Yahoo Groups archive

Milter-greylist

Index last updated: 2026-04-28 23:32 UTC

Message

Re: [milter-greylist] Submitter DNS name resolution and forgery detection

2013-08-15 by Jim Klimov

On 2013-08-15 06:52, manu@... wrote:
> Here is a patch that does it using getaddrinfo/getnameinfo
> http://ftp.espci.fr/shadow/manu/unbracket.patch
>
> Please tell me if it fits your needs.

I did not compile and test it yet, but from code review:

# This is in wrong order by a couple of lines - you should first
set the priv->priv_hostname value with strncpy(), then fix it :)

@@ -375,8 +376,11 @@
         priv->priv_buflen = 0;
         priv->priv_max_elapsed = 0;
         priv->priv_last_whitelist = EXF_NONE;

+       if ((priv->priv_hostname[0] = '[') && conf.c_unbracket)
+               (void)resolve_bracketed(priv->priv_hostname);
+
         strncpy(priv->priv_hostname, hostname, ADDRLEN);
         priv->priv_hostname[ADDRLEN] = '\0';

         if (addr != NULL) {


# Also, this is geared towards exactly resolving a bracketed name.
My code could also do resolution in the (theoretical) case that a
numeric IP address was passed without brackets. Then again, this
routine is called "unbracketing" for a reason ;)

# In the routine itself you have an ifdef... I think it warrants
an #else to report that unbracketing was needed and requested, but
the program was configured and built without proper DNS support.

# Mine also had some more debugging info about the process (that
the unbracketing was called, that it failed or succeeded, that there
were several DNS PTR hits and we only picked one, etc.) which the
current implementation lacks. I found it convenient to have while
debugging the configuration...

Overall, this is more compact and simple - less prone to breakage
due to our own neglect. If the concerns about debug-logging and
about the order of operations are addressed, and this does also
work equivalently to mine, I'd be okay with this change ;)

I hope to test it tonight sometime...

//Jim

Attachments

Move to quarantaine

This moves the raw source file on disk only. The archive index is not changed automatically, so you still need to run a manual refresh afterward.