Page History

   loadplugin            ReplaceTags  /path/to/plugin/ReplaceTags.pm
  replace_rules         VIAGRA_OBFU, CIALIS_OBFU # ... and so on
  replace_start_sign         <
  replace_end_sign           >

  # Example classes
  replace_class         A               [\@\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xe4\xe3\xe2\xe0\xe1\xe2\xe3\xe4\xe5\xe6]
  replace_class         G               [gk]
  replace_class         I               [il\|\!1y\?\xcc\xcd\xce\xcf\xec\xed\xee\xef]
  replace_class         R               [r3]
  replace_class         V               [v\\\/wu]
  replace_class         SP      [\s\        [\s\d\_\-\*\$\%\(\)\,\.\:\;\?\!\}\{\[\]\|\/\?\^\#\~\xa1\Ž\`\'\+]

  # This is only an example for a pair of rules
  bodySmall functional example
  body                  VIAGRA_OBFU     /(?!viagra)<V>+<SP>*<I>+<SP>*<A>+<SP>*<G>+<SP>*<R>+<SP>*<A>+/i
  describe              VIAGRA_OBFU     obfuscated match "viagra"
  score                 VIAGRA_OBFU     3

  body                  VIAGRA          /viagra/i
  describe              VIAGRA          match plain "viagra"
  score                 VIAGRA          1.5

=head1 NAME

ReplaceTags - Create character-classes for SpamAssassin-rules

A character-class may contain of any character which is valid in a regular expression.
The grouped characters are easy to maintain and the rules are more readable.

=head1 SYNOPSIS

  loadplugin            ReplaceTags  /path/to/plugin/ReplaceTags.pm
  replace_rules         VIAGRA_OBFU, CIALIS_OBFU,...
  replace_start_sign         <
  replace_end_sign           >

  replace_class         A               [\@\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xe4\xe3\xe2\xe0\xe1\xe2\xe3\xe4\xe5\xe6]
  replace_class         G               [gk]
  replace_class         I               [il\|\!1y\?\xcc\xcd\xce\xcf\xec\xed\xee\xef]
  replace_class         R               [r3]
  replace_class         V               [v\\\/wu]
  replace_class         SP              [\s\d\_\-\*\$\%\(\)\,\.\:\;\?\!\}\{\[\]\|\/\?\^\#\~\xa1\Ž<B4>\`\'\+]

  body                  VIAGRA_OBFU     /(?!viagra)<V>+<SP>*<I>+<SP>*<A>+<SP>*<G>+<SP>*<R>+<SP>*<A>+/i
  describe              VIAGRA_OBFU     obfuscated match "viagra"
  score                 VIAGRA_OBFU     3

  body                  VIAGRA          /viagra/i
  describe              VIAGRA          match plain "viagra"
  score                 VIAGRA          1.5

This example displays how this plugin can be used to match obfuscated and "normal" phrases, which makes it easier
to increase the scores for rules matching only obfuscated patterns on a real world example.

=head1 CONFIGURATION

=over 4

=item replace_rules     list_of_tests

Specify a commaspererated list of symbolic test names (seperated with whitespaces) of tests which should be parsed. The test will only be
 parsed if it is a body, headerheade
r, uri, full or raw test.

=item replace_start_sign sign

=item replace_end_sign   sign

Character(s) which indicate the start and end of a class inside a rule. If the class is not enclosed by this
signs it won't be found nor replaced. If you encounter problems run spamassassin from the commandline with
the -D flag and check the output. The default values are < (for replace_start_sign) and > (for replace_end_sign).

=item replace_class classname charactersexpression

Define a character class.  or a valid regular expression. Valid characters are the same as in any usual regular expression. It is not a good idea to put
put quantifiers inside the character class, better use them inside your rule is shown above in the example.

=cut

package ReplaceTags;

use strict;
use Mail::SpamAssassin;
use Mail::SpamAssassin::Plugin;
use Switch;

our @ISA = qw|Mail::SpamAssassin::Plugin|;

sub new {
  my ($class, $mailsa) = @_;
      $class = ref($class) || $class;

  my $self = $class->SUPER::new($mailsa);

  bless ($self, $class);

  return $self;
}

sub check_start {
  # This is the point where the rulesets get replaced with our stuff
  my ($self,$pms) = @_;

  my $start_tag   = $self->{'replace_start_sign'};

  my $end_tag     = $self->{'replace_end_sign'};

  # Put the names of the rules, which get replaced in a hash, for easier usage
  my %Rules = ();

  for my $rule_name (@{$self->{'rules_to_replace'}}) {
    $Rules{$rule_name} = 1;
  }

  for my $rule_set (qw|body_tests rawbody_tests head_tests full_tests uri_tests|) {

    # TODO check what that 0 is for (I guess 0 are the GLOBAL tests and user-tests will
    #      have a number (uid?)...guess is wrong :( )
    for my $rule_name (keys %{$pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}}) {

      # If rulename doesn't match, skip
      next unless ($Rules{$rule_name});

      # Increase it here, so that we can do some small debugging at the end
      $Rules{$rule_name}++dbg("ReplaceTags: parse rule $rule_name");

      my $rule_content = $pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}->{$rule_name};

      #my Loop%SkippedTags all= available(); tags
    # Check-Container forto myprevent $tag_name (keys %{$self->{'tags_to_replace'}}) {

endless loops
        # Check the rule for replacements and replace them
        if ($rule_content =~ m|$start_tag$tag_name$end_tag|) {

    # If a tag isn't found myfor $replacementmax = get_replacement_value($self,$tag_name);

   4 times the while-loops stopps
       if ($replacement) {
            dbg("ReplaceTags: modifying rule $rule_name, replacing $start_tag$tag_name$end_tag with $replacement");
    # this seems to be a _really_  $rule_content =~ s|$start_tag$tag_name$end_tag|$replacement|g;bad idea... This can also occure
            $pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}->{$rule_name} = $rule_content;
          }
        # if elsesomebody {
has content inside his classes which contains the
     dbg("ReplaceTags:  No replacement found for rule $rule_name, ($start_tag$tag_name$end_tag)");
          }

        }

 # start- and end-tag unquoted, }but #without fora myvalid $tag_tag-name. (keys %{$self->{'tags_to_replace'}})

In that
     } # for my $rule_name (keys %{$pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}})

  } # for my $test (qw|body_tests rawbody_tests head_tests full_tests uri_tests|)

  # See if we have rules, that we should# parsecase and haven't been found
 this loop, would run for my $rule (keys %Rules) {
a while...

      while dbg("ReplaceTags: Rule $rule not found.") if ($Rules{$rule} == 1);
  }

}
sub get_replacement_value {
  # Substitute replacement with the correct pattern
  my ($self,$tag_name) = @_;

  my $replacement = $self->{'tags_to_replace'}->{$tag_name};

  if ($replacement) ($pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}->{$rule_name} =~ m|$start_tag(.+?)$end_tag|g) {

        my $tag_name = $1;

        dbg("ReplaceTags: Please quote your start and end-signs in rule $rule_name") and last if ($SkippedTags{$tag_name} > 5);

        dbg("ReplaceTags: TagName = $tag_name");

        # If the tag exists, replace it with the corresponding phrase
        if ($tag_name) {
          dbg("Davor => ".$pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}->{$rule_name});
          $pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}->{$rule_name} = replace_rule($self,$tag_name,$rule_content,$rule_name);
          dbg("Danach => ".$pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}->{$rule_name});
        }
        else {
          dbg("ReplaceTags: unknown tag encountered ($start_tag$tag_name$end_tag) in rule $rule_name");
          $SkippedTags{$tag_name}++;
        }

      } # while ($rule_content =~ m|$start_tag(.*?)$end_tag|)

    } # for my $rule_name (keys %{$pms->{'permsgstatus'}->{'conf'}->{$rule_set}->{0}})

  } # for my $test (qw|body_tests rawbody_tests head_tests full_tests uri_tests|)

} # sub check_start

sub replace_rule {

  my ($self,$tag_name,$rule_content,$rule_name) = @_;
  my $start_tag   = $self->{'replace_start'};
  my $end_tag     = $self->{'replace_end'};

  my $replacement = $self->{'replace_classes'}->{$tag_name};

  if ($replacement) {
    # Do the modifications to the rule and return it
    dbg("ReplaceTags: modifying rule $rule_name, replacing $start_tag$tag_name$end_tag with $replacement");
    $rule_content =~ s|$start_tag$tag_name$end_tag|$replacement|g;

    return ($rule_content);

  }
  else {
    dbg("ReplaceTags: ReplacementNo replacement found $replacement for rule $rule_name, ($start_tag$tag_name$end_tag)");
  }

  else {
    dbg# It should never ever get here
  #dbg("ReplaceTags: NoPlease Replacementreport for $tag_name");
  }
  return ($replacementthis to somebody including the full debug-log.");

}

sub parse_config {
  # Used configuration pragmas are
  #   replace_class
  #   replace_rules
  #   replace_start_sign
  #   replace_end_sign

  my ($self, $opts) = @_;

  switch ($opts->{'key'}) {

    case 'replace_class'
        {
          if ($opts->{'value'} =~ m|^(\S+)\s+(.*?)\s*$|) {
            my $tag_name        = $1;
            my $tag_replacement = $2;

            dbg("ReplaceTags: parse_config got $tag_name -> $tag_replacement");

            $self->{'tagsreplace_to_replaceclasses'}->{$tag_name} = $tag_replacement;
            #$opts->{'conf'}->{'tags_to_replace'}->{$TagName} = $TagReplacement;
          }
        }

    case 'replace_rules'
        {
          # The replace_rules configuration-pragma contains a commasepareted
          # list of all rules, which should get parsed by this module
          $opts->{'value'} =~ s|\s*||g;

          @{$self->{'rules_to_replace'}} = split(/\,s+/,$opts->{'value'});
        }

    case 'replace_start_sign'
         {
           # The replace_start_sign indicates the start of a replacement-tag. If this
           # setting is omitted a < is used as default.
           if ($opts->{'value'}) {
             dbg("ReplaceTags: setting start sign to '".$opts->{'value'}."'");
 
             $self->{'replace_start_sign'} = $opts->{'value'};
           }
           else {
             dbg("ReplaceTags: no start sign specified. Fall back to default '<'");
 
             $self->{'replace_start_sign'} = '<';
           }
         }
 
    case 'replace_end_sign'
         {
           # The replace_end_sign indicates the end of a replacement-tag. If this
           # setting is omitted a > is used as default.
           if ($opts->{'value'}) {
             dbg("ReplaceTags: setting end sign to '".$opts->{'value'}."'");
 
             $self->{'replace_end_sign'} = $opts->{'value'};
           }
           else {
             dbg("ReplaceTags: no end sign specified. Fall back to default '>'");
 
             $self->{'replace_end_sign'} = '>';
           }
         }
  }  
}

sub dbg { Mail::SpamAssassin::dbg (@_); }

1;