sb-getipdomain.rc

这是一个从音频信号里提取特征参量的程序

   :0
   * ? ${TEST} -f ${LOCALHOSTFILE} && (${ECHO} "${CHECK}" | ${GREP} -i -f ${LOCALHOSTFILE})
   { CHKLOCALTO=yes }
  }

  :0
  * $ ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\].*by.*${DOMAIN}
  { CHKLOCALTO=yes }

  :0
  * $ ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\].*by.*${THISISP}
  { CHKLOCALTO=yes }


  # Check to ensure that the IP you're looking at is not an ICANN non-routable IP address.
  :0
  * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[(0\.[0-9]+\.[0-9]+\.[0-9]+|\
                   1\.[0-9]+\.[0-9]+\.[0-9]+|\
                   10\.[0-9]+\.[0-9]+\.[0-9]+|\
                   127\.[0-9]+\.[0-9]+\.[0-9]+|\
                   169\.254\.[0-9]+\.[0-9]+|\
                   172\.16\.[0-9]+\.[0-9]+|\
                   192\.0\.[0-9]+\.[0-9]+|\
                   192\.168\.[0-9]+\.[0-9]+|\
                   204\.152\.6[4-5]\.[0-9]+|\
                   22[4-9]\.[0-9]+\.[0-9]+\.[0-9]+|\
                   23[0-1]\.[0-9]+\.[0-9]+\.[0-9]+|\
                   255\.255\.255\.255)\]
  { CHKNONROUTABLE=yes }

  :0
  * CHKLOCALFROM ?? no
  * CHKLOCALTO ?? yes
  * CHKNONROUTABLE ?? no
  {
   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)[ ]\(
   {
    :0
    * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
    {
     :0
     { STRING=${MATCH} }

     :0
     { FIRSTEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
    }
   }

   :0 E
   {
    :0
    * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
    {
     :0
     { STRING=${MATCH} }

     :0
     { FIRSTEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
    }
   }

   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received:.*\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
   { FIRSTEXIP=${MATCH} }
  }
 }

 # If not non-local from/local to, then move on to second external IP....
 :0
 * CHKNONROUTABLE ?? no
 * ! FIRSTEXIP ?? 000.000.000.000
 * SECONDEXIP ?? 000.000.000.000
 {
  :0
  * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)[ ]\(
  {
   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
   {
    :0
    { STRING=${MATCH} }

    :0
    { SECONDEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
   }
  }

  :0 E
  {
   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
   {
    :0
    { STRING=${MATCH} }

    :0
    { SECONDEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
   }
  }

  :0
  * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received:.*\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
  { SECONDEXIP=${MATCH} }
 }


 # If both first and second external IP addresses are already assigned, move to third.
 :0
 * CHKNONROUTABLE ?? no
 * ! FIRSTEXIP ?? 000.000.000.000
 * ! SECONDEXIP ?? 000.000.000.000
 * THIRDEXIP ?? 000.000.000.000
 {
  :0
  * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)[ ]\(
  {
   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
   {
    :0
    { STRING=${MATCH} }

    :0
    { THIRDEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
   }
  }

  :0 E
  {
   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
   {
    :0
    { STRING=${MATCH} }

    :0
    { THIRDEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
   }
  }

  :0
  * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received:.*\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
  { THIRDEXIP=${MATCH} }
 }

 # If first, second, and third external IP addresses are already assigned, move to fourth.
 :0
 * CHKNONROUTABLE ?? no
 * ! FIRSTEXIP ?? 000.000.000.000
 * ! SECONDEXIP ?? 000.000.000.000
 * ! THIRDEXIP ?? 000.000.000.000
 * FOURTHEXIP ?? 000.000.000.000
 {
  :0
  * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)[ ]\(
  {
   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
   {
    :0
    { STRING=${MATCH} }

    :0
    { FOURTHEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
   }
  }

  :0 E
  {
   :0
   * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from[ ]([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[ ]\(
   {
    :0
    { STRING=${MATCH} }

    :0
    { FOURTHEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/..$//g'` }
   }
  }

  :0
  * ^Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received: from.*\[.*\](.*$)+Received:.*\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
  { FOURTHEXIP=${MATCH} }
 }
}






# Now, generate the REVERSE IP equivalents of each extracted external IP, for
# checking against DNSBLs.

# Reverse first external IP address.  This one is checked against open proxy DNSBLs,
# and lists of dial-up IPs, Cablemodem # IPs, and other IP addresses dynamically
# assigned to users, in addition to spam source DNSBLs.

:0
* $!FIRSTEXIP ?? 000.000.000.000
*   FIRSTEXIP ?? ()\/[0-9]+
{
  QUAD1=${MATCH}

  :0
  *  FIRSTEXIP ?? [0-9]+\.\/[0-9]+
  {
    QUAD2=${MATCH}

    :0
    *  FIRSTEXIP ?? [0-9]+\.[0-9]+\.\/[0-9]+
    {
      QUAD3=${MATCH}

      :0
      *  FIRSTEXIP ?? [0-9]+\.[0-9]+\.[0-9]+\.\/[0-9]+
      {
        FIRSTEXREVIP="${MATCH}.${QUAD3}.${QUAD2}.${QUAD1}"
      }
    }
  }
}

# Reverse second external IP.

:0
* $!SECONDEXIP ?? 000.000.000.000
*   SECONDEXIP ?? ()\/[0-9]+
{
  QUAD1=${MATCH}

  :0
  *  SECONDEXIP ?? [0-9]+\.\/[0-9]+
  {
    QUAD2=${MATCH}

    :0
    *  SECONDEXIP ?? [0-9]+\.[0-9]+\.\/[0-9]+
    {
      QUAD3=${MATCH}

      :0
      *  SECONDEXIP ?? [0-9]+\.[0-9]+\.[0-9]+\.\/[0-9]+
      {
        SECONDEXREVIP="${MATCH}.${QUAD3}.${QUAD2}.${QUAD1}"
      }
    }
  }
}

# Reverse third external IP.

:0
* $!THIRDEXIP ?? 000.000.000.000
*   THIRDEXIP ?? ()\/[0-9]+
{
  QUAD1=${MATCH}

  :0
  *  THIRDEXIP ?? [0-9]+\.\/[0-9]+
  {
    QUAD2=${MATCH}

    :0
    *  THIRDEXIP ?? [0-9]+\.[0-9]+\.\/[0-9]+
    {
      QUAD3=${MATCH}

      :0
      *  THIRDEXIP ?? [0-9]+\.[0-9]+\.[0-9]+\.\/[0-9]+
      {
        THIRDEXREVIP="${MATCH}.${QUAD3}.${QUAD2}.${QUAD1}"
      }
    }
  }
}

# Reverse fourth external IP.

:0
* $!FOURTHEXIP ?? 000.000.000.000
*   FOURTHEXIP ?? ()\/[0-9]+
{
  QUAD1=${MATCH}

  :0
  *  FOURTHEXIP ?? [0-9]+\.\/[0-9]+
  {
    QUAD2=${MATCH}

    :0
    *  FOURTHEXIP ?? [0-9]+\.[0-9]+\.\/[0-9]+
    {
      QUAD3=${MATCH}

      :0
      *  FOURTHEXIP ?? [0-9]+\.[0-9]+\.[0-9]+\.\/[0-9]+
      {
        FOURTHEXREVIP="${MATCH}.${QUAD3}.${QUAD2}.${QUAD1}"
      }
    }
  }
}


# Now, extract the From: and Reply-to: domains.
# From: domain first.
:0
* ^From:[ ].*[a-z0-9][-_\.a-z0-9]+@([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)([^a-z0-9\.]|$)
{
 :0
 * ^From:[ ].*[a-z0-9][-_\.a-z0-9]+@([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)([^a-z0-9\.]|$)
 {
  :0
  { STRING=${MATCH} }

  :0
  * $ STRING ?? [a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)[^a-z]
  { FROMDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/.$//g'` }

  :0 E
  { FROMDOMAIN=${STRING} }
 }
}

:0 E
{
 :0
 * ^From:[ ].*[a-z0-9][-_\.a-z0-9]+@([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*([^a-z0-9\.]|$)
 {
  :0
  { STRING=${MATCH} }

  :0
  * $ STRING ?? [a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[^a-z]
  { FROMDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/.$//g'` }

  :0 E
  { FROMDOMAIN=${STRING} }
 }
}


# Now the Reply-To: domain, if it exists.
:0
* ^Reply-to:[ ].*[a-z0-9][-_\.a-z0-9]+@([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)([^a-z0-9\.]|$)
{
 :0
 * ^Reply-to:[ ].*[a-z0-9][-_\.a-z0-9]+@([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)([^a-z0-9\.]|$)
 {
  :0
  { STRING=${MATCH} }

  :0
  * $ STRING ?? [a-z0-9][-_a-z0-9]+\.(aero|biz|cc|com|coop|de|edu|exp|fi|geek|gov|info|int|llc|lnx|ltd|lv|med|mil|museum|name|net|nic|noc|nu|null|org|porn|pro|pt|se|st|to|tv|ws|xxx)[^a-z]
  { REPLYTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/.$//g'` }

  :0 E
  { REPLYTODOMAIN=${STRING} }
 }
}

:0 E
{
 :0
 * ^Reply-to:[ ].*[a-z0-9][-_\.a-z0-9]+@([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?([a-z0-9][-_a-z0-9]+\.)?\/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*([^a-z0-9\.]|$)
 {
  :0
  { STRING=${MATCH} }

  :0
  * $ STRING ?? [a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z][a-z]*[^a-z]
  { REPLYTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/.$//g'` }

  :0 E
  { REPLYTODOMAIN=${STRING} }
 }
}