You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by René Berber <r....@computer.org> on 2006/12/11 03:26:07 UTC
[Bug report] Botnet uses a lot of time with DSN message
John Rudd wrote:
[snip]
> It can be downloaded from:
>
> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
>
> As usual, feedback, statistics, bug reports, feature suggestions, are
> all welcome.
[snip]
Botnet 0.6 causes a timeout while MA is running SA on a DSN message.
Tests:
1) Test message w/o Botnet:
# mv /etc/mail/spamassassin/Botnet.cf /etc/mail/spamassassin/Botnet.cf-disabled
# time spamassassin -x -t < sample.eml
...
real 9.6
user 8.4
sys 0.5
2) Test with Botnet:
# mv /etc/mail/spamassassin/Botnet.cf-disabled /etc/mail/spamassassin/Botnet.cf
# time spamassassin -x -t < sample.eml
...
Content preview: The following message to <A0...@itesm.mx> was
undeliverable. The reason for the problem: 5.x.1 - Maximum number of
delivery attempts exceeded. [Default] 552-'RCPT TO:<A0...@itesm.mx>
Mailbox disk quota exceeded' [...]
Content analysis details: (2.1 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.0 BOTNET_NORDNS IP address has no PTR record
0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines
0.3 MAILTO_TO_SPAM_ADDR URI: Includes a link to a likely spammer email
0.2 HTML_TAG_BALANCE_BODY BODY: HTML has unbalanced "body" tags
0.0 HTML_MESSAGE BODY: HTML included in message
2.5 BOTNET The submitting mail server looks like part of a Botnet
-0.8 AWL AWL: From: address is in the auto white-list
real 1:32.0
user 8.5
sys 0.4
3) Debug:
# spamassassin -x --debug -t < sample.eml
[17995] dbg: logger: adding facilities: all
[17995] dbg: logger: logging level is DBG
[17995] dbg: generic: SpamAssassin version 3.1.5
...
[17995] dbg: dns: is Net::DNS::Resolver available? yes
[17995] dbg: dns: Net::DNS version: 0.58
...
[17995] dbg: config: read file /etc/mail/spamassassin/Botnet.cf
...
[17995] dbg: plugin: fixed relative path: /etc/mail/spamassassin/Botnet.pm
[17995] dbg: plugin: loading Mail::SpamAssassin::Plugin::Botnet from
/etc/mail/spamassassin/Botnet.pm
[17995] dbg: plugin: registered Mail::SpamAssassin::Plugin::Botnet=HASH(0x6fd5ec)
[17995] dbg: plugin: Mail::SpamAssassin::Plugin::Botnet=HASH(0x6fd5ec)
implements 'parse_config'
[17995] dbg: Botnet: setting botnet_pass_auth to 1
[17995] dbg: Botnet: adding ^127\.0\.0\.1$ to botnet_skip_ip
[17995] dbg: Botnet: adding ^10\..*$ to botnet_skip_ip
[17995] dbg: Botnet: adding ^172\.1[6789]\..*$ to botnet_skip_ip
[17995] dbg: Botnet: adding ^172\.2[0-9]\..*$ to botnet_skip_ip
[17995] dbg: Botnet: adding ^172\.3[01]\..*$ to botnet_skip_ip
[17995] dbg: Botnet: adding ^192\.168\..*$ to botnet_skip_ip
[17995] dbg: Botnet: adding ^192\.168\.20\..*$ to botnet_pass_ip
[17995] dbg: Botnet: adding ^200\.57\.94\.14[03]$ to botnet_pass_ip
[17995] dbg: Botnet: adding (\.|\A)amazon\.com$ to botnet_pass_domains
[17995] dbg: Botnet: adding (\.|\A)apple\.com$ to botnet_pass_domains
[17995] dbg: Botnet: adding (\.|\A)ebay\.com$ to botnet_pass_domains
[17995] dbg: Botnet: adding (\b|\d)cable(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)catv(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)ddns(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)dhcp(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)dial-?up(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)dip(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)dsl(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)dynamic(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)modem(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)ppp(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)client(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)fixed(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)pool(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)static(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)user(\b|\d) to botnet_clientwords
[17995] dbg: Botnet: adding (\b|\d)mail(\b|\d) to botnet_serverwords
[17995] dbg: Botnet: adding (\b|\d)smtp(\b|\d) to botnet_serverwords
[17995] dbg: Botnet: adding (\b|\d)mx(\b|\d) to botnet_serverwords
...
[17995] dbg: plugin: Mail::SpamAssassin::Plugin::Botnet=HASH(0x6fd5ec)
implements 'parse_config'
[17995] dbg: plugin: FuzzyOcr=HASH(0x7048d0) implements 'parse_config'
...
[17995] dbg: dns: dns_available set to yes in config file, skipping test
[17995] dbg: received-header: unknown format: via tmail-2006c.14 for mocampo;
Sat, 9 Dec 2006 02:06:30 -0600 (CST)
[17995] dbg: received-header: unparseable: via tmail-2006c.14 for mocampo; Sat,
9 Dec 2006 02:06:30 -0600 (CST)
[17995] dbg: dns: looking up PTR record for '200.34.200.251'
[17995] dbg: dns: name server: 192.168.20.245, family: 2, ipv6: 0
[17995] dbg: dns: PTR for '200.34.200.251': ''
[17995] dbg: received-header: parsed as [ ip=200.34.200.251 rdns=
helo=as.itesm.mx by=mail.legosoft.com.mx ident= envfrom= intl=0
id=kB983l49014423 auth= ]
[17995] dbg: received-header: relay 200.34.200.251 trusted? no internal? no
[17995] dbg: received-header: unparseable: from localhost by as.itesm.mx; 09 Dec
2006 02:03:06 -0600
[17995] dbg: metadata: X-Spam-Relays-Trusted:
[17995] dbg: metadata: X-Spam-Relays-Untrusted: [ ip=200.34.200.251 rdns=
helo=as.itesm.mx by=mail.legosoft.com.mx ident= envfrom= intl=0
id=kB983l49014423 auth= ]
[17995] dbg: metadata: X-Spam-Relays-Internal:
[17995] dbg: metadata: X-Spam-Relays-External: [ ip=200.34.200.251 rdns=
helo=as.itesm.mx by=mail.legosoft.com.mx ident= envfrom= intl=0
id=kB983l49014423 auth= ]
...
[17995] dbg: eval: all '*From' addrs: MAILER-DAEMON@as.itesm.mx
[17995] dbg: Botnet: checking baddns
[17995] dbg: Botnet: get_relay didn't find RDNS
[17995] dbg: Botnet: IP is '200.34.200.251'
********** Here it stops for about a minute **********
********** testing the address doesn't take **********
********** longer that 3 sec both ways: **********
********** # time host as.itesm.mx
********** as.itesm.mx has address 200.34.200.251
********** real 2.6
********** # time host 200.34.200.251
********** Host 251.200.34.200.in-addr.arpa not found: 2(SERVFAIL)
********** real 0.2
[17995] dbg: Botnet: RDNS is ''
...
[17995] dbg: Botnet: checking client words
[17995] dbg: Botnet: client words regexp
is(((\b|\d)cable(\b|\d))|((\b|\d)catv(\b|\d))|((\b|\d)ddns(\b|\d))|((\b|\d)dhcp(\b|\d))|((\b|\d)dial-?up(\b|\d))|((\b|\d)dip(\b|\d))|((\b|\d)dsl(\b|\d))|((\b|\d)dynamic(\b|\d))|((\b|\d)modem(\b|\d))|((\b|\d)ppp(\b|\d))|((\b|\d)client(\b|\d))|((\b|\d)fixed(\b|\d))|((\b|\d)pool(\b|\d))|((\b|\d)static(\b|\d))|((\b|\d)user(\b|\d)))\S*\.\S+\.\S+$
[17995] dbg: Botnet: get_relay -1 RDNS
[17995] dbg: Botnet: IP is '200.34.200.251'
[17995] dbg: Botnet: RDNS is ''
[17995] dbg: Botnet: checking server words
[17995] dbg: Botnet: server words regexp
is(((\b|\d)mail(\b|\d))|((\b|\d)smtp(\b|\d))|((\b|\d)mx(\b|\d)))\S*\.\S+\.\S+$
[17995] dbg: Botnet: get_relay -1 RDNS
[17995] dbg: Botnet: IP is '200.34.200.251'
[17995] dbg: Botnet: RDNS is ''
[17995] dbg: Botnet: checking ip in hostname
[17995] dbg: Botnet: get_relay -1 RDNS
[17995] dbg: Botnet: IP is '200.34.200.251'
[17995] dbg: Botnet: RDNS is ''
[17995] dbg: eval: forged-HELO: from= helo=as.itesm.mx by=legosoft.com.mx
[17995] dbg: Botnet: checking nordns
[17995] dbg: Botnet: get_relay -1 RDNS
[17995] dbg: Botnet: IP is '200.34.200.251'
[17995] dbg: Botnet: RDNS is ''
[17995] dbg: Botnet: nordns hit
[17995] dbg: rules: ran eval rule BOTNET_NORDNS ======> got hit
...
I found this problem after seeing 3 messages that caused SA to timeout (from MS
point of view), all 3 messages where DSN returns.
I'll check later, during business hours, if simple read receipts also trigger
this timeout.
--
René Berber
Re: [Bug report] Botnet uses a lot of time with DSN message
Posted by René Berber <r....@computer.org>.
René Berber wrote:
[snip]
> What I don't understand is what is Botnet doing for about 60 to 80 seconds,
> where I pointed out that it stoped. To be clear, I ran the test 3 times and it
> always stopped, so it was no glitch, or temporary problem.
Perhaps it was, I just re-ran the test and it took 14 seconds.
What I think happened is that the other day I had the backup DNS server down,
probably the DNS query used by Botnet tried first that server and after a long
time-out continued with the second DNS server. Now that I have both, everything
works... sorry for the noise, I should have investigated more thoroughly.
--
René Berber
Re: [Bug report] Botnet uses a lot of time with DSN message
Posted by René Berber <r....@computer.org>.
John Rudd wrote:
> René Berber wrote:
>> John Rudd wrote:
>> [snip]
>>> It can be downloaded from:
>>>
>>> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
>>>
>>> As usual, feedback, statistics, bug reports, feature suggestions, are
>>> all welcome.
>> [snip]
>>
>> Botnet 0.6 causes a timeout while MA is running SA on a DSN message.
>>
>
> It looks to me like it's not being caused by a DSN message, it's that
> the IP doesn't have a PTR record, and your mail server has rather slow
> DNS. Do you have a caching DNS server on your mail server, by chance?
Yes, the same server (which is not slow) is the domain master server and cache
DNS for the LAN.
Slow? Didn't you see the running of `host` I included, less than 3 seconds for
manually running both queries looks normal to me.
I agree that the problem seems to be with that specific mail server, which
doesn't have a reverse but with others that don't have it there has been no
problem. And I also checked read receipts to see if the format of the DSN had
anything to do with it, and there was no problem (except that read receipts from
our own users don't go through authentication -- empty sender, I know, but
Botnet hits them hard).
What I don't understand is what is Botnet doing for about 60 to 80 seconds,
where I pointed out that it stoped. To be clear, I ran the test 3 times and it
always stopped, so it was no glitch, or temporary problem.
--
René Berber
Re: Botnet question
Posted by John Rudd <jr...@ucsc.edu>.
Hm. I don't see anything wrong with that domain. I'll look into it.
Carlos Horowicz wrote:
> Hi John,
>
> the IP Address is 64.76.24.252 and the domain is comintec.net , Botnet
> version is 0.6 under SA 3.1.7
>
> THanks,
>
> -Carlos
>
>
> John Rudd wrote:
>
>>
>> I would have to know the IP address of the relay in order to give a
>> meaningful answer. Just the 0 shouldn't have been enough. Though, if
>> one of the octets is 0, and you're using an older version of botnet,
>> it might have matched that one octet twice. That's a bug I'm pretty
>> sure I fixed in 0.6.
>>
>>
>>
>> Carlos Horowicz wrote:
>>
>>> Hi list,
>>>
>>> I came across an e-mail originating at a customer domain hosted in a
>>> dedicated server provided by my company, whose outgoing relay and
>>> incoming MX are the same, namely mx0.<domain>, and that Botnet in my
>>> server tagged with:
>>>
>>> BOTNET=5, BOTNET_CLIENT=0.01, BOTNET_IPINHOSTNAME=0.01
>>>
>>> The only matching rule seems to be coming from botnet_ipinhostname()
>>>
>>> Reverse DNS is OK.
>>>
>>> Could somebody tell what could have triggered the rule ? if the 0
>>> (zero) in the mx0 hostname , or the fact that they use the same
>>> server for incoming or outgoing relay ? or maybe anything else I
>>> should look at ?
>>>
>>> Thank you,
>>>
>>> /Carlos
>>>
>>>
>>> John Rudd wrote:
>>>
>>>> René Berber wrote:
>>>>
>>>>> John Rudd wrote:
>>>>> [snip]
>>>>>
>>>>>> It can be downloaded from:
>>>>>>
>>>>>> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
>>>>>>
>>>>>> As usual, feedback, statistics, bug reports, feature suggestions, are
>>>>>> all welcome.
>>>>>
>>>>>
>>>>> [snip]
>>>>>
>>>>> Botnet 0.6 causes a timeout while MA is running SA on a DSN message.
>>>>>
>>>>
>>>> It looks to me like it's not being caused by a DSN message, it's
>>>> that the IP doesn't have a PTR record, and your mail server has
>>>> rather slow DNS. Do you have a caching DNS server on your mail
>>>> server, by chance?
>>>>
Re: Botnet question
Posted by Carlos Horowicz <ca...@infodrive.com.ar>.
Hi John,
the IP Address is 64.76.24.252 and the domain is comintec.net , Botnet
version is 0.6 under SA 3.1.7
THanks,
-Carlos
John Rudd wrote:
>
> I would have to know the IP address of the relay in order to give a
> meaningful answer. Just the 0 shouldn't have been enough. Though, if
> one of the octets is 0, and you're using an older version of botnet,
> it might have matched that one octet twice. That's a bug I'm pretty
> sure I fixed in 0.6.
>
>
>
> Carlos Horowicz wrote:
>
>> Hi list,
>>
>> I came across an e-mail originating at a customer domain hosted in a
>> dedicated server provided by my company, whose outgoing relay and
>> incoming MX are the same, namely mx0.<domain>, and that Botnet in my
>> server tagged with:
>>
>> BOTNET=5, BOTNET_CLIENT=0.01, BOTNET_IPINHOSTNAME=0.01
>>
>> The only matching rule seems to be coming from botnet_ipinhostname()
>>
>> Reverse DNS is OK.
>>
>> Could somebody tell what could have triggered the rule ? if the 0
>> (zero) in the mx0 hostname , or the fact that they use the same
>> server for incoming or outgoing relay ? or maybe anything else I
>> should look at ?
>>
>> Thank you,
>>
>> /Carlos
>>
>>
>> John Rudd wrote:
>>
>>> René Berber wrote:
>>>
>>>> John Rudd wrote:
>>>> [snip]
>>>>
>>>>> It can be downloaded from:
>>>>>
>>>>> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
>>>>>
>>>>> As usual, feedback, statistics, bug reports, feature suggestions, are
>>>>> all welcome.
>>>>
>>>>
>>>> [snip]
>>>>
>>>> Botnet 0.6 causes a timeout while MA is running SA on a DSN message.
>>>>
>>>
>>> It looks to me like it's not being caused by a DSN message, it's
>>> that the IP doesn't have a PTR record, and your mail server has
>>> rather slow DNS. Do you have a caching DNS server on your mail
>>> server, by chance?
>>>
Re: Botnet question
Posted by John Rudd <jr...@ucsc.edu>.
I would have to know the IP address of the relay in order to give a
meaningful answer. Just the 0 shouldn't have been enough. Though, if
one of the octets is 0, and you're using an older version of botnet, it
might have matched that one octet twice. That's a bug I'm pretty sure I
fixed in 0.6.
Carlos Horowicz wrote:
> Hi list,
>
> I came across an e-mail originating at a customer domain hosted in a
> dedicated server provided by my company, whose outgoing relay and
> incoming MX are the same, namely mx0.<domain>, and that Botnet in my
> server tagged with:
>
> BOTNET=5, BOTNET_CLIENT=0.01, BOTNET_IPINHOSTNAME=0.01
>
> The only matching rule seems to be coming from botnet_ipinhostname()
>
> Reverse DNS is OK.
>
> Could somebody tell what could have triggered the rule ? if the 0 (zero)
> in the mx0 hostname , or the fact that they use the same server for
> incoming or outgoing relay ? or maybe anything else I should look at ?
>
> Thank you,
>
> /Carlos
>
>
> John Rudd wrote:
>
>> René Berber wrote:
>>
>>> John Rudd wrote:
>>> [snip]
>>>
>>>> It can be downloaded from:
>>>>
>>>> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
>>>>
>>>> As usual, feedback, statistics, bug reports, feature suggestions, are
>>>> all welcome.
>>>
>>> [snip]
>>>
>>> Botnet 0.6 causes a timeout while MA is running SA on a DSN message.
>>>
>>
>> It looks to me like it's not being caused by a DSN message, it's that
>> the IP doesn't have a PTR record, and your mail server has rather slow
>> DNS. Do you have a caching DNS server on your mail server, by chance?
>>
Botnet question
Posted by Carlos Horowicz <ca...@infodrive.com.ar>.
Hi list,
I came across an e-mail originating at a customer domain hosted in a
dedicated server provided by my company, whose outgoing relay and
incoming MX are the same, namely mx0.<domain>, and that Botnet in my
server tagged with:
BOTNET=5, BOTNET_CLIENT=0.01, BOTNET_IPINHOSTNAME=0.01
The only matching rule seems to be coming from botnet_ipinhostname()
Reverse DNS is OK.
Could somebody tell what could have triggered the rule ? if the 0 (zero)
in the mx0 hostname , or the fact that they use the same server for
incoming or outgoing relay ? or maybe anything else I should look at ?
Thank you,
/Carlos
John Rudd wrote:
> René Berber wrote:
>
>> John Rudd wrote:
>> [snip]
>>
>>> It can be downloaded from:
>>>
>>> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
>>>
>>> As usual, feedback, statistics, bug reports, feature suggestions, are
>>> all welcome.
>>
>> [snip]
>>
>> Botnet 0.6 causes a timeout while MA is running SA on a DSN message.
>>
>
> It looks to me like it's not being caused by a DSN message, it's that
> the IP doesn't have a PTR record, and your mail server has rather slow
> DNS. Do you have a caching DNS server on your mail server, by chance?
>
Re: [Bug report] Botnet uses a lot of time with DSN message
Posted by John Rudd <jr...@ucsc.edu>.
René Berber wrote:
> John Rudd wrote:
> [snip]
>> It can be downloaded from:
>>
>> http://people.ucsc.edu/~jrudd/spamassassin/Botnet.tar
>>
>> As usual, feedback, statistics, bug reports, feature suggestions, are
>> all welcome.
> [snip]
>
> Botnet 0.6 causes a timeout while MA is running SA on a DSN message.
>
It looks to me like it's not being caused by a DSN message, it's that
the IP doesn't have a PTR record, and your mail server has rather slow
DNS. Do you have a caching DNS server on your mail server, by chance?