Subject: A "jumbo"-patch for spam filtering

From: lebayle <[email-masked]>
Date: Tue, 18 Jul 2000 17:32:40 +0200 (MET DST)

Hi,
I've been away for a while, and don't know what's new regarding smap and 
spam filtering. The fwtk's web site does not give anything new on the 
topic, so since I've made a lot of efforts on my side, I would like to 
make my patches available for other users. Especially, the included 
filtering based on email contents (http://www.cnx.com/stopspam.html) is 
really cool, it protected our site from the I-love-you virus and others.

------------------------------
short description of filtering
------------------------------
Each of the following features can be added separately using the 
relevant compilation options.

1- Built-in home-made anti-relay ("FILTER" compilation option)

2- Unsollicited Commercial Emails coming from well-known "spammers" are 
filtered according to the NoSpam! database (more than 5000 entries) 
developed by Jason R. Rhoads (http://www.sabernet.net). The filter 
processes ("NOSPAM" compilation option):
     - the "From:" field (sender's name): either a full username or a 
domain name
     - the originating hostname i.e. the host establishing the SMTP 
connection intended to transport the email: either a full hostname, or a 
domain name, or an IP address 

3- MAPS/RBL database (Mail Abuse Prevention System - Realtime Blackhole 
List). The http://maps.vix.com/rbl site provides a tool checking whether 
a particular host belongs to the MAPS/RBL database. The spammer is 
identified based on the originating host only (also "NOSPAM" compilation 
option). 

4- Malformed "From:" address ("NOFAKE" compilation option):
     - empty "From:" field (either no character at all, or <>, or <@>), 
except for error reports as of RFC821 
     - user without domain name 
     - user with invalid domain name, i.e. not registered in DNS
     - fake user name (e.g. more than N figures) 
     - fake host name

5- Well-know strings in the email's contents ("SPAMBODY" compilation 
option): based on the work of http://www.cnx.com/stopspam.html

Bruno LEBAYLE ([email-masked])
European Synchrotron Radiation Facility - Grenoble, FRANCE