You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@spamassassin.apache.org by bu...@bugzilla.spamassassin.org on 2015/03/16 16:24:21 UTC
[Bug 7156] New: new_dns_packet (domain=something type=A class=IN)
failed: a domain name contains a null label
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
Bug ID: 7156
Summary: new_dns_packet (domain=something type=A class=IN)
failed: a domain name contains a null label
Product: Spamassassin
Version: 3.4.0
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: spamassassin
Assignee: dev@spamassassin.apache.org
Reporter: per@computer.org
After a recent upgrade to 3.4.0, I see this message quite frequently, and
almost certain always incorrectly, see log data and emails attached.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #3 from Per Jessen <pe...@computer.org> ---
Created attachment 5286
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5286&action=edit
an email that produced the error
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
Per Jessen <pe...@computer.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |per@computer.org
--- Comment #1 from Per Jessen <pe...@computer.org> ---
Created attachment 5284
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5284&action=edit
log lines containing new_dns_packet
A grep through the mail log looking for 'new_dns_packet'. I have not checked
each individual line, but a quick glance suggests the domains are certainly not
from spammers.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
Gerald Turner <gt...@unzane.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |gturner@unzane.com
--- Comment #26 from Gerald Turner <gt...@unzane.com> ---
On April 26th I upgraded SpamAssassin from 3.3.2 to 3.4.0 (Debian wheezy to
jessie upgrade). My mailserver processes about 1000 emails per day. This
error did not exist until May 27, and now I receive about two every day. This
makes me think the new error may have been triggered by saupdate.
Example 1:
http://news.gmane.org/find-root.php?message_id=20150526173040.54227agdaxfauco4@webmail.alunos.dcc.fc.up.pt
May 26 14:23:05 azathoth spamd[22215]: spamd: processing message
<20...@webmail.alunos.dcc.fc.up.pt> for gturner:1000
May 26 14:23:05 azathoth spamd[22215]: dns: new_dns_packet (domain=...il.com.
type=A class=IN) failed: a domain name contains a null label
May 26 14:23:05 azathoth spamd[22215]: dns: new_dns_packet
(domain=...nos.dcc.fc.up.pt. type=A class=IN) failed: a domain name contains a
null label
May 26 14:23:06 azathoth spamd[22215]: spamd: clean message (-4.2/3.0) for
gturner:1000 in 2.2 seconds, 4707 bytes.
May 26 14:23:06 azathoth spamd[22215]: spamd: result: . -4 -
BAYES_00,HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,SPF_PASS
scantime=2.2,size=4707,user=gturner,uid=1000,required_score=3.0,rhost=localhost,raddr=::1,rport=38815,mid=<20150526173040.54227agdaxfau
Attribution was elided, presumably to hide complete email addresses, looks
like a feature of Horde IMP:
2015-05-26 14:59:46 +0100, stephane.chazelas@...il.com:
> 2015-05-26 12:47:47 +0200, up201407890@...nos.dcc.fc.up.pt:
> [...]
Example 2:
http://news.gmane.org/find-root.php?message_id=5565CAA1.9070409@redpinesignals.com
May 27 06:53:03 azathoth spamd[2386]: spamd: processing message
<55...@redpinesignals.com> for gturner:1000
May 27 06:53:03 azathoth postfix/smtpd[3053]: disconnect from
lists.xen.org[50.57.142.19]
May 27 06:53:03 azathoth spamd[2386]: dns: new_dns_packet (domain=...!..net.
type=A class=IN) failed: a domain name contains a null label
May 27 06:53:07 azathoth spamd[2386]: spamd: clean message (-2.0/3.0) for
gturner:1000 in 4.2 seconds, 68825 bytes.
May 27 06:53:07 azathoth spamd[2386]: spamd: result: . -2 -
BAYES_00,HEADER_FROM_DIFFERENT_DOMAINS,LOCAL_NEGATE_DNSWL_HI,RCVD_IN_DNSWL_HI,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL,T_RP_MATCHES_RCVD
scantime=4.2,size=68825,user=gturner,uid=1000,required_score=3.0,rhost=localhost,raddr=::1,rport=49848,mid=<55...@redpinesignals.com>,bayes=0.000000,autolearn=no
autolearn_force=no,shortcircuit=no
This message, as well as each reply, contains a Linux kernel kmalloc crash
dump containing a line like:
Object 0xc2f407c0: f1 ef 57 49 59 70 40 87 11 10 21 00 0d 4e 45 54
ñïWIYp@...!..NET
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #15 from Kevin A. McGrail <km...@pccc.com> ---
(In reply to AXB from comment #13)
> (In reply to RW from comment #12)
> > I looked at the some of attachments and couldn't see a ".." anywhere.
>
> exactly
>
> my weekly masscheck log spit out
>
> dns: new_dns_packet (domain=gallery.mailchimp..com. type=A class=IN) failed:
> a domain name contains a null label
> dns: new_dns_packet (domain=www.treatunhealthyconditions..com. type=A
> class=IN) failed: a domain name contains a null label
>
> but none of the msgs had a ".."
Interesting! Perhaps a DNS lookup chain from something else? A cname or
something? I tried the first email with svn trunk, spamassassin -D -t < /tmp/5
2>&1 | grep -i null and got nothing.
Anyone able to reproduce with these samples?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #4 from Per Jessen <pe...@computer.org> ---
Created attachment 5287
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5287&action=edit
an email that produced the error
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #21 from Per Jessen <pe...@computer.org> ---
Okay, I was able to reproduce using a simple spamc mockup calling my spamd
setup. It's been pounding spamd with the same four emails most of the day,
maybe 8-9 hours, and has produced one example.
I can easily isolate this backend and run spamd with debugging on, without any
real mails going through. Will running it with '-Ddns' suffice?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
David L. Crow <cr...@OrangeBlood.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |crow@OrangeBlood.org
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #7 from AXB <ax...@gmail.com> ---
(In reply to Kevin A. McGrail from comment #6)
> So do we have consensus that if we have something ending in a .TLD from
> registrar boundaries and containing a .. (i.e. null entry), let's turn the
> multiple dots into 1 dot on the fly for URIs?
I think we should try to find the source of this issue. Either parser or some
DNS lib... I also see happening on every weekly masscheck run.
Now we have samples to debug it would nice if somebody with all the perl foo
could try to find the cause...
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
AXB <ax...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |axb.lists@gmail.com
--- Comment #5 from AXB <ax...@gmail.com> ---
*** Bug 7104 has been marked as a duplicate of this bug. ***
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
AXB <ax...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |Mark.Martinec@ijs.si
--- Comment #11 from AXB <ax...@gmail.com> ---
I'd like to hear Mark's opinion... assuming this also affects his AskDNS
plugin's behaviour
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #28 from Gerald Turner <gt...@unzane.com> ---
Created attachment 5305
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5305&action=edit
Comment 26, Example 2
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #30 from Gerald Turner <gt...@unzane.com> ---
(In reply to Mark Martinec from comment #29)
> (In reply to Gerald Turner from comment #26)
> > On April 26th I upgraded SpamAssassin from 3.3.2 to 3.4.0 (Debian wheezy to
> > jessie upgrade). My mailserver processes about 1000 emails per day. This
> > error did not exist until May 27, and now I receive about two every day.
> > This makes me think the new error may have been triggered by saupdate.
>
> > spamd[22215]: dns: new_dns_packet
> > (domain=...il.com. type=A class=IN) failed:
> > a domain name contains a null label
>
> This warning was added some time between 3.3.2 to 3.4.0. It does
> not indicate an error, it's just a reminder that an URL found in
> a message contained such invalid domain name.
>
> The warning was intentionally left in the DNS code to remind
> us that it is probably up to the URL-gathering code do decide
> what to do with such invalid domains (e.g. sanitize them or
> ignore), so that such domain names won't reach DNS resolver
> code any longer.
I understand it's a warning, and it may be used to improve the URIBL code to
avoid querying DNS with bogus domains, so with that in mind, I'm reporting a
new and subtly different error:
spamd[31180]: dns: new_dns_packet
(domain=ll-state-dept-asks-it-to-figure-out-ways-to-stop-bad-people-using-tor.sh.multi.surbl.org.
type=A class=IN) failed: a label in a domain name is longer than 63 bytes
This was triggered by a plain text email from a mailing list that had a long
URL broken up on several lines, e.g.:
http://some.news.site/with-a-very-very-very-long-
url-containing-more-than-36-bytes-on-one-of-the.li
nes
BTW, I use "logcheck" on my mail server which runs every hour, detects any
unusual syslog messages that haven't been whitelisted in it's catalog of regexp
patterns, and reports them via email. While I do have SpamAssassin's
"shortcircuit ALL_TRUSTED on" configured, the URIBL still seems to scan these
internal logcheck emails. Therefore when something new like this happens,
where each logcheck email also triggers a new message from SpamAssassin, I get
an infinite loop of hourly emails until I "fix" yet another logcheck whitelist
regex. Crazy sysadmin reactive busy work ;-)
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@spamassassin.apache.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
Henrik Krohns <ap...@hege.li> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |apache@hege.li
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #33 from Henrik Krohns <ap...@hege.li> ---
Part of this update.
Sending spamassassin-3.4/UPGRADE
Sending spamassassin-3.4/lib/Mail/SpamAssassin/DnsResolver.pm
Sending spamassassin-3.4/lib/Mail/SpamAssassin/PerMsgStatus.pm
Sending spamassassin-3.4/lib/Mail/SpamAssassin/RegistryBoundaries.pm
Sending spamassassin-3.4/lib/Mail/SpamAssassin/Util.pm
Sending spamassassin-3.4/t/uri.t
Sending spamassassin-3.4/t/uri_text.t
Sending trunk/UPGRADE
Sending trunk/lib/Mail/SpamAssassin/DnsResolver.pm
Sending trunk/lib/Mail/SpamAssassin/PerMsgStatus.pm
Sending trunk/lib/Mail/SpamAssassin/Plugin/URIDNSBL.pm
Sending trunk/lib/Mail/SpamAssassin/RegistryBoundaries.pm
Sending trunk/lib/Mail/SpamAssassin/Util.pm
Sending trunk/t/uri.t
Sending trunk/t/uri_text.t
Transmitting file data ...............done
Committing transaction...
Committed revision 1864336.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #10 from Kevin A. McGrail <km...@pccc.com> ---
(In reply to Joe Quinn from comment #9)
> Invalidating the URI causes its own issues. Suppose a spammer figured this
> out and started sending emails linking to badwebsiteofyourchoice..com
>
> We'd either miss it entirely, or test against "com" which is obviously not a
> domain we can blacklist.
>
> We need to collapse dots for sure.
OK, what about if I write make sure you download those files...microsoft.com.
Do I mean an ellipses (...)? Something to watch for.
Regards,
KAM
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #29 from Mark Martinec <Ma...@ijs.si> ---
(In reply to Gerald Turner from comment #26)
> On April 26th I upgraded SpamAssassin from 3.3.2 to 3.4.0 (Debian wheezy to
> jessie upgrade). My mailserver processes about 1000 emails per day. This
> error did not exist until May 27, and now I receive about two every day.
> This makes me think the new error may have been triggered by saupdate.
> spamd[22215]: dns: new_dns_packet
> (domain=...il.com. type=A class=IN) failed:
> a domain name contains a null label
This warning was added some time between 3.3.2 to 3.4.0. It does
not indicate an error, it's just a reminder that an URL found in
a message contained such invalid domain name.
The warning was intentionally left in the DNS code to remind
us that it is probably up to the URL-gathering code do decide
what to do with such invalid domains (e.g. sanitize them or
ignore), so that such domain names won't reach DNS resolver
code any longer.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #22 from Kevin A. McGrail <km...@pccc.com> ---
(In reply to Per Jessen from comment #21)
> Okay, I was able to reproduce using a simple spamc mockup calling my spamd
> setup. It's been pounding spamd with the same four emails most of the day,
> maybe 8-9 hours, and has produced one example.
> I can easily isolate this backend and run spamd with debugging on, without
> any real mails going through. Will running it with '-Ddns' suffice?
Interesting. So with a sample you have produced the error once with MANY times
running through the same few email?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
Kevin A. McGrail <km...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |kmcgrail@pccc.com
--- Comment #6 from Kevin A. McGrail <km...@pccc.com> ---
So do we have consensus that if we have something ending in a .TLD from
registrar boundaries and containing a .. (i.e. null entry), let's turn the
multiple dots into 1 dot on the fly for URIs?
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #14 from Mark Martinec <Ma...@ijs.si> ---
These three samples do not produce a 'dns: new_dns_packet' warning here,
although I do have a few other samples that do. In these the dots are
indeed there (if I remember correctly, some were a result of incorrect
QP encoding, need to check again). Seemed to me that these errors in
URL were a result of some mail composition sw bug, not an intentional
obfuscation.
I don't have much of an opinion on what to do about these, apart that
whatever is decided should be a part of URI parsing/cleaning code,
rather than a hack in DNS querying code (which noone is suggesting,
just wanted be mention such possibility).
Probably depends on whether some browser can make use of such URL.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #27 from Gerald Turner <gt...@unzane.com> ---
Created attachment 5304
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5304&action=edit
Comment 26, Example 1
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #2 from Per Jessen <pe...@computer.org> ---
Created attachment 5285
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5285&action=edit
an email that produced the error
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #8 from Kevin A. McGrail <km...@pccc.com> ---
(In reply to AXB from comment #7)
> (In reply to Kevin A. McGrail from comment #6)
> > So do we have consensus that if we have something ending in a .TLD from
> > registrar boundaries and containing a .. (i.e. null entry), let's turn the
> > multiple dots into 1 dot on the fly for URIs?
>
> I think we should try to find the source of this issue. Either parser or
> some DNS lib... I also see happening on every weekly masscheck run.
> Now we have samples to debug it would nice if somebody with all the perl foo
> could try to find the cause...
I believe the cause is thus:
i.am.a.subdomain..microsoft.com
That .. has a very clear, easy to see NULL entry in between the two dots...
So we need to either: not do lookups on URIs with .. or we need to massage
them.
My recommendation is to reduce multiple dots to one dot for anything that ends
in a TLD.
Or we could just invalidate the URI as not being usable from more than one dot.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #16 from AXB <ax...@gmail.com> ---
(In reply to Mark Martinec from comment #14)
> These three samples do not produce a 'dns: new_dns_packet' warning here,
> although I do have a few other samples that do. In these the dots are
> indeed there (if I remember correctly, some were a result of incorrect
> QP encoding, need to check again). Seemed to me that these errors in
> URL were a result of some mail composition sw bug, not an intentional
> obfuscation.
>
> I don't have much of an opinion on what to do about these, apart that
> whatever is decided should be a part of URI parsing/cleaning code,
> rather than a hack in DNS querying code (which noone is suggesting,
> just wanted be mention such possibility).
I didn't suggest it hoping you'd find something... .-)
> Probably depends on whether some browser can make use of such URL.
In the samples I've seen, the URLs are perfectly ok
the samples Per submitted are perfectly clickable
<<GRMBL>>
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #25 from Per Jessen <pe...@computer.org> ---
(In reply to Kevin A. McGrail from comment #24)
> For me, this sounds more like a DNS or network issue perhaps creeping in.
> It's odd that we can't reproduce it repeatedly but appreciate your efforts
> and look forward to seeing the logs!
I haven't been running the stress test continually, but on the system under
test I have not seen any of these messages since 2015/03/17 - another three
systems show 2-3 since midnight today. Weird.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
Joe Quinn <jq...@pccc.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jquinn+SAbug@pccc.com
--- Comment #9 from Joe Quinn <jq...@pccc.com> ---
Invalidating the URI causes its own issues. Suppose a spammer figured this out
and started sending emails linking to badwebsiteofyourchoice..com
We'd either miss it entirely, or test against "com" which is obviously not a
domain we can blacklist.
We need to collapse dots for sure.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #23 from Per Jessen <pe...@computer.org> ---
(In reply to Kevin A. McGrail from comment #22)
> (In reply to Per Jessen from comment #21)
> > Okay, I was able to reproduce using a simple spamc mockup calling my spamd
> > setup. It's been pounding spamd with the same four emails most of the day,
> > maybe 8-9 hours, and has produced one example.
> > I can easily isolate this backend and run spamd with debugging on, without
> > any real mails going through. Will running it with '-Ddns' suffice?
>
> Interesting. So with a sample you have produced the error once with MANY
> times running through the same few email?
I didn't count them :-)
With an estimated 10sec per mail and 8 hours runtime, I get 2880 runs. Seen
relative to a total of 29 hits across four backends since midnight CET, not
much.
I'm running the same thing now, with -Ddns enabled.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #24 from Kevin A. McGrail <km...@pccc.com> ---
For me, this sounds more like a DNS or network issue perhaps creeping in. It's
odd that we can't reproduce it repeatedly but appreciate your efforts and look
forward to seeing the logs!
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
RW <rw...@googlemail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |rwmaillists@googlemail.com
--- Comment #12 from RW <rw...@googlemail.com> ---
I looked at the some of attachments and couldn't see a ".." anywhere.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #17 from Mark Martinec <Ma...@ijs.si> ---
So it seems that none of us could find a domain with a null label
in provided samples (I even tried with a fresh 3.4.0 install).
I suggest Per tries to feed these (or other) samples through
a command-line 'spamassassin -D dns' and if the warning is indeed
produced, the debug output (and a message) can be attached here.
I suspect that the three attached samples are not those that
contributed to the attached grepped log.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #31 from Gerald Turner <gt...@unzane.com> ---
Created attachment 5401
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5401&action=edit
Comment 30 example email
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #20 from AXB <ax...@gmail.com> ---
(In reply to Per Jessen from comment #19)
> (In reply to Per Jessen from comment #18)
> > (In reply to Mark Martinec from comment #17)
> > > So it seems that none of us could find a domain with a null label
> > > in provided samples (I even tried with a fresh 3.4.0 install).
> > > I suggest Per tries to feed these (or other) samples through
> > > a command-line 'spamassassin -D dns' and if the warning is indeed
> > > produced, the debug output (and a message) can be attached here.
> >
> > I have already tried that, it did not produce the expected warnings/errors.
> > I'll have to try with the spamc/spamd combination too.
>
> Well, the first few tries did not reproduce the problem. I'm leaving a test
> running for the next few hours. This might very well be down to a bug in my
> local setup that was exposed by the upgrade to 3.4.0.
I don't think this is related to a local setup. I see these null label guys
every day but can't save local copies of production traffic
Mar 17 05:16:06 box06 spamd[7847]: dns: new_dns_packet (domain=bnpparibas..com.
type=A class=IN) failed: a domain name contains a null label
What OS /perl/Net:DNS versions are you using?
I've reduced my masscheck corpus size as well as adding verbose logging to be
able to find sample msgs on next Saturday's weekly net masscheck.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #13 from AXB <ax...@gmail.com> ---
(In reply to RW from comment #12)
> I looked at the some of attachments and couldn't see a ".." anywhere.
exactly
my weekly masscheck log spit out
dns: new_dns_packet (domain=gallery.mailchimp..com. type=A class=IN) failed: a
domain name contains a null label
dns: new_dns_packet (domain=www.treatunhealthyconditions..com. type=A class=IN)
failed: a domain name contains a null label
but none of the msgs had a ".."
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #18 from Per Jessen <pe...@computer.org> ---
(In reply to Mark Martinec from comment #17)
> So it seems that none of us could find a domain with a null label
> in provided samples (I even tried with a fresh 3.4.0 install).
> I suggest Per tries to feed these (or other) samples through
> a command-line 'spamassassin -D dns' and if the warning is indeed
> produced, the debug output (and a message) can be attached here.
I have already tried that, it did not produce the expected warnings/errors.
I'll have to try with the spamc/spamd combination too.
> I suspect that the three attached samples are not those that
> contributed to the attached grepped log.
They're not, they're appeared later, but they produced the same style
log-entries.
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
Reindl Harald <h....@thelounge.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |h.reindl@thelounge.net
--- Comment #32 from Reindl Harald <h....@thelounge.net> ---
> OK, what about if I write make sure you download
> those files...microsoft.com.
>
> Do I mean an ellipses (...)? Something to watch for
i think that's not the point - the question is does a DNS request happen with
"files...microsoft.com." and when yes normalize it before send the DNS query
itself OR skip it entirely
i would prefer normalize it an look for "files...microsoft.com" because of the
simple reason that MUA's randomly make things clickable and when then a error
in the browser appears the user might realize the multiple, dots, fix it and
press enter which probably is the expected behavior of the spammer to work
around URIBL with no cost
what bad should happen with the DNS request for "files.microsoft.com." - it's
either a NXDOMAIN or when it is listed then well, caught for some reason
--
You are receiving this mail because:
You are the assignee for the bug.
[Bug 7156] new_dns_packet (domain=something type=A class=IN) failed:
a domain name contains a null label
Posted by bu...@bugzilla.spamassassin.org.
https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7156
--- Comment #19 from Per Jessen <pe...@computer.org> ---
(In reply to Per Jessen from comment #18)
> (In reply to Mark Martinec from comment #17)
> > So it seems that none of us could find a domain with a null label
> > in provided samples (I even tried with a fresh 3.4.0 install).
> > I suggest Per tries to feed these (or other) samples through
> > a command-line 'spamassassin -D dns' and if the warning is indeed
> > produced, the debug output (and a message) can be attached here.
>
> I have already tried that, it did not produce the expected warnings/errors.
> I'll have to try with the spamc/spamd combination too.
Well, the first few tries did not reproduce the problem. I'm leaving a test
running for the next few hours. This might very well be down to a bug in my
local setup that was exposed by the upgrade to 3.4.0.
--
You are receiving this mail because:
You are the assignee for the bug.