I've noticed a lot of dictionary spamming of late, and I was thinking
of enhancing my filter_recipient to help stop it. Right now, I basically
use filter_recipient to look for a HELO claiming to be me, or for an
E-Mail headed to my "whitelist request" address.
What I'd like to add is something to check validity of local
recipients (using a mechanism other than md_check_against_smtp_server
for various political reasons that aren't important here), but I'm not
sure how the logic flow works.
My questions are:
1) Is filter_recipient called for each RCPT TO: (as would
appear to be the case), or at DATA?
2) The documentation states that if filter_recipient returns
DISCARD, the message is discarded for ALL Recipients. Is
this also true of REJECT (as would also appear to be
the case)?
3) Since it looks like filter_recipient can't be used to
selectively (on a per-Recipient basis, allowing to some
but not all) reject/discard a connection, can I have it
alter a given Recipient envelope address so I can look
for that "flag" in filter_begin and remove the
Recipient there?
My idea is something like (where "recipient_valid" is a function
I've written to check address validity, returning FALSE for a *valid*
address and TRUE for an *invalid* one):
[....existing filter_recipient code...]
if ( recipient_invalid($recipient) )
{
$recipient = "[EMAIL PROTECTED]";
return ('CONTINUE', "OK");
}
[...existing filter_recipient code....]
and then
[....existing filter_begin code...]
[start loop to step thru @Recipients; $check is index...]
if ( $Recipients[$check] =~ "invalid" )
{
delete_recipient($Recipients[$repindex]);
}
[...end loop to step thru @Recipients]
[...some code to check if there are any valid Recipients left...]
if ( $no_valid )
{
return('REJECT', "Dictionary SPAM rejected");
}
[...existing filter_begin code....]
Feedback? Sane? Insane?
Dirk
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.
Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list [email protected]
http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
