Re: PBL using -notfirsthop vs -lastexternal (Re: spamhaus' PBL is now *active* (in beta ... but still active). now what? )

[Justin Mason <jm...@jmason.org>]

John Rudd writes:
> Is there an SA function that will just return an array of Relays that 
> fit a given one of these criteria?  Such as:
> 
> @relays = get_relays(options);
> 
> where options is a comma delimited string of words like:
>     Trusted      - include a given relay if it is trusted
>     Untrusted    - include a relay if it is untrusted
>     External     - include a relay if it is external
>     Internal     - include a relay if it is internal
>     LastExternal - do NOT include the relay if it is NOT the
>                    most recent external relay
>     NotFirstHop  - do NOT include the relay if there are multiple
>                    relays and this one was the least recent relay
> 
> and the returned relay array meets the specified criteria, and contains 
> the same data about the relays that are in the pseudo-headers?
> 
> An SA function, particularly a PerMsgStatus method, that did something 
> like this would be VERY useful.

well, it's not a method -- nor is it well-documented -- but it's
available.  e.g. lib/Mail/SpamAssassin/Plugin/DCC.pm:

  my $client = $permsgstatus->{relays_external}->[0]->{ip};
  if ($self->{dccifd_available}) {
    my $clientname = $permsgstatus->{relays_external}->[0]->{rdns};
    my $helo = $permsgstatus->{relays_external}->[0]->{helo} || "";
    if ($client) {
      if ($clientname) {
        $client = $client . "\r" . $clientname;
      }
    } else {
      $client = "0.0.0.0";
    }
    return $self->dccifd_lookup($permsgstatus, $full, $client, $clientname, $helo);


There are similar arrays under relays_trusted, relays_untrusted,
relays_internal as well.  Each contains {ip}, {helo}, {rdns}
and the other pieces of Relays metadata.

--j.

Re: PBL using -notfirsthop vs -lastexternal (Re: spamhaus' PBL is now *active* (in beta ... but still active). now what? )

[John Rudd <jr...@ucsc.edu>]

Justin Mason wrote:
> John Rudd writes:
>> Is there an SA function that will just return an array of Relays that 
>> fit a given one of these criteria?  Such as:
>>
>> @relays = get_relays(options);
>>
>> where options is a comma delimited string of words like:
>>     Trusted      - include a given relay if it is trusted
>>     Untrusted    - include a relay if it is untrusted
>>     External     - include a relay if it is external
>>     Internal     - include a relay if it is internal
>>     LastExternal - do NOT include the relay if it is NOT the
>>                    most recent external relay
>>     NotFirstHop  - do NOT include the relay if there are multiple
>>                    relays and this one was the least recent relay
>>
>> and the returned relay array meets the specified criteria, and contains 
>> the same data about the relays that are in the pseudo-headers?
>>
>> An SA function, particularly a PerMsgStatus method, that did something 
>> like this would be VERY useful.
> 
> well, it's not a method -- nor is it well-documented -- but it's
> available.  e.g. lib/Mail/SpamAssassin/Plugin/DCC.pm:
> 
[example snipped]
> 
> There are similar arrays under relays_trusted, relays_untrusted,
> relays_internal as well.  Each contains {ip}, {helo}, {rdns}
> and the other pieces of Relays metadata.

Yep, I know about those.  I make use of the trusted and untrusted ones 
in Botnet.  But what I was saying is: it'd be nice if there was a nice 
function for pulling that material out for you.

And, what would be nicer is if it was all object oriented (get_relays 
returns an array of objects, which have accessor methods and such).

It might also be useful if the Relays metadata included flags for 
"notfirsthop" and "lastexternal".  I mean, I'm sure you can easily guess 
at it, but like I said, I'm looking for things that make it so that a 
module writer doesn't have to re-invent the wheel in order to get the 
same results.  If we all want to look at "the last external relay", then 
there should be one piece of code we can all call that gives us "the 
last external relay".  That way a change in implementation doesn't cause 
all of the modules to have to be re-written.