# pm-jaube-keywords.rc -- Bare bones word list based UBE filter
# $Id: pm-jaube-keywords.rc,v 2.45 2004/10/27 10:26:55 jaalto Exp $
#
#   File id
#
#       .Copyright (C)  2004 Jari Aalto
#       .$Keywords:     procmail, subroutine, UBE, spam, UCE filter $
#
#       This code is free software in terms of GNU Gen. pub. Lic. v2 or later
#       Refer to http://www.gnu.org/copyleft/gpl.html
#
#   Warning
#
#       Put all your UBE (aka spam) filters towards the _end_ of your
#       ~/.procmailrc. The idea is that valid messages are filed
#       first (mailing lists, your work and private mail, bounces) and only
#       the uncategorized messages are checked.
#
#       Now, if 50-70 % hit rate is good enough for your starting point,
#       go ahead and read more. This file is supposed to be the last resort,
#       if you really do not have any better tool to analyze messages.
#
#   Overview of features
#
#       o   Word and phrase based matching
#       o   50-70 % success rate. 90 % never achieved. That's a guarantee.
#       o   Extremely fast and a dream to CPU resources. Implemented in pure
#           procmail and you can almost hear the humming sound of its
#           regular expression engine shredding UBE messages to pieces.
#
#   Description
#
#       Are you sure you want use this word list based checking?
#
#       Think twice before you use this subroutine. It knows nothing about
#       the content your mail. "It's all UBE unless proven otherwise" is the
#       motto. The brutal search tracks words and phrases to find an indication
#       of mass posting and traces of Unsolicited Bulk Email (UBE aka spam).
#       _Repeat:_ Read the first paragraph again before you consider putting
#       this file into action. This filter WILL PASS through unwanted mail
#       and it WILL catch good mail. This is rule based matching, so I suppose
#       you know where you're putting your head with this. Ahem. Alerted? Good.
#
#      The Story
#
#       There was a man and mail account. The account had limited space,
#       couldn't install any other programs because disk quota would have
#       exceeded. System administrators weren't' interested in installing
#       anything. The Mail server ran behind firewall and had OS that was
#       never heard of - it couldn't run other programs. Or if it could,
#       the Bad system administrator was too scared to install extra
#       programs to the host MTA ran. No joy -- no means to stop incoming
#       UBE -- Right?
#
#       Wrong. There was procmail. The Bad system adminitrator didn't mention
#       that `~/.procmailrc' was honored - just the the external programs
#       we a no-no-no (Technical: the MDA host mounted user disks; the
#       server ran on separate host and couldn't use any of the user
#       compiled programs. Statically linked ones filled up the man's disk
#       space).
#
#       First line of defense, any defense would do. So, this rule based
#       file was born. Nothing else was installed in that account and the
#       happy word list based matching routine kept chewing mail, mail,
#       mail. And the system administrator was happy - he nurtured the MTA
#       host's CPU resources and noticed nothing alarming. All ticked like
#       clockwork.
#
#       Life began again. After 1000 mail bombards a day, the account was
#       usable again.
#
#      Motivation
#
#       If you can, use the Bayesian filters and forget all rule based
#       ones, word and phrase matching based ones; all static filters. On
#       the other hand, if you want quick solution, even imperfect, until
#       you have time to learn and setup other tools, this subroutine may
#       be of interest.
#
#       The best part. You can carry this single file anywhere where procmail
#       lives. No other files are needed. Setup couldn't be simpler.
#
#   About bouncing message back
#
#       The general consensus is, that you should not send bounces. The UBE
#       sender is not there, because the address is usually forged. Do not
#       increase the network traffic. Instead save the messages to folders
#       and periodically check their contents. It's not nice to be forced to
#       apologize about bounces to a wrong destination.
#
#   Code Note
#
#       Procmail is picky about the whitespace in continuing lines, make sure
#       there is _not_ a single spaces left after the continuation backslash.
#       Use good editors or external programs to get rid of the white spaces. In
#       Emacs you would add this line to your `~/.emacs' startup file:
#       "(add-hook 'write-file-hooks 'delete-trailing-whitespace)"
#
#           :0
#           * ^Subject:.*(regexp\
#                   |and-more\
#                   |and-more\
#                   )
#           {
#               # Process it
#           }
#
#       Why are the regexps put into this file and not to a separate regexp
#       file? Good question. It is possible to check message's content with
#       external process, like `grep', to see if any matches are found.
#       This kind of methodology is covered in Procmail Tips section
#       "Using grep with file lists to mach messages" at
#       <http://pm-tips.sf.net>. The reason why all the regexp are maintained
#       inside this file is:
#
#       o   Simplicity. One file - no extra configuration files or regexp
#           databases.
#       o   Self standing. Does not call external processes, so it's a little
#           faster than possible `grep' and `fgrep' solution.
#
#   Required settings
#
#       None. No dependencies to other procmail modules.
#
#   Call arguments (variables to set before calling)
#
#       o   JA_UBE_KEYWORD_HEADER, if set, then the results are put to
#           messages headers. By default this variable is not defined
#           to save from external `formail' process call.
#           Suggestion: "X-Spam-JaubeKwd"; without trailing colon.
#
#   Return values
#
#       o   `ERROR_STATUS' is set to word "Bad" otherwise empty.
#       o   `ERROR' is set to short descriptive word that indicate which
#           rule was matched. Values: *Header-From-Keywords*,
#           *Header-Subject-keywords* and *Body-keywords*
#       o   `ERROR_MATCH' is set to some words that happened to trigger
#           UBE catch rule.
#
#   Usage example
#
#           #   Exclude these addresses from tests
#           VALID_FROM = "(my@address.example.com|word@here.example.com)"
#
#           :0
#           *$ ! ^From:.*$VALID_FROM
#           *  !  FROM_DAEMON
#           {
#               INCLUDERC             = $PMSRC/pm-jaube-keywords.rc
#
#               #  Variable "ERROR" was set if message was UBE
#
#               :0 :
#               * ! ERROR ?? ^^^^
#               junk.ube.spool
#           }
#
#   File layout
#
#       The layout of this file is managed by Emacs packages tinyprocmal.el
#       and tinytab.el for the 4 tab text placement.
#       See project http://tiny-tools.sourceforge.net/
#
#   Change Log
#
#       None.

dummy = "
========================================================================
pm-jaube-keywords.rc: init:"


#######################################################################
#
#   User configurable variables. Set these, before calling this
#   module/subroutine.
#
#######################################################################

#   Set to a empty to suppress external shell call to `formail'.

JA_UBE_KEYWORD_HEADER = ${JA_UBE_KEYWORD_HEADER:-"X-Spam-JaubeKwd"}

#######################################################################
#
#   Private variables. Do not touch
#
#######################################################################

#   Kill variables or set default values

ERROR      
ERROR_MATCH
ERROR_STATUS 

dummy="Checking UBE: subject keywords"

jaubeKwdVerboseOld  = $VERBOSE      # don't write log for these variables
VERBOSE             = off

jaubeKwdLinebufOld  = $LINEBUF
LINEBUF		    = 8192	    # Increase

# Deutch, Spanish and other languages

language="(\
[a-z] (con|m[ae]s|para) [a-z]\
|\<aloha\
|bitte\>\
|rbeitet\
|\<bail[ae]\
|damen\
|\<ganz\
|herren\
|bestaetigung\
|contenidos\
|fabricamos\
|freundlichen\
|kontakte\
|seguridad\
|<\ihre\
|jetzt\
|\<keine?\>\
|kontakt\
|telefono\
|\<tenga\
|totalmente\
|trabaje\
)"

# 	English words. 
#	The marketting slogars are creative, consider: V:I:A:G:R:A!!

keywords="(\
[0-9][0-9.]* +per (month|year)\
affordable\
|\<acne\>\
|adult\
|\<advertis\
|accessor(y|ies)\
|at + no +charge\
|\<babe\>\
|bachelor\
|bedroom\
|\<blonde\>\
|\<bondage>\
|boyfriend\
|\<breast\
|\<brunette\
|\<bucks\
|business +on our\>.*\<site\>\
|\<call +[+]?[0-9][0-9]\
|\<cash\>\
|\<cable +tv\
|calsium\
|cartoon\
|cartridge\
|casino\
|celebrit\
|\<censor\
|cheap(er|est)\
|cholesterol\
|C[|i]+a[|]*1is\
|\<clinic\
|\<click +here\
|\<clits?\>\
|\<cocaine\
|\<cock\>\
|\<congrat\
|confidential\
|consultation\
|\<credit\
|\<cum\>\
|daughter\
|\<(dating|escort) +service\
|\<defensa\
|\<dental\
|depressant\
|detective\
|\<diabet\
|\<dick\>\
|\<dildo\>\
|discreet\
|do +you +like\
|\<doctor\
|domestic\
|download.*today\
|dramatic\
|drugs\
|earnings\
|erection\
|eroti[ck]\
|fair +exchange\
|exchange +rate\
|exquisite\
|farmac[yo]\
|fashion\
|female\
|financ(e|ial)\
|\<films?\>\
|filthy\
|fitness\
|\<for .*your.*Needs\
|\<fuck\
|\<fund\
|\<gay\
|get it for (just)?.*[$]\
|get +perfect.*your\
|get +(lucky|fucked)\
|Get +the +best\
|\<girls?\>\
|get +(a|for)? *free\
|greetings\
|gouranga\
|herbalife\
|Hey +People\
|(hi|hello|hey) +lucky\
|\<honey\>\
|horoscope\
|hurry +(now|fast)\
|\<husband\
|\<illnes\
|\<income\
|\<in +bed\
|\<invest(ment)?\>\
|\<instant\
|\<interest +rates\>?\
|\<iraq\
|just .*$d+.*days\
|\<kenedy\
|laboratory\
|\<laden\>\
|\<lad(y|ies)\>\
|lesbian\
|lifestyle\
|(limited|special|future)\>.*\<offer\
|\<li+m+i+t+e+d.*time\
|lingerie\
|lo+l+i+t+a+\
|\<loan\
|lottery\
|madam\
|mafia\
|manhood\
|\<marine\<\
|masturbat\
|medic(a[lt]|in)\
|mexican\
|money\
|mortgage\
|movie\
|new.*\<(video|dvd|cd)\
|nigeria\
|nipple\
|offer.*valid\
|offshore\
|<\oil\>\
|oppurtun\
|\<orgy\>\
|\<our +(company|product)\
|order +(soon|now|fast)\
|paycheck\
|paying\
|partner\
|\<pence\
|\<penis\>\
|\<pharmac\
|\<poker\
|\<prank\
|pregnan\
|\<porn\
|profit\
|promotion\
|prostitute\
|\<puss(y|ies)\>\
|\<rape\>\
|rates starting at\
|regalis\
|(restaurant|food) +recipe\
|\<rich\>\
|robbery\
|rolex\
|sadd?am\
|sadomasokism\
|satellite.*\<tv\
|\<(sav(ing|e)|buy|see|web).*\<(pills|meds|m +e +d +s)\>\
|\<scent\>\
|screensaver\
|\<sex\>\
|silver\
|\<singles\
|\<sir\>\
|\<s[i|]ze +(real[a-z|]+ +)*matters?\>\
|sperm\
|stamina\
|stocks?\
|sydney\
|\<save .*[0-9] *%\
|sweetheart\
|\<tax\
|\<teen\>\
|terrorist\
|tobacco\
|\<try .* our\>\
|\<USD? *[$]\
|[$][0-9][0-9.,]*[0-9]\
|uncle\
|u+n+d+e+r+a+g+e\
|vegas\
|\<venture\>\
|v[1i@.,!:;?]a+g+r+a\
|\<v[^ ]+gra\>\
|\<v[^ ]*[1i][^ ]*a[^ ]*g[^ ]*r[^ ]a*\>\
|v[|]*iaggar\
|\<weight[ -]+loss\
|welcome +to +our\
|\<webcam\
|women acting\
|\<you.*benefit\
|\<you('| +wi)ll +be +satisfied\
|you can be.*(safe|secure)\
|\<youth\
|$language\
)"

#  Some regexps cannot be used, because they would easily match legimite mail:
#
#  - "your.*address" would match
#    Please confirm your XXX Forwarding Address
#  - "charm" would match
#    works like a charm...
#
#  Notes:
#  - Regalis, Cialis are viagra drugs

subjectKeywordsOnly="(\
[?][?]\
|!!\
|XXX\
|\$[0-9][0-9.]+\
|(down|king).*size\
|(offer|receive).* you\
|(try|do).*<(it|now|today)\
|[bm]illion\
|\<(china|korea|usa|europe|australia|russia>)\
|\<(tv|she|us|hi|heya?|hello|win|ink|pics?|yo)\>\
|\<advisor\
|\<aging\>\
|anytime\
|anywhere\
|\<ass\>\
|\<award\
|back +to\
|believ\
|\<bid\
|bonus\
|breath\
|bringing\
|bulk_mailer\
|busines\
|\<buy\
|camera\
|candle\
|\<cds?\>\
|charge\
|\<che+a+[pt]\>\
|\<check.*\<out\>\
|\<child\>\
|ciao\
|cigar\
|cold\
|coral\
|\<cost\
|coupon\
|\<dance\
|debt\
|degree\
|density\
|deserve\
|\<diet\
|digital\
|discount\
|d[0o]llar\
|don't +be\
|\<dude\
|dvd\
|\<dying\
|effortless\
|eliminate\
|employ\
|enhance\
|enjoy\
|eliminate +deb[st]?\>\
|enlarge\
|expedition\
|expert\
|facilit\
|find +out\
|fingering\
|\<for\>.*\<you.*order\
|fortune\
|fountain\
|friend\
|\<fun\
|g[eo]t +some\
|\<gain\
|go.* for\
|gold\
|got +it\
|gratis\
|guarant\
|health\
|hold +of\
|<\hope\
|\<house\
|humble\
|larger\
|letter\
|life\
|limited\
|\<love\
|lowest\
|\<luck\
|make\>.*\<(it|her|extra)\
|\<master\>\
|market\
|mastercard\
|mobile\
|more[!?]\
|movie\
|mp3\
|muscle\
|music\
|newsletter\
|now!\
|\<our\>\
|\<paid\>\
|\<pay\>\
|\<(pda)\>\
|personal\
|phone\
|photo\
|picture\
|premier\
|\<prescri[pb]\
|\<prices?\
|protect\
|public\
|receive\
|reciprocal\
|refill\
|\<sale\
|save\
|screensaver\
|security\
|\<see\>.*\<this\>.*(www|web|site|page)\
|\<sell\
|\<sensati\
|\<sense\
|\<she\>.*(happy|try|tried)\
|\<shop\
|\<sincer\
|\<smok\
|solicit\
|special\
|\<spend\
|\<spirit\
|\<stress\
|\<stock\
|\<summer\>\
|\<super\
|swallow\
|symptom\
|\<target\
|thank +you\
|the +time\
|\<thin\
|thousand\
|time +to\
|today\
|\<toner\
|\<tons>\
|traffic\
|travel\
|\<try\>\
|typing\
|ultimate\
|up +to\
|\<urgent\
|\<utmost\
|video\
|visitor\
|\<wash\
|\<watch\
|we +ship\
|weather\
|welcome\
|\<wife\
|\<wines?\>\
|\<wish\
|wom[ae]n\
|work.*for\
|yellow +page\
|$keywords\
)"

LINEBUF = $jaubeKwdLinebufOld
VERBOSE = $jaubeKwdVerboseOld

dummy = "pm-jaube-keywords.rc: Header keywords"

:0
*$  ^Subject:.*\/$subjectKeywordsOnly[^ ]*
{
    ERROR       = "Header-SubjectKeywords"
    ERROR_MATCH = "$MATCH"
}

dummy = "pm-jaube-keywords.rc: Header From keywords"

:0 E
*$  ^From.*()\/$keywords[^ ]*
{
    ERROR       = "Header-FromKeywords"
    ERROR_MATCH = "$MATCH"
}

dummy = "pm-jaube-keywords.rc: body keywords"

:0 E
*$ B ?? ()\/$keywords[^ ]*
{
    ERROR        = "Body-Keywords"
    ERROR_MATCH  = "$MATCH"
}

:0
* ! ERROR ?? ^^^^
{
    ERROR_STATUS = "Bad"
}

:0
* ! JA_UBE_KEYWORD_HEADER ?? ^^^^
* ! ERROR		  ?? ^^^^
{
    jaubeKwdInfo   = "$ERROR $ERROR_MATCH"
    jaubeKwdHeader = "$ERROR_STATUS $jaubeKwdInfo"

    :0 fw
    | ${FORMAIL:-"formail"} \
      -I "$JA_UBE_KEYWORD_HEADER: $jaubeKwdHeader"
}

dummy = "pm-jaube-keywords.rc: end: $ERROR_STATUS $ERROR"

# pm-jaube.rc ends here