Download & Extend

DNSBL filter module

Project:Spam
Version:6.x-1.0
Component:Code
Category:feature request
Priority:normal
Assigned:Unassigned
Status:active

Issue Summary

I was recently seeing lots of spam in my Drupal-powered forum. So I wrote the following DNS blacklist filter for the SPAM module. The Troll and Bad behavior module already does similar things, but they are not integrated with the Spam module. So I had to write this. I am posting it here in case it helps anyone else. It is working well for me :-)

Filter name is "spamdnsbl". Thanks.

<?php
// $Id$

/**
* @file
* DNSBL filter plug-in for the spam module.
*
* Uses DNSBL service provided by opm.tornevall.org.  This blacklist
* includes blacklisted IP addresses listed by http://www.stopforumspam.com.
*/

/**
* @see http://dnsbl.tornevall.org/index.php?do=usage
*/
define('SPAMDNSBL_LOOKUP_HOST', '.opm.tornevall.org');


/**
* Spam hook_spamapi implementation.
*/
function spamdnsbl_spamapi($op, $type = NULL, $content = array(),
                           $fields = array(), $extra = NULL) {

  switch ($op) {
    case 'filter':
      if (!module_invoke('spam', 'filter_enabled', 'spamdnsbl',
                                $type, $content, $fields, $extra)) return;
      return spamdnsbl_spam_filter($content, $type, $fields, $extra);

    case 'filter_module':
      return 'spamdnsbl';

    case 'filter_info':
      return array(
        'name' => t('DNSBL filter'),
        'module' => t('spamdnsbl'),
        'description' => t('A DNSBL filter.'),
        'help' => t('Looks up IP address in DNSBL to determine if content could be spam.'),
      );
      break;

    case 'filter_install':
      return array(
        'status' => SPAM_FILTER_ENABLED,
        'gain' => 250,
        'weight' => -9,
      );
  }
}


/**
* Check for spam IP address.
*/
function spamdnsbl_spam_filter($content, $type, $fields, $extra = array(), $filter_test = FALSE) {

  $id = spam_invoke_module($type, 'content_id', $content, $extra);
  $action = array();

  $ip_address = ip_address();
  $spam = spamdnsbl_is_spam_ip($ip_address);

  if ($spam) {
    spam_log(SPAM_LOG, 'spamdnsbl_spam_filter',
        t('Found spammer IP @IP', array('@IP' => $ip_address)), $type, $id);

    $action['spamdnsbl'][] = array(
      'ip' => $ip_address,
      'probability' => 99,
    );

    $action['total'] = 99;
  }
  else {
    $action['total'] = 0;
  }

  return $action;
}


/**
* Checks the given IP address against DNSBL.
*
* @param string $ip_address
* @return bool
*/
function spamdnsbl_is_spam_ip($ip_address) {

  $octet_list = explode('.', $ip_address);
  $reverse_octet_list = array_reverse($octet_list);
  $reverse_ip_address = join('.', $reverse_octet_list);
  $dnsbl_lookup_hostname = $reverse_ip_address . SPAMDNSBL_LOOKUP_HOST;

  /**
   * gethostbyname() returns the IPv4 address on success or a string containing the
   * unmodified hostname on failure.
   */
  $ip = gethostbyname($dnsbl_lookup_hostname);

  if ($ip !== $dnsbl_lookup_hostname) return TRUE;
  else return FALSE;
}

Module info file:

; $Id$
name = Spam DNSBL filter
description = A DNSBL filter plug-in for the spam module.
package = Spam
dependencies[] = spam
core = 6.x
nobody click here