamassassin/trunk/rules/70_testing.cf
URL: http://svn.apache.org/viewcvs/spamassassin/trunk/rules/70_testing.cf?rev=169364&r1=169363&r2=169364&view=diff
==============================================================================
--- spamassassin/trunk/rules/70_testing.cf (original)
+++ spamassassin/trunk/rules/70_testing.cf Mon May 9 14:35:31 2005
@@ -26,21 +26,3 @@
#
########################################################################
-# replacement HELO_DYNAMIC rules which fix the "HELO_DYNAMIC rules firing on authenticated handovers" bug
-header T_HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
-header T_HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
-header T_HELO_DYNAMIC_HCC X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\.[^\]]+ auth= /i
-header T_HELO_DYNAMIC_ATTBI X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+\S+\.client2\.attbi\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_ROGERS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_ADELPHIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net[^\]]+ auth= /i
-header T_HELO_DYNAMIC_YAHOOBB X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=YahooBB[^\]]+ auth= /i
-header T_HELO_DYNAMIC_IPADDR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
-header T_HELO_DYNAMIC_RR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner[^\]]+ auth= /i
-header T_HELO_DYNAMIC_COMCAST X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast[^\]]+ auth= /i
-header T_HELO_DYNAMIC_TELIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=h\d+n\d+fls\S+\.telia\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_VTR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr[^\]]+ auth= /i
-header T_HELO_DYNAMIC_CHELLO_NO X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.cm\.chello\.no[^\]]+ auth= /i
-header T_HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl[^\]]+ auth= /i
-header T_HELO_DYNAMIC_VELOX X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\.[^\]]+ auth= /i
-header T_HELO_DYNAMIC_NTL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com[^\]]+ auth= /i
-header T_HELO_DYNAMIC_HOME_NL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i