On Sun, August 13, 2006 02:11, John D. Hardin wrote:
> On Sat, 12 Aug 2006, John Rudd wrote:
>
> 127.0.0.1 ... 127.0.0.100 perhaps? How would a rule to score points
> based on the returned IP look? Can/does SA cache the returned IP and
> test it in multiple rules without making multiple DNS queries?
yes, i have created an example.cf to SA
--
Benny
first the real lookup
header __DNSBL rbleval:check_rbl('CACHE', 'dnsbl.example.com.')
describe __DNSBL cache result
tflags __DNSBL net
score __DNSBL 0.1
header DNSBL_1 eval:check_rbl_sub('CACHE', '127.0.0.1')
describe DNSBL_1 result code 1
tflags DNSBL_1 net
score DNSBL_1 0.5
header DNSBL_2 eval:check_rbl_sub('CACHE', '127.0.0.2')
describe DNSBL_2 result code 2
tflags DNSBL_2 net
score DNSBL_2 1.1
header DNSBL_3 eval:check_rbl_sub('CACHE', '127.0.0.3')
describe DNSBL_3 result code 3
tflags DNSBL_3 net
score DNSBL_3 0.4
header DNSBL_4 eval:check_rbl_sub('CACHE', '127.0.0.4')
describe DNSBL_4 result code 4
tflags DNSBL_4 net
score DNSBL_4 0.4
....
as much you like, it will one do one dns lookup
