block_subject plugin

[Fred Moyer]

Greetings,

I've been plagued intermittently with certain spam that gets through my 
Spamassassin filters, it's always the same but comes in a very low score 
and manages to slip through.  I've been getting about one each day this 
week, and finally today I had enough.

Enter block_subject plugin.  It allows you to block emails based on 
exacting subject phrases.  Some of the offending ones that have gotten 
through use subjects like 'The Ultimate Online Pharmaceutical', and 
'Message From eBay Member'.

This plugin is currently alpha quality, but I'm running it in 
production.  If you are suffering from these same annoying emails you 
might want to try this out.  As always, feedback welcome.

One interesting sidebar is that returning DENY_DISCONNECT ended up 
queuing the message, if anyone can enlighten me as to why, I'd love to 
hear about it, I'm currently returning DENY for matching subjects.

Latest svn available at 
https://www.redhotpenguin.com/svn/qpsmtpd/plugins/block_subject

Here's the source!


=head1 NAME

block_subject - block emails based on subject

=head1 DESCRIPTION

Plugin that blocks emails which have exact subjects that are repeat spam
offenders.  For a while I've been plagued by spam which is exactly the same,
yet is not caught by Spamassassin or other filters.  This is a narrow scoped
filter designed to fix this annoying corner case.

=head1 CONFIG

Configure your plugin as so in config/plugins.  Specify specific domains to
invoke the plugin on, or specify 'all' to apply to all domains.

  block_subject [ all | [ domain1, domain2 ... ] ]

Add the subjects which you want to block in the init sub.

=head1 TODO

=over 4

=item *

Figure out how to manage the blocked subjects better.

=item *

Allow configuration of the subject matching, with a regex perhaps.

=head1 AUTHOR

Fred Moyer <[EMAIL PROTECTED]>

=head1 COPYRIGHT AND LICENSE

Copyright 2006 Fred Moyer

This plugin is licensed under the same terms as the qpsmtpd package itself.
Please see the LICENSE file included with qpsmtpd for details.

=cut

sub init {
    my ($self, $qp, @domains) = @_;

    unless (defined $domains[0]) {
        die "block_subject needs proper domain configuration";
    }
    $self->{_args}->{domains} = [EMAIL PROTECTED];

    my $block_content = <<"SUBJECTS";
YOUR REPRESENTATIVE ASSISTANCE IS HIGHLY NEEDED
Message From eBay Member
The Ultimate Online Pharmaceutical
SUBJECTS

    my @subjects = split("\n", $block_content);
    $self->{_args}->{subjects} = [EMAIL PROTECTED];

    $self->log(LOGDEBUG,
               sprintf("Blocking subjects: \n%s", join("\n", @subjects)));
}

sub hook_data_post {
    my ($self, $transaction) = @_;

    # Check the subject immediately if we are blocking for all domains
    if ($self->{_args}->{domains}->[0] eq 'all') {
        if ($self->blocked_subject($transaction)) {
            return DENY;
        }
        else {
            return DECLINED;
        }
    }

    # Check each domain
    my @recip_domains = map { $_->host } $transaction->recipients;
    foreach my $domain (@recip_domains) {
        if (grep (/^$domain$/, @{$self->{_args}->{domains}})
            && $self->blocked_subject($transaction))
        {
            return DENY;
        }
    }

    return DECLINED;
}

sub blocked_subject {
    my ($self, $transaction) = @_;

    my $subject = $transaction->header->get('Subject');
    chomp($subject);

    if (grep { /^$subject$/i } @{$self->{_args}->{subjects}}) {
        $self->log(LOGINFO, "block_subject blocking email, subject 
$subject");
        return 1;
    }
}