You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by Gary Funck <ga...@intrepid.com> on 2004/02/08 00:56:40 UTC
whitelist_rcvd_from: ignoring localhost handover?
This is a follow up to my original inquiry on SA Talk:
http://article.gmane.org/gmane.mail.spam.spamassassin.general/41027/match=+w
hitelist+rcvd+funck
(which went unanswered. I'd still appreciate hearing from the experts out
there, when
you've got a min/two. :/)
(config: SA 2.63, Perl 5.8.0, RH 9.0, network checks enabled, sendmail
8.12.8)
I've got a situation where I tried to set up whitelist_from_rcvd, but I see
the
following in the debug output:
debug: received-header: ignoring localhost handover
which, reading the code in Received.pm seems to indicate that the Receieved:
header
couldn't be parsed properly?
Here's my whitelist entry (names/IP addrs changed for this example):
# Trusted hosts
whitelist_from_rcvd * localhost
whitelist_from_rcvd *@*foo.org foo.org
### We can trust headers from these IP's:
trusted_networks 127.
trusted_networks 199.99.99.0/24 ## will rDNS to foo.org
An example header:
>From web@www.foo.org Sat Feb 7 05:50:52 2004
Return-Path: <we...@www.foo.org>
Received: from www.foo.org (localhost [127.0.0.1])
by www.foo.org (8.12.8/8.12.8) with ESMTP id i17DoZMn008108;
Sat, 7 Feb 2004 05:50:35 -0800
Received: (from web@localhost)
by www.foo.org (8.12.8/8.12.8/Submit) id i17DoYRj008106;
Sat, 7 Feb 2004 05:50:34 -0800
Date: Sat, 7 Feb 2004 05:50:34 -0800
From: Web Admin <we...@www.foo.org>
Message-Id: <20...@www.foo.org>
To: admin@foo.net
Subject: ht://Dig Report for www.foo.net - Fri Feb 6 22:30:00 PST 2004
Is this a bug in the Received: header parsing? I saw the following bug
reports, but they say they're closed/fixed:
http://bugzilla.spamassassin.org/show_bug.cgi?id=2787 (milestone: 2.62)
RE: whitelist_rcvd_from: ignoring localhost handover?
Posted by Gary Funck <ga...@intrepid.com>.
This is a follow-up to the following note. Basically, I'm trying to build
a patch to 2.63 to fix this problem, and I've got the Received.pm part done
perhaps, but am (more) unsure about the Evaltest.pm part.
Here's a recap:
>
> (config: SA 2.63, Perl 5.8.0, RH 9.0, network checks enabled, sendmail
> 8.12.8)
>
> I've got a situation where I tried to set up whitelist_from_rcvd,
> but I see
> the
> following in the debug output:
>
> debug: received-header: ignoring localhost handover
>
> which, reading the code in Received.pm seems to indicate that the
> Receieved:
> header
> couldn't be parsed properly?
>
> Here's my whitelist entry (names/IP addrs changed for this example):
>
> # Trusted hosts
> whitelist_from_rcvd * localhost
> whitelist_from_rcvd *@*foo.org foo.org
>
> ### We can trust headers from these IP's:
> trusted_networks 127.
> trusted_networks 199.99.99.0/24 ## will rDNS to foo.org
>
> An example header:
>
> >From web@www.foo.org Sat Feb 7 05:50:52 2004
> Return-Path: <we...@www.foo.org>
> Received: from www.foo.org (localhost [127.0.0.1])
> by www.foo.org (8.12.8/8.12.8) with ESMTP id i17DoZMn008108;
> Sat, 7 Feb 2004 05:50:35 -0800
> Received: (from web@localhost)
> by www.foo.org (8.12.8/8.12.8/Submit) id i17DoYRj008106;
> Sat, 7 Feb 2004 05:50:34 -0800
> Date: Sat, 7 Feb 2004 05:50:34 -0800
> From: Web Admin <we...@www.foo.org>
> Message-Id: <20...@www.foo.org>
> To: admin@foo.net
> Subject: ht://Dig Report for www.foo.net - Fri Feb 6 22:30:00 PST 2004
So, as you can see - this message was sent from localhost (a procmail
forward
I believe) to the mail gateway (on the same physical host system), thus both
headers are trusted, and there is no trusted/untrusted border.
I've patched Received.pm to have all the new code relating to parsing
different
header formats, but took out the code that calculated trusted host headers.
I'm beginning to think this won't fix the problem that I'm seeing, but if
there
are suggestions on patching Evaltest.pm to work the info. that 2.63 has, I'd
like to hear it.
Here is the 2.63 routine in question:
sub _check_whitelist_rcvd {
my ($self, $list, $addr) = @_;
# we can only match this if we have at least 1 untrusted header
return unless ($self->{num_relays_untrusted} > 0);
my $lastunt = $self->{relays_untrusted}->[0];
my $rdns = $lastunt->{lc_rdns};
dbg ("check_whitelist_from_rcvd: last_untrusted = $lastunt($rdns)");
$addr = lc $addr;
foreach my $white_addr (keys %{$list}) {
my $regexp = $list->{$white_addr}{re};
my $domain = $list->{$white_addr}{domain};
if ($addr =~ /${regexp}/i && $rdns =~ /(?:^|\.)\Q${domain}\E$/) {
return 1;
}
}
return 0;
}
and the 2.70 code:
sub _check_whitelist_rcvd {
my ($self, $list, $addr) = @_;
# we can only match this if we have at least 1 trusted or untrusted header
return unless ($self->{num_relays_untrusted}+$self->{num_relays_trusted} >
0);
my @relays = ();
# try the untrusted one first
if ($self->{num_relays_untrusted} > 0) {
@relays = $self->{relays_untrusted}->[0];
}
# then try the trusted ones; the user could have whitelisted a trusted
# relay, totally permitted
if ($self->{num_relays_trusted} > 0) {
push (@relays, @{$self->{relays_trusted}});
}
$addr = lc $addr;
foreach my $white_addr (keys %{$list}) {
my $regexp = $list->{$white_addr}{re};
my $domain = $list->{$white_addr}{domain};
$addr = lc $addr;
foreach my $white_addr (keys %{$list}) {
my $regexp = $list->{$white_addr}{re};
my $domain = $list->{$white_addr}{domain};
if ($addr =~ /${regexp}/i) {
foreach my $lastunt (@relays) {
my $rdns = $lastunt->{lc_rdns};
if ($rdns =~ /(?:^|\.)\Q${domain}\E$/) { return 1; }
}
}
}
return 0;
}
--------
I'd hoped that by patching the Received header parsing, I'd be home free (it
did help,
because 2.63 wasn't parsing it), but it seems that I also need this
trusted/untrusted
host logic as well? (I've verified that num_relays_untrusted is 0 on entry).
Question: why is the code checking the first untrusted received line?
Is the "first untrusted" considered to be the first Received line that has
a trusted host in the "by <host>" part, but the "from <host>" part is
untrusted?
Thus - trust or not trust applies to the "from" part of the Received line?