commit 5f5a126: [Fix] Prevent DNSWL sabotage
Marc Dierksen
m.dierksen at netcon-consulting.com
Thu Oct 5 19:07:03 UTC 2023
Author: Marc Dierksen
Date: 2023-10-05 19:05:36 +0200
URL: https://github.com/rspamd/rspamd/commit/5f5a126a4ec179e91eda61aaaa219ba5ebb553eb (refs/pull/4627/head)
[Fix] Prevent DNSWL sabotage
When exceeding the query limit for DNSWL it can happen that instead
of the returncode 127.0.0.255, that according to documentation
(https://www.dnswl.org/?page_id=15) indicates a block, the
returncode 127.0.10.3 is returned for all queries.
According to documentation (https://www.dnswl.org/?page_id=15) the
127.0.10.3 returncode indicates the highest level of trustworthiness
that should never be blocked and a category of 'some special cases'.
As it turns out that documentation is a lie and that 127.0.10.3
returncode is used by DNSWL to intentionally sabotage email security
by marking all sending servers as highly trustworthy
(https://www.dnswl.org/?p=120).
---
conf/modules.d/rbl.conf | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/conf/modules.d/rbl.conf b/conf/modules.d/rbl.conf
index e3ece5a66..c1ef6afaa 100644
--- a/conf/modules.d/rbl.conf
+++ b/conf/modules.d/rbl.conf
@@ -110,11 +110,11 @@ rbl {
whitelist_exception = "RCVD_IN_DNSWL_LOW";
whitelist_exception = "DNSWL_BLOCKED";
returncodes {
- RCVD_IN_DNSWL_NONE = "127.0.%d+.0";
- RCVD_IN_DNSWL_LOW = "127.0.%d+.1";
- RCVD_IN_DNSWL_MED = "127.0.%d+.2";
- RCVD_IN_DNSWL_HI = "127.0.%d+.3";
- DNSWL_BLOCKED = "127.0.0.255";
+ RCVD_IN_DNSWL_NONE = ["127%.0%.%d%.0", "127%.0%.[02-9]%d%.0", "127%.0%.1[1-9]%.0", "127%.0%.[12]%d%d%.0"];
+ RCVD_IN_DNSWL_LOW = ["127%.0%.%d%.1", "127%.0%.[02-9]%d%.1", "127%.0%.1[1-9]%.1", "127%.0%.[12]%d%d%.1"];
+ RCVD_IN_DNSWL_MED = ["127%.0%.%d%.2", "127%.0%.[02-9]%d%.2", "127%.0%.1[1-9]%.2", "127%.0%.[12]%d%d%.2"];
+ RCVD_IN_DNSWL_HI = ["127%.0%.%d%.3", "127%.0%.[02-9]%d%.3", "127%.0%.1[1-9]%.3", "127%.0%.[12]%d%d%.3"];
+ DNSWL_BLOCKED = ["127%.0%.0%.255", "127%.0%.10%.%d+"];
}
}
@@ -155,11 +155,11 @@ rbl {
unknown = false;
returncodes {
- DWL_DNSWL_NONE = "127.0.%d+.0";
- DWL_DNSWL_LOW = "127.0.%d+.1";
- DWL_DNSWL_MED = "127.0.%d+.2";
- DWL_DNSWL_HI = "127.0.%d+.3";
- DWL_DNSWL_BLOCKED = "127.0.0.255";
+ DWL_DNSWL_NONE = ["127%.0%.%d%.0", "127%.0%.[02-9]%d%.0", "127%.0%.1[1-9]%.0", "127%.0%.[12]%d%d%.0"];
+ DWL_DNSWL_LOW = ["127%.0%.%d%.1", "127%.0%.[02-9]%d%.1", "127%.0%.1[1-9]%.1", "127%.0%.[12]%d%d%.1"];
+ DWL_DNSWL_MED = ["127%.0%.%d%.2", "127%.0%.[02-9]%d%.2", "127%.0%.1[1-9]%.2", "127%.0%.[12]%d%d%.2"];
+ DWL_DNSWL_HI = ["127%.0%.%d%.3", "127%.0%.[02-9]%d%.3", "127%.0%.1[1-9]%.3", "127%.0%.[12]%d%d%.3"];
+ DWL_DNSWL_BLOCKED = ["127%.0%.0%.255", "127%.0%.10%.%d+"];
}
}
More information about the Commits
mailing list