You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2005/01/26 02:00:06 UTC
[Bug 4106] New: URI rules do not check name servers against RHS lists.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
Summary: URI rules do not check name servers against RHS lists.
Product: Spamassassin
Version: unspecified
Platform: Other
OS/Version: All
Status: NEW
Severity: normal
Priority: P4
Component: Libraries
AssignedTo: dev@spamassassin.apache.org
ReportedBy: track@plectere.com
When checking a URI, the inital URI is checked against all URI rules and
lists, both IP based and RHS based; However name server (indirected) queries
are only checked against IP based lists. This is at times a serious limitation
when name servers jump IPs to new netblocks (not yet in the IP based lists),
yet retain their previous domain names - It also reduces the effectiveness of
any RHS list based URI tests.
Time allowing, a sample implementation of (relatively simple) code changes will
follow.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4106] URI rules do not check name servers against RHS lists.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
------- Additional Comments From quinlan@pathname.com 2005-01-25 17:17 -------
Subject: Re: New: URI rules do not check name servers against RHS lists.
Sounds good. Maybe this should use a different rule type?
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4106] URI rules do not check name servers against RHS lists.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
------- Additional Comments From track@plectere.com 2005-01-25 17:46 -------
Subject: Re: URI rules do not check name servers against RHS lists.
>>From apache@bugzilla.spamassassin.org Tue Jan 25 17:17:49 2005
>From: bugzilla-daemon@bugzilla.spamassassin.org
>To: track@Plectere.com
>Subject: [Bug 4106] URI rules do not check name servers against RHS lists.
>In-Reply-To: <41...@spamassassin.apache.org>
>References: <41...@spamassassin.apache.org>
>X-Bugzilla-Reason: Reporter
>Date: Tue, 25 Jan 2005 17:17:26 -0800 (PST)
>
>http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
>
>------- Additional Comments From quinlan@pathname.com 2005-01-25 17:17 -------
>Subject: Re: New: URI rules do not check name servers against RHS lists.
>
>Sounds good. Maybe this should use a different rule type?
>
>------- You are receiving this mail because: -------
>You reported the bug, or are watching the reporter.
>
After some discussions (a while ago with Jeff C. of SURBL) and
checking the existing code, I'm pretty sure the actual changes required
are on the order of a full day or two of work (at least for me - where
perl is a fourth or fifth language). I don't believe a different rule
is appropriate as this is a simple enhancement to existing functionality,
in fact for 3.0.x, there are no RHS URI rules - though I did just file
another bug report containing many (Bugzilla #4104).
Paul Shupak
P.S. What is needed is construct similar to urirhssub such as (the
nonexistent) uridnsblsub which *could* save many DNS queries (like
for the SPEWS cases I listed in #4104).
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4106] URI rules do not check name servers against RHS lists.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
------- Additional Comments From jeffc@surbl.org 2005-01-25 22:31 -------
Perhaps Daniel can clarify what he was suggesting.
What you suggest of creating a name-based BL of spam domain name servers sounds
interesting, but SURBLs are not really designed to do that. Perhaps someone
else could put something together. We'd certainly share our data with anyone
who wanted to do that. One of the difficulties would be keeping spam domains
refreshed as to which nameservers they were using, etc. As you note the name
server IPs move around pretty often, but do the name servers names for a given
domain changed much?
Throwaway domains also would tend to make the task more difficult. Since many
spammers treat many domains as disposable, that somewhat complicates the task of
trying to keep track of which ones were actively used in order to know which
ones to track the name servers of.
Researching spammer name servers is a topic unto itself. Spamhaus has folks
doing it, as do probably others. SURBL doesn't. I guess we find the
first-order task of listing domains that appear in spam URIs to be something
we're better suited to do. To me those are somewhat more transparent and easier
to track than name servers, though others are surely looking into them.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4106] URI rules do not check name servers against RHS lists.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
------- Additional Comments From track@plectere.com 2005-01-25 20:33 -------
Subject: Re: URI rules do not check name servers against RHS lists.
Jeff,
As is often the case I read it a little differently, but I can clearly
see how your interpretation might be correct; If so, while it would require
re-scoring the existing rules lower, I think the net effect should be overall
greater - and then I would tend to agree - a separate rule which fires to
generate additive scores should be more "powerful" than a single score if, for
example, both the site and its DNS servers were in the SBL.
Just to request once again, I'd love to see SURBL. mine the existing
data used to create a (sub-)class of known spam DNS server domains which would
feed just such a process. As I previously said to you, the issue of FPs is
more significant for DNS servers than with the spamvertized sites themselves,
but for those which have already gotten into the SBL, SPEWS level 1, or like
the "christmas tree" examples I showed you previously (I've collected a few
more since) are the clear cases, most of the marginal ones like Yahoo's YNS,
gandi.net, msn.com, joker.net, uu.net, etc. servers can just be white-listed,
but many others will present difficulty to prevent FPs. For instance, the
domains "dns-secure.com", "dnsmanaged.com", "dnsmadeeasy.com".
"name-services.com", and "namesecure.com" are all *favorites* with spammers,
but all also have a significant number of legitimate customers. I would be
willing to help with any coding involved.
Anyway, bye again,
Paul Shupak
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4106] URI rules do not check name servers against RHS lists.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
------- Additional Comments From jeffc@surbl.org 2005-01-25 18:00 -------
I think when Quinlan says "new rule type" he means creating a new class such as
NS rule (instead of existing URI, body or header rules), which would for example
check the name and IP of a name server against both name and number types of RBLs.
If so, he's making a meta argument for a new type of rule and not a modification
of or addition to the existing URI type.
Or I could be misreading Daniel. His response was somewhat underspecific, IMO.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4106] URI rules do not check name servers against RHS lists.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
Bob@Menschel.net changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|Undefined |Future
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
[Bug 4106] URI rules do not check name servers against RHS lists.
Posted by bu...@bugzilla.spamassassin.org.
http://bugzilla.spamassassin.org/show_bug.cgi?id=4106
------- Additional Comments From jm@jmason.org 2005-02-17 15:12 -------
I think "different rule type" would refer to something like "urinsrhsbl",
similar to "urirhsbl", "uribl" etc. IOW, a different rule parameter, rather
than a whole new type.
(Daniel, the URIRHSBL rules et al are not different rule types anyway in the
first place. IIRC, they hook in in the guise of "body eval rules" even though
they aren't really implemented that way.)
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.