Re: dcc whiteclnt support broken in SA 3.1.x?

[Justin Mason <jm...@jmason.org>]

Matt Kettler writes:
> I recently have been fighting with making DCC work properly on a SA
> 3.1.x install.
> 
> I have several high-volume mailing lists, that repeatedly hit DCC, so I
> did what every good DCC user should do. I added an "ok" for the envelope
> from to my whiteclnt file, make sure dccifd was using it, and reloaded
> dccifd.
> 
> Next message from that list, still tagged by DCC.
> 
> So I tried received, still no go.
> 
> Looking at the code, the evelope_from will *never* work, because SA
> passes an empty string as the envelope sender in sub dccifd_lookup.
> 
>     # send the options and other parameters to the daemon
>     $sock->print("header " . $opts . "\n") || dbg("dcc: failed write")
> && die; # options
>     $sock->print($client . "\n") || dbg("dcc: failed write") && die; #
> client
>     $sock->print($helo . "\n") || dbg("dcc: failed write") && die; #
> HELO value
>     $sock->print("\n") || dbg("dcc: failed write") && die; # sender
>     $sock->print("unknown\r\n") || dbg("dcc: failed write") && die; #
> recipients
>     $sock->print("\n") || dbg("dcc: failed write") && die; # recipients
> 
> However, the received one should work. in check_dcc, both the first
> external host and it's RDNS name are added to $client, so that should be
> getting to dccifd.
> 
> What's going on? What magic do I need to make whiteclnt work properly in
> a SA 3.1.x environment when using dccifd?

er, I think it'd need to be implemented ;)

The whole idea of manually whitelisting all the DCC FPs is anathema to the
SpamAssassin model -- instead we try to just accept the FPs and adjust the
score to cope.  Hence we've never added support for whiteclnt.

--j.

Re: dcc whiteclnt support broken in SA 3.1.x?

[Matt Kettler <mk...@verizon.net>]

Justin Mason wrote:
> Matt Kettler writes:
>   
>> What's going on? What magic do I need to make whiteclnt work properly in
>> a SA 3.1.x environment when using dccifd?
>>     
>
> er, I think it'd need to be implemented ;)
>
> The whole idea of manually whitelisting all the DCC FPs is anathema to the
> SpamAssassin model -- instead we try to just accept the FPs and adjust the
> score to cope.  Hence we've never added support for whiteclnt.
>
>   
Of course, the advice on this very list is that if you're using DCC, you
must make use of DCC whitelists for all your high-volume mailing lists.

I've got some pretty significant problems where DCC is matching
solicited commercial bulk mail. That same solicited commercial bulk mail
are often already borderline in score, and the combination results in a
FP. While it's difficult to get these guys to stop using things like
broken HTML, third party hosting that's URIBLed, or third party sending
service that's in SpamCop, I can affect the DCC processing.

So I'm stuck with the alternative of whitelisting the whole sender in SA
with whitelist_from_rcvd or def_whitelist_from_rcvd. Which is a little
over-strong for this situation.

That said, Paul seems to have env_from dcc whitelists working, so I'll
have to delve further into my problem.