Re: Expression configuration blocking site with word "sussex"

[Chip Burkitt]

(^|[-.\?+=/_0-9]) is part of a regular expression (search for "regular 
expressions" on Google for _tons_ of information on them). I'm not sure what the ^| 
means in this context, but [-.\?+=/_0-9] matches any single character within the square 
brackets. The range 0-9 represents all digits. I think (but this is just a guess) that 
the expressions matches a domain name that does not begin with a non-alphabetic character 
but contains one or more instances of the forbidden words. As far as I can remember, 
domain names must start with an alphabetic character. This is only a guess, and I'm sure 
you could get a better answer from someone more familiar with regular expressions.

Chip Burkitt

Kleikamp, Frank wrote:

Hello Yong,

I had the same problem. I found two ways out of this:
1. don�t use "sex" in your expressionlist (but I�m sure you don�t want that)
or
2. create a whitelist with for special domains like essex, sexten (a village
in italy), and so on.

I created that whitelist by createing another blacklist (sounds strange)
called "special" and putting in the special domains.
And these are the parts from my squdGuard.conf:

        #
        # DESTINATION CLASSES:
        #

        destination bl_special {
                domainlist      blacklists/special/domains
        }

        #
        # ACCESS CONTROL
        #

                access {
                        pass bl_special !bl_what_ever_you_like_to_block any
                        redirect 302:http://where_ever_you_redirect
                }

I did hat because suidGuard checks the acls from top to bottom, means first
bl_special is checked and if there is a hit all other blacklist are ignored
and traffic is passed.

I don�t know what the "(^|[-.\?+=/_0-9])" stands for. Perhaps it�s some kind
of opening sequence for squidGuard.

Hope that helps you,
Frank

-----Original Message-----
From: Yong Bong Fong [mailto:[EMAIL PROTECTED]
Sent: Thursday, January 20, 2005 3:02 AM
To: squidguard@squidguard.org
Subject: Expression configuration blocking site with word "sussex"

Dear all,

I am working on the squidguard configuration for the expression part. So far, its blocking ok however for site such as "sussex" it also block.
I have a configuration as below:



(adultos|adultsight|adultsite|sex|porn|adultsonly|adultweb|blow-?job|bondage
|centerfold|cumshot|cyberlust|cybercore|hardcore|incest|masturbat|obscene|pe
dophil|pedofil|playmate|pornstar|sexdream|showgirl|softcore|striptease)


(^|[-.\?+=/_0-9])(all|big|cute|cyber|fake|firm|hard|huge|little|mega|mini|na
ughty|new|old|pure|real|small|serious|soft|super|tiny|young)?(anal|babe|bhar
ath|boob|breast|busen|busty|clit|cum|cunt|dick|fetish|fuck|hooter|lez|lust|n
aked|nude|oral|orgy|porno?|pupper|pussy|rotten|sex|shit|smutpump|teen|tit|to
pp?les|vixen|xxx)s?(cafe|site|surf|surfing|web|website)?([-.\?+=/_0-9]|$)


(^|[-.\?+=/_0-9])(all|big|cute|cyber|fake|firm|hard|huge|little|mega|mini|na
ughty|new|old|pure|real|small|serious|soft|super|tiny|young)(girl|virgin)s?(
cafe|site|surf|surfing|web|website)?([-.\?+=/_0-9]|$)



I can't understand whats the purpose of the "(^|[-.\?+=/_0-9])" in front of it, and "?([-.\?+=/_0-9]|$)" at the end of it.

I have read the squidguard site about expression configuration, just can't understand the meaning of configuration with things such as
(^|[-\?+=/_) on it. Can anyone give me some examples ?

Thanks in advance,

Regards
yong