https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7500
Bug ID: 7500
Summary: spamassassin severely penalizes IPV6 link-local
addresses
Product: Spamassassin
Version: 3.4.1
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Rules
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: Undefined
Created attachment 5479
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5479&action=edit
As an attachment I have two email messages, both with anonymized hostnames,
first with IPV6 link-local in headers, second same but with those IPV6
addresses replaced with IPV4
In spamassassin 3.4.1-3 to 3.4.1-7 (and before and PROBABLY AFTER)
/usr/share/perl5/Mail/SpamAssassin/Plugin/RelayEval.pm
seems to deliberately sabotage any potential handling of IPV6 link-local
addresses.
# note using IPv4 addresses for now due to empty strings matching IP_ADDRESS
# due to bug in pure IPv6 address regular expression
sub helo_ip_mismatch {
my ($self, $pms) = @_;
my $IP_ADDRESS = IPV4_ADDRESS;
my $IP_PRIVATE = IP_PRIVATE;
for my $relay (@{$pms->{relays_untrusted}}) {
# is HELO usable?
next unless ($relay->{helo} =~ m/^$IP_ADDRESS$/ &&
$relay->{helo} !~ /$IP_PRIVATE/);
# compare HELO with IP
return 1 if ($relay->{ip} =~ m/^$IP_ADDRESS$/ &&
$relay->{ip} !~ m/$IP_PRIVATE/ &&
$relay->{helo} ne $relay->{ip} &&
# different IP is okay if in same /24
$relay->{helo} =~ /^(\d+\.\d+\.\d+\.)/ &&
index($relay->{ip}, $1) != 0);
}
0;
}
This, or perhaps similar code elsewhere causes headers such as the
following to get an effective 7 spamassassin point penalty. (2 to 3
for RDNS_NONE, and 5 for not matching ALL_TRUSTED).
=============================================================================
Received: from connhm01.connect.uwaterloo.ca ([fe80::d4bf:9432:cac5:5f3b]) by
connhm01.connect.uwaterloo.ca ([fe80::d4bf:9432:cac5:5f3b%19]) with mapi id
15.01.1034.032; Fri, 27 Oct 2017 13:06:52 -0400
=============================================================================
I have been able to sed the IPV6 addresses into an acceptable IPV4 version
and obtain a spamassassin score approximately 7 points "less spammy" (in
our context, of course).
I include a complete sample message followed by a version modified to
pass "ALL_TRUSTED" (in our context, of course). Some hostnames and all
list names have been made bogus, however. To a smaller audience,
I could provide similar messages without that obfuscation.
"Preview" doesn't seem to preview attachments, and I don't seem to be
able to add more than one attachment, so the attachment may end up less
useful than I hope.
Adrian Pepper
--
You are receiving this mail because:
You are the assignee for the bug.
