Hi Scott:

Just thinking out loud. I currently use filters to "group" multiple test
results. It works fine - but it's not very intuitive to your new customers.
I also don't like maintaining external files where it doesn't offer any
other benefits.

How about the following "GROUP...GROUPEND" syntax in Global.cfg:

OPENRELAY       GROUP   OR      *       5       0

SORBS-SMTP       ip4r   dnsbl.sorbs.net         127.0.0.5       0       0
AHBLRELAYS       ip4r   dnsbl.ahbl.org          127.0.0.2       0       0
NJABLRELAYS      ip4r   qwdnsbl.njabl.org               127.0.0.2       0
0
DSBLSINGLE       ip4r   list.dsbl.org           *               0       0
ORDB             ip4r   relays.ordb.org                 *               0
0
KUNDENSERVER ip4r       relays.bl.kundenserver.de 127.0.0.2     0       0

*               GROUPEND        

By definition, each test could only be part of one group. 
Nested grouping would not be supported
One could define either "OR" or "AND" condition for the group.


This may be a simple way to address some of the frequent request to
"combine" tests with AND and OR without having to introduce a complete
"scripting" language.


Best Regards
Andy Schmidt

H&M Systems Software, Inc.
600 East Crescent Avenue, Suite 203
Upper Saddle River, NJ 07458-1846

Phone:  +1 201 934-3414 x20 (Business)
Fax:    +1 201 934-9206

http://www.HM-Software.com/


-----Original Message-----
From: Andy Schmidt [mailto:[EMAIL PROTECTED] 
Sent: Thursday, June 17, 2004 05:59 PM
To: '[EMAIL PROTECTED]'
Subject: RE: [Declude.JunkMail] IP4R DNS lookup


Hi,

I have used filters to "summarize" categories of ip4r and other tests.

All the open relay tests will fail ONE filter.  So whether one or 4
black-lists say it's an open relay - it will only get ONE weight.

All the DUL/DUHL will fail ONE filter. So, whether a dial-up or dynamic port
is listed in one or many black-lists - it will only get ONE weight.

This technique allowed me to check against MORE blacklists AND define a
higher weight for each "class" of blacklist.  I don't have to fear that just
because a dial-up port is "widely known" it will suddenly fail JUST on that.

Best Regards
Andy

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to