diff options
| author | Marc Dierksen <m.dierksen@netcon-consulting.com> | 2023-10-05 19:05:36 +0200 |
|---|---|---|
| committer | Marc Dierksen <m.dierksen@netcon-consulting.com> | 2023-10-05 19:05:36 +0200 |
| commit | 5f5a126a4ec179e91eda61aaaa219ba5ebb553eb (patch) | |
| tree | 83c9ca347927e1550bb3b9cc631f44daf3f75e3e /conf | |
| parent | 5532e265c06649cd56839bd23f64f8d8dccb9018 (diff) | |
| download | rspamd-5f5a126a4ec179e91eda61aaaa219ba5ebb553eb.tar.gz rspamd-5f5a126a4ec179e91eda61aaaa219ba5ebb553eb.zip | |
[Fix] Prevent DNSWL sabotage
When exceeding the query limit for DNSWL it can happen that instead
of the returncode 127.0.0.255, that according to documentation
(https://www.dnswl.org/?page_id=15) indicates a block, the
returncode 127.0.10.3 is returned for all queries.
According to documentation (https://www.dnswl.org/?page_id=15) the
127.0.10.3 returncode indicates the highest level of trustworthiness
that should never be blocked and a category of 'some special cases'.
As it turns out that documentation is a lie and that 127.0.10.3
returncode is used by DNSWL to intentionally sabotage email security
by marking all sending servers as highly trustworthy
(https://www.dnswl.org/?p=120).
Diffstat (limited to 'conf')
| -rw-r--r-- | conf/modules.d/rbl.conf | 20 |
1 files changed, 10 insertions, 10 deletions
diff --git a/conf/modules.d/rbl.conf b/conf/modules.d/rbl.conf index e3ece5a66..c1ef6afaa 100644 --- a/conf/modules.d/rbl.conf +++ b/conf/modules.d/rbl.conf @@ -110,11 +110,11 @@ rbl { whitelist_exception = "RCVD_IN_DNSWL_LOW"; whitelist_exception = "DNSWL_BLOCKED"; returncodes { - RCVD_IN_DNSWL_NONE = "127.0.%d+.0"; - RCVD_IN_DNSWL_LOW = "127.0.%d+.1"; - RCVD_IN_DNSWL_MED = "127.0.%d+.2"; - RCVD_IN_DNSWL_HI = "127.0.%d+.3"; - DNSWL_BLOCKED = "127.0.0.255"; + RCVD_IN_DNSWL_NONE = ["127%.0%.%d%.0", "127%.0%.[02-9]%d%.0", "127%.0%.1[1-9]%.0", "127%.0%.[12]%d%d%.0"]; + RCVD_IN_DNSWL_LOW = ["127%.0%.%d%.1", "127%.0%.[02-9]%d%.1", "127%.0%.1[1-9]%.1", "127%.0%.[12]%d%d%.1"]; + RCVD_IN_DNSWL_MED = ["127%.0%.%d%.2", "127%.0%.[02-9]%d%.2", "127%.0%.1[1-9]%.2", "127%.0%.[12]%d%d%.2"]; + RCVD_IN_DNSWL_HI = ["127%.0%.%d%.3", "127%.0%.[02-9]%d%.3", "127%.0%.1[1-9]%.3", "127%.0%.[12]%d%d%.3"]; + DNSWL_BLOCKED = ["127%.0%.0%.255", "127%.0%.10%.%d+"]; } } @@ -155,11 +155,11 @@ rbl { unknown = false; returncodes { - DWL_DNSWL_NONE = "127.0.%d+.0"; - DWL_DNSWL_LOW = "127.0.%d+.1"; - DWL_DNSWL_MED = "127.0.%d+.2"; - DWL_DNSWL_HI = "127.0.%d+.3"; - DWL_DNSWL_BLOCKED = "127.0.0.255"; + DWL_DNSWL_NONE = ["127%.0%.%d%.0", "127%.0%.[02-9]%d%.0", "127%.0%.1[1-9]%.0", "127%.0%.[12]%d%d%.0"]; + DWL_DNSWL_LOW = ["127%.0%.%d%.1", "127%.0%.[02-9]%d%.1", "127%.0%.1[1-9]%.1", "127%.0%.[12]%d%d%.1"]; + DWL_DNSWL_MED = ["127%.0%.%d%.2", "127%.0%.[02-9]%d%.2", "127%.0%.1[1-9]%.2", "127%.0%.[12]%d%d%.2"]; + DWL_DNSWL_HI = ["127%.0%.%d%.3", "127%.0%.[02-9]%d%.3", "127%.0%.1[1-9]%.3", "127%.0%.[12]%d%d%.3"]; + DWL_DNSWL_BLOCKED = ["127%.0%.0%.255", "127%.0%.10%.%d+"]; } } |