Attachment #4652 for bug #6295

View | Details | Raw Unified | Return to bug 6295
Collapse All | Expand All




meta     __VIA_ML  __ML1 || __ML2 || __ML3 || __ML4 || __ML5
describe __VIA_ML  Mail from a mailing list


# Bug #6295 - RCVD_ILLEGAL_IP should not be eval rule
#
# (note this might miss some hits if the Received.pm skips any invalid IPs)
# do we really want to chase the more recent IANA allocations?
# check: http://www.iana.org/assignments/ipv4-address-space/
header RCVD_ILLEGAL_IP		X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?:[057]|22[4-9]|2[3-9]\d|[12]\d{3,}|[3-9]\d\d+)\.\d+\.\d+\.\d+ /
describe RCVD_ILLEGAL_IP	Received: contains illegal IP address


###########################################################################

ifplugin Mail::SpamAssassin::Plugin::HeaderEval

header RCVD_NUMERIC_HELO	eval:check_for_numeric_helo()
describe RCVD_NUMERIC_HELO	Received: contains an IP address used for HELO

header RCVD_ILLEGAL_IP		eval:check_for_illegal_ip()
describe RCVD_ILLEGAL_IP	Received: contains illegal IP address

# not used directly right now due to FPs; but CONFIRMED_FORGED turns it
# into a 1.0 S/O rule anyway, so that's not a problem ;)
# 2.626   3.6340   1.5251    0.704   0.34    1.44  FORGED_RCVD_TRAIL





  # the important bit!
  $self->register_eval_rule("check_for_numeric_helo");
  $self->register_eval_rule("check_for_illegal_ip");
  $self->register_eval_rule("check_all_trusted");
  $self->register_eval_rule("check_no_relays");
  $self->register_eval_rule("check_relays_unparseable");

  }
}

sub _helo_forgery_whitelisted {
  my ($helo, $rdns) = @_;
  if ($helo eq 'msn.com' && $rdns eq 'hotmail.com') { return 1; }
  0;

  return 0;
}

sub check_for_illegal_ip {
  my ($self, $pms) = @_;

  foreach my $rcvd ( @{$pms->{relays_untrusted}} ) {
    # (note this might miss some hits if the Received.pm skips any invalid IPs)
    # do we really want to chase the more recent IANA allocations?
    # check: http://www.iana.org/assignments/ipv4-address-space/
    foreach my $check ( $rcvd->{ip}, $rcvd->{by} ) {
      return 1 if ($check =~ /^
	(?:[0157]|22[4-9]|2[3-9]\d|[12]\d{3,}|[3-9]\d\d+) \.\d+\.\d+\.\d+
	$/x);
    }
  }
  return 0;
}

sub sent_by_applemail {
  my ($self, $pms) = @_;

  return 0 unless ($pms->get("MIME-Version") =~ /Apple Message framework/);
  return 0 unless ($pms->get("X-Mailer") =~ /^Apple Mail \(\d+\.\d+\)/);
  return 0 unless ($pms->get("Message-Id") =~
		   /^<[A-F0-9]+(?:-[A-F0-9]+){4}\@\S+.\S+>$/);
  return 1;
}

# note using IPv4 addresses for now due to empty strings matching IP_ADDRESS
# due to bug in pure IPv6 address regular expression
sub helo_ip_mismatch {

    my $prev = $from[$i-1];
    if (defined($prev) && $i > 0
		&& $prev =~ /^\w+(?:[\w.-]+\.)+\w+$/
		&& $by ne $prev && !_helo_forgery_whitelisted($by, $prev))
    {
      dbg2("eval: forged-HELO: mismatch on from: '$prev' != '$by'");
      $pms->{mismatch_from}++;

Return to bug 6295

Lines 414-419 Link Here

(-)rules/20_head_tests.cf (-3 / +10 lines)
414	meta __VIA_ML __ML1 \|\| __ML2 \|\| __ML3 \|\| __ML4 \|\| __ML5	414	meta __VIA_ML __ML1 \|\| __ML2 \|\| __ML3 \|\| __ML4 \|\| __ML5
415	describe __VIA_ML Mail from a mailing list	415	describe __VIA_ML Mail from a mailing list
416		416
		417
		418	# Bug #6295 - RCVD_ILLEGAL_IP should not be eval rule
		419	#
		420	# (note this might miss some hits if the Received.pm skips any invalid IPs)
		421	# do we really want to chase the more recent IANA allocations?
		422	# check: http://www.iana.org/assignments/ipv4-address-space/
		423	header RCVD_ILLEGAL_IP X-Spam-Relays-Untrusted =~ / (?:by\|ip)=(?:[057]\|22[4-9]\|2[3-9]\d\|[12]\d{3,}\|[3-9]\d\d+)\.\d+\.\d+\.\d+ /
		424	describe RCVD_ILLEGAL_IP Received: contains illegal IP address
		425
		426
417	###########################################################################	427	###########################################################################
418		428
419	ifplugin Mail::SpamAssassin::Plugin::HeaderEval	429	ifplugin Mail::SpamAssassin::Plugin::HeaderEval
Lines 552-560 Link Here
552	header RCVD_NUMERIC_HELO eval:check_for_numeric_helo()	562	header RCVD_NUMERIC_HELO eval:check_for_numeric_helo()
553	describe RCVD_NUMERIC_HELO Received: contains an IP address used for HELO	563	describe RCVD_NUMERIC_HELO Received: contains an IP address used for HELO
554		564
555	header RCVD_ILLEGAL_IP eval:check_for_illegal_ip()
556	describe RCVD_ILLEGAL_IP Received: contains illegal IP address
557
558	# not used directly right now due to FPs; but CONFIRMED_FORGED turns it	565	# not used directly right now due to FPs; but CONFIRMED_FORGED turns it
559	# into a 1.0 S/O rule anyway, so that's not a problem ;)	566	# into a 1.0 S/O rule anyway, so that's not a problem ;)
560	# 2.626 3.6340 1.5251 0.704 0.34 1.44 FORGED_RCVD_TRAIL	567	# 2.626 3.6340 1.5251 0.704 0.34 1.44 FORGED_RCVD_TRAIL

Lines 41-47 Link Here

(-)lib/Mail/SpamAssassin/Plugin/RelayEval.pm (-29 / +2 lines)
41		41
42	# the important bit!	42	# the important bit!
43	$self->register_eval_rule("check_for_numeric_helo");	43	$self->register_eval_rule("check_for_numeric_helo");
44	$self->register_eval_rule("check_for_illegal_ip");
45	$self->register_eval_rule("check_all_trusted");	44	$self->register_eval_rule("check_all_trusted");
46	$self->register_eval_rule("check_no_relays");	45	$self->register_eval_rule("check_no_relays");
47	$self->register_eval_rule("check_relays_unparseable");	46	$self->register_eval_rule("check_relays_unparseable");
Lines 73-79 Link Here
73	}	72	}
74	}	73	}
75		74
76	sub helo_forgery_whitelisted {	75	sub _helo_forgery_whitelisted {
77	my ($helo, $rdns) = @_;	76	my ($helo, $rdns) = @_;
78	if ($helo eq 'msn.com' && $rdns eq 'hotmail.com') { return 1; }	77	if ($helo eq 'msn.com' && $rdns eq 'hotmail.com') { return 1; }
79	0;	78	0;
Lines 96-127 Link Here
96	return 0;	95	return 0;
97	}	96	}
98		97
99	sub check_for_illegal_ip {
100	my ($self, $pms) = @_;
101
102	foreach my $rcvd ( @{$pms->{relays_untrusted}} ) {
103	# (note this might miss some hits if the Received.pm skips any invalid IPs)
104	# do we really want to chase the more recent IANA allocations?
105	# check: http://www.iana.org/assignments/ipv4-address-space/
106	foreach my $check ( $rcvd->{ip}, $rcvd->{by} ) {
107	return 1 if ($check =~ /^
108	(?:[0157]\|22[4-9]\|2[3-9]\d\|[12]\d{3,}\|[3-9]\d\d+) \.\d+\.\d+\.\d+
109	$/x);
110	}
111	}
112	return 0;
113	}
114
115	sub sent_by_applemail {
116	my ($self, $pms) = @_;
117
118	return 0 unless ($pms->get("MIME-Version") =~ /Apple Message framework/);
119	return 0 unless ($pms->get("X-Mailer") =~ /^Apple Mail \(\d+\.\d+\)/);
120	return 0 unless ($pms->get("Message-Id") =~
121	/^<[A-F0-9]+(?:-[A-F0-9]+){4}\@\S+.\S+>$/);
122	return 1;
123	}
124
125	# note using IPv4 addresses for now due to empty strings matching IP_ADDRESS	98	# note using IPv4 addresses for now due to empty strings matching IP_ADDRESS
126	# due to bug in pure IPv6 address regular expression	99	# due to bug in pure IPv6 address regular expression
127	sub helo_ip_mismatch {	100	sub helo_ip_mismatch {
Lines 375-381 Link Here
375	my $prev = $from[$i-1];	348	my $prev = $from[$i-1];
376	if (defined($prev) && $i > 0	349	if (defined($prev) && $i > 0
377	&& $prev =~ /^\w+(?:[\w.-]+\.)+\w+$/	350	&& $prev =~ /^\w+(?:[\w.-]+\.)+\w+$/
378	&& $by ne $prev && !helo_forgery_whitelisted($by, $prev))	351	&& $by ne $prev && !_helo_forgery_whitelisted($by, $prev))
379	{	352	{
380	dbg2("eval: forged-HELO: mismatch on from: '$prev' != '$by'");	353	dbg2("eval: forged-HELO: mismatch on from: '$prev' != '$by'");
381	$pms->{mismatch_from}++;	354	$pms->{mismatch_from}++;