You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Philip Prindeville <ph...@redfish-solutions.com> on 2023/04/24 20:32:55 UTC
Did the whitelist_from_rcvd semantics change?
Hi,
I have the following line:
whitelist_from_rcvd *@ceipalmm.com mailgun.net
And tried it on a message that had:
Return-Path: <bl...@mg2.ceipalmm.com>
But it didn't get whitelisted. If I change the pattern above to "*@mg2.ceipalmm.com" it works. I thought the matching included subdomains, and seem to remember that working.
But just ran a simple test and that's not the case.
Is this a bug? Looking at Mail/SpamAssassin/Plugin/WLBLEval.pm I see:
if ($rdns =~ /(?:^|\.)\Q${domain}\E$/i) { $match=1; last }
So I *thought* that was what was happening, but testing says otherwise.
Insights?
Thanks,
-Philip
Re: Did the whitelist_from_rcvd semantics change?
Posted by "Kevin A. McGrail" <km...@apache.org>.
Hi Philip,
To my knowledge, the matching is a simple glob which does NOT work on
subdomains.
You might be able to do *@*.ceipalmm.com and *@ceipalmm.com
Regards,
KAM
On 4/24/2023 4:34 PM, Philip Prindeville wrote:
> Oh, and this is on Fedora, so I'm running 3.4.6...
>
>
>> On Apr 24, 2023, at 2:32 PM, Philip Prindeville <ph...@redfish-solutions.com> wrote:
>>
>> Hi,
>>
>> I have the following line:
>>
>> whitelist_from_rcvd *@ceipalmm.com mailgun.net
>>
>> And tried it on a message that had:
>>
>> Return-Path: <bl...@mg2.ceipalmm.com>
>>
>> But it didn't get whitelisted. If I change the pattern above to "*@mg2.ceipalmm.com" it works. I thought the matching included subdomains, and seem to remember that working.
>>
>> But just ran a simple test and that's not the case.
>>
>> Is this a bug? Looking at Mail/SpamAssassin/Plugin/WLBLEval.pm I see:
>>
>> if ($rdns =~ /(?:^|\.)\Q${domain}\E$/i) { $match=1; last }
>>
>> So I *thought* that was what was happening, but testing says otherwise.
>>
>> Insights?
>>
>> Thanks,
>>
>> -Philip
>>
--
Kevin A. McGrail
KMcGrail@Apache.org
Member, Apache Software Foundation
Chair Emeritus Apache SpamAssassin Project
https://www.linkedin.com/in/kmcgrail - 703.798.0171
Re: Did the whitelist_from_rcvd semantics change?
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
Oh, and this is on Fedora, so I'm running 3.4.6...
> On Apr 24, 2023, at 2:32 PM, Philip Prindeville <ph...@redfish-solutions.com> wrote:
>
> Hi,
>
> I have the following line:
>
> whitelist_from_rcvd *@ceipalmm.com mailgun.net
>
> And tried it on a message that had:
>
> Return-Path: <bl...@mg2.ceipalmm.com>
>
> But it didn't get whitelisted. If I change the pattern above to "*@mg2.ceipalmm.com" it works. I thought the matching included subdomains, and seem to remember that working.
>
> But just ran a simple test and that's not the case.
>
> Is this a bug? Looking at Mail/SpamAssassin/Plugin/WLBLEval.pm I see:
>
> if ($rdns =~ /(?:^|\.)\Q${domain}\E$/i) { $match=1; last }
>
> So I *thought* that was what was happening, but testing says otherwise.
>
> Insights?
>
> Thanks,
>
> -Philip
>
Re: Did the whitelist_from_rcvd semantics change?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2023-04-28 at 12:11:02 UTC-0400 (Fri, 28 Apr 2023 10:11:02 -0600)
Philip Prindeville <ph...@redfish-solutions.com>
is rumored to have said:
>> On Apr 25, 2023, at 6:28 AM, Bill Cole
>> <sa...@billmail.scconsult.com> wrote:
>>
>> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600)
>> Philip Prindeville <ph...@redfish-solutions.com>
>> is rumored to have said:
>>
>>> I thought the matching included subdomains, and seem to remember
>>> that working.
>>
>> It never has. At least not in the past 17 years.
>>
>
>
> Then how do pools of servers like *.protection.outbound.outlook.com
> get handled?
Subdomains are implicitly included in the relay hostname parameter, NOT
in the From address parameter, where simple glob wildcards work. RTFM:
perldoc Mail::SpamAssassin::Conf
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: Did the whitelist_from_rcvd semantics change?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
If you're going to engage with RH, leave me out of it.
On 2023-05-01 at 11:14:12 UTC-0400 (Mon, 1 May 2023 09:14:12 -0600)
Philip Prindeville <ph...@redfish-solutions.com>
is rumored to have said:
>> On May 1, 2023, at 3:48 AM, Reindl Harald <h....@thelounge.net>
>> wrote:
>>
>>
>>
>> Am 30.04.23 um 20:54 schrieb Philip Prindeville:
>>>> On Apr 28, 2023, at 12:17 PM, Philip Prindeville
>>>> <ph...@redfish-solutions.com> wrote:
>>>>
>>>>
>>>>
>>>>> On Apr 28, 2023, at 10:24 AM, Reindl Harald
>>>>> <h....@thelounge.net> wrote:
>>>>>
>>>>>
>>>>>
>>>>> Am 28.04.23 um 18:11 schrieb Philip Prindeville:
>>>>>>> On Apr 25, 2023, at 6:28 AM, Bill Cole
>>>>>>> <sa...@billmail.scconsult.com> wrote:
>>>>>>>
>>>>>>> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55
>>>>>>> -0600)
>>>>>>> Philip Prindeville <ph...@redfish-solutions.com>
>>>>>>> is rumored to have said:
>>>>>>>
>>>>>>>> I thought the matching included subdomains, and seem to
>>>>>>>> remember that working.
>>>>>>>
>>>>>>> It never has. At least not in the past 17 years.
>>>>>>>
>>>>>> Then how do pools of servers like
>>>>>> *.protection.outbound.outlook.com get handled?
>>>>>
>>>>> as * is always handeled at globbing
>>>>>
>>>>> *.example.com
>>>>> *@example.com
>>>>
>>>>
>>>> Maybe I'm missing something, but the code brackets ${domain} with
>>>> \Q and \E so globbing wouldn't work.
>>>>
>>>> if ($rdns =~ /(?:^|\.)\Q${domain}\E$/i) { $match=1; last }
>>>>
>>> But it *is* anchored on the left hand side by either beginning of
>>> line *or* dot
>>
>> and what do you think "*" will do with the anchoring?
>>
>> ^*
>
>
> And that will continue to glob inside \Q ... \E ?
>
> -Philip
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire
Re: Did the whitelist_from_rcvd semantics change?
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
> On May 1, 2023, at 3:48 AM, Reindl Harald <h....@thelounge.net> wrote:
>
>
>
> Am 30.04.23 um 20:54 schrieb Philip Prindeville:
>>> On Apr 28, 2023, at 12:17 PM, Philip Prindeville <ph...@redfish-solutions.com> wrote:
>>>
>>>
>>>
>>>> On Apr 28, 2023, at 10:24 AM, Reindl Harald <h....@thelounge.net> wrote:
>>>>
>>>>
>>>>
>>>> Am 28.04.23 um 18:11 schrieb Philip Prindeville:
>>>>>> On Apr 25, 2023, at 6:28 AM, Bill Cole <sa...@billmail.scconsult.com> wrote:
>>>>>>
>>>>>> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600)
>>>>>> Philip Prindeville <ph...@redfish-solutions.com>
>>>>>> is rumored to have said:
>>>>>>
>>>>>>> I thought the matching included subdomains, and seem to remember that working.
>>>>>>
>>>>>> It never has. At least not in the past 17 years.
>>>>>>
>>>>> Then how do pools of servers like *.protection.outbound.outlook.com get handled?
>>>>
>>>> as * is always handeled at globbing
>>>>
>>>> *.example.com
>>>> *@example.com
>>>
>>>
>>> Maybe I'm missing something, but the code brackets ${domain} with \Q and \E so globbing wouldn't work.
>>>
>>> if ($rdns =~ /(?:^|\.)\Q${domain}\E$/i) { $match=1; last }
>>>
>> But it *is* anchored on the left hand side by either beginning of line *or* dot
>
> and what do you think "*" will do with the anchoring?
>
> ^*
And that will continue to glob inside \Q ... \E ?
-Philip
Re: Did the whitelist_from_rcvd semantics change?
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
> On Apr 28, 2023, at 12:17 PM, Philip Prindeville <ph...@redfish-solutions.com> wrote:
>
>
>
>> On Apr 28, 2023, at 10:24 AM, Reindl Harald <h....@thelounge.net> wrote:
>>
>>
>>
>> Am 28.04.23 um 18:11 schrieb Philip Prindeville:
>>>> On Apr 25, 2023, at 6:28 AM, Bill Cole <sa...@billmail.scconsult.com> wrote:
>>>>
>>>> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600)
>>>> Philip Prindeville <ph...@redfish-solutions.com>
>>>> is rumored to have said:
>>>>
>>>>> I thought the matching included subdomains, and seem to remember that working.
>>>>
>>>> It never has. At least not in the past 17 years.
>>>>
>>> Then how do pools of servers like *.protection.outbound.outlook.com get handled?
>>
>> as * is always handeled at globbing
>>
>> *.example.com
>> *@example.com
>
>
> Maybe I'm missing something, but the code brackets ${domain} with \Q and \E so globbing wouldn't work.
>
> if ($rdns =~ /(?:^|\.)\Q${domain}\E$/i) { $match=1; last }
>
But it *is* anchored on the left hand side by either beginning of line *or* dot.
-Philip
Re: Did the whitelist_from_rcvd semantics change?
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
> On Apr 28, 2023, at 10:24 AM, Reindl Harald <h....@thelounge.net> wrote:
>
>
>
> Am 28.04.23 um 18:11 schrieb Philip Prindeville:
>>> On Apr 25, 2023, at 6:28 AM, Bill Cole <sa...@billmail.scconsult.com> wrote:
>>>
>>> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600)
>>> Philip Prindeville <ph...@redfish-solutions.com>
>>> is rumored to have said:
>>>
>>>> I thought the matching included subdomains, and seem to remember that working.
>>>
>>> It never has. At least not in the past 17 years.
>>>
>> Then how do pools of servers like *.protection.outbound.outlook.com get handled?
>
> as * is always handeled at globbing
>
> *.example.com
> *@example.com
Maybe I'm missing something, but the code brackets ${domain} with \Q and \E so globbing wouldn't work.
if ($rdns =~ /(?:^|\.)\Q${domain}\E$/i) { $match=1; last }
Re: Did the whitelist_from_rcvd semantics change?
Posted by Philip Prindeville <ph...@redfish-solutions.com>.
> On Apr 25, 2023, at 6:28 AM, Bill Cole <sa...@billmail.scconsult.com> wrote:
>
> On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600)
> Philip Prindeville <ph...@redfish-solutions.com>
> is rumored to have said:
>
>> I thought the matching included subdomains, and seem to remember that working.
>
> It never has. At least not in the past 17 years.
>
Then how do pools of servers like *.protection.outbound.outlook.com get handled?
-Philip
Re: Did the whitelist_from_rcvd semantics change?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 2023-04-24 at 16:32:55 UTC-0400 (Mon, 24 Apr 2023 14:32:55 -0600)
Philip Prindeville <ph...@redfish-solutions.com>
is rumored to have said:
> I thought the matching included subdomains, and seem to remember that
> working.
It never has. At least not in the past 17 years.
--
Bill Cole
bill@scconsult.com or billcole@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Not Currently Available For Hire