#include <Analyze.h>
Public Types | |
enum | Option { VIEWWHOIS, ABUSEDETAILS, USEONLYCACHE, NODISPLAYOUTPUT } |
some options that can be set More... | |
enum | Type { EMAILHEADER, IP_URL } |
Type. More... | |
Static Public Member Functions | |
static void | setDnsbls (std::list< Dnsbl > lst) |
Set the DNSBL list to be used. | |
static void | addDnsbl (const Dnsbl &to_add) |
Add a DNSBL. | |
static void | removeDnsbl (const std::string &name) |
Remove a DNSBL. | |
static void | analyze (const std::string &is, VirtStream &hOut, const AnalyzerFeedback *listener=NULL, Type type=EMAILHEADER) |
Start a header analysis. | |
static void | stop () |
Stop a running analysis. | |
static bool | getBoolOption (Option opt) |
Get an engine option. | |
static void | setOption (Option opt, bool newvalue) |
Set a boolean engine option. | |
static void | setAbuseCache (AbuseAddiesCache *cache) |
Set the Abuse Address Cache. | |
static void | setSafeAddresses (const std::list< UrlRange > &safe) |
Set a list of ranges of ip addresses as trustable. | |
static AbuseAddiesCache * | getAbuseCache () |
Return a pointer to the Abuse Addresses Cache. | |
static void | getVersionStrings (std::string &versionData) |
Retrieve the engine version. | |
static void | setThreshold (const int value) |
Set a threshold level of confidence when extracting abuse contacts. | |
static void | getErrorCnts (error_Cnts &cnts) |
Retrieve the errors of an analysis. | |
Private Types | |
typedef std::map< Option, bool > | BoolOptions |
Private Member Functions | |
Analyzer () | |
To avoid instances of the class. | |
Static Private Member Functions | |
static void | doAnalyzeIP_URL (const std::string &is, VirtStream &hOut) throw (std::exception) |
static void | doAnalyze (const std::string &is, VirtStream &hOut) throw (std::exception) |
static Result | massiveCheck (const Url &url, std::list< std::string > *names=NULL) |
static void | dump (VirtStream &ss, const Received &curr) |
static THREADRETVALUE | threadBegin (LPVOID lpv) |
static int | checkChain (const Received &curr, const Received &prev, VirtStream &os, int initialLevel=0) |
static bool | checkMX (const Received &curr, VirtStream &os) |
static EmailTrust | checkAbuseOnline (const Url &thisUrl, std::list< std::string > &contacts, VirtStream &os) |
static EmailTrust | getAbuse (ZeWhois::WhoisList &we, std::list< std::string > &emails, Url &thisUrl, VirtStream &os) |
static BoolOptions & | boolOptions () |
static void | init () |
static bool | isTrusted (const Received &rec) |
static bool | canBeDynamic (const Url &url, const std::string &declared_to_be) |
Static Private Attributes | |
static const char * | NOTSET = "[[NOTSET]]" |
static const AnalyzerFeedback * | listener = NULL |
static std::list< RefCounted< ThreadedDnsbl > > | dnsbls |
static Event | eTerminate = true |
static AbuseAddiesCache * | m_cache = NULL |
static std::list< UrlRange > | m_safeAddies |
static int | THRESHOLD = 100 |
static int | NAMEMISMATCH = 75 |
static int | NAMELOOKSDYNAMIC = 100 |
static int | BLACKLISTED = 75 |
static int | RECBYMISMATCH = 100 |
static int | SIMILARNAMES = -75 |
static int | SAMEDOMAINS = -75 |
Friends | |
class | Win32Initializer |
|
For internal use only. Useful typedef for engine boolean options |
|
some options that can be set
|
|
Type.
|
|
To avoid instances of the class.
|
|
Add a DNSBL.
|
|
Start a header analysis.
|
|
For internal use only. Return a reference to the engine bool options |
|
For internal use only. Return true if an host is likely to be a dynamic ip |
|
For internal use only. No info about this... |
|
Check if the Received: chain is respected, i.e. if we can trust a Received line not to be faked |
|
For internal use only. Check if an email addy contained in a Received line has a default MX (mail exchanger) host |
|
For internal use only.
|
|
For internal use only. This function analyzes an ip address |
|
That's what I remember
|
|
For internal use only. Try to extract an abuse addresses of an host |
|
Return a pointer to the Abuse Addresses Cache.
|
|
Get an engine option.
|
|
Retrieve the errors of an analysis.
|
|
Retrieve the engine version.
|
|
For internal use only. Init the engine |
|
For internal use only. Tell if a Received line comes from a trustable address |
|
For internal use only.
|
|
Remove a DNSBL.
|
|
Set the Abuse Address Cache.
|
|
Set the DNSBL list to be used.
|
|
Set a boolean engine option.
|
|
Set a list of ranges of ip addresses as trustable. This member is used to qualify some ip ranges as trustables, i.e. any e-mail headers Received: line containing one of these address as the dispatcher (from) is supposed authentic (not faked), and so it's the previous line (where the same host should appear as the receiver, "by" side of the line),
|
|
Set a threshold level of confidence when extracting abuse contacts.
|
|
Stop a running analysis.
|
|
Analyzer::analyze starts a new thread, with a pointer to some data concerning the analysis. |
|
|
|
For internal use only. decrement in confidence if a mailserver is blacklisted for some reasons |
|
For internal use only. list of dnsbls used, each one running in its own thread |
|
For internal use only. Event set if the analysis is to be interrupted |
|
For internal use only. Pointer to the client sink interface |
|
For internal use only. Pointer to the Abuse Addresses Cache |
|
For internal use only. list of ip addresses ranges to be considered as safe (trustable) |
|
For internal use only. decrement in confidence if a mailserver's name contains its IP address |
|
For internal use only. decrement in confidence if a mailserver's name is not what it declared to be |
|
For internal use only. I simply don't remember what this is used for... |
|
For internal use only. decrement in confidence if there's a received from/by mismatch in two following Received lines |
|
For internal use only. increment in confidence if the Received line mismatch is somehow caused by hosts having the same domain |
|
For internal use only. increment in confidence if the Received line mismatch is somehow caused by similar names |
|
For internal use only. Threshold level of confidence of a Received line |