Milter-greylist

It appears that there is a bug in the way from addresses are parsed if
an equals sign appears in them.

Example:

Feb 10 08:38:35 mxa milter-greylist: j1AGcYDf023468: addr 64.192.229.17 
from =windwireless.net@...> rcpt <user@...>: 
autowhitelisted for more 120:00:00
Feb 10 08:38:36 mxa sendmail[23468]: j1AGcYDf023468: 
from=<bounce-9985-user=windwireless.net@...>, size=6682, 
class=0, nrcpts=1, 
msgid=<200502101638.j1AGcYDf023468@...>, proto=SMTP, 
daemon=MTA, relay=mta1.m.freeride.com [64.192.229.17]

   Sendmail correctly shows the entire from address, the milter is only
getting the tail end of it starting at the equals sign.  I checked in
the greylist.db file, it's broken there also.

At 10:00 AM 2.11.2005 -0800, Brian W. Antoine wrote:
>
>   It appears that there is a bug in the way from addresses are parsed if
>an equals sign appears in them.
>
>Example:
>
>Feb 10 08:38:35 mxa milter-greylist: j1AGcYDf023468: addr 64.192.229.17 
>from =windwireless.net@...> rcpt <user@...>: 
>autowhitelisted for more 120:00:00
>Feb 10 08:38:36 mxa sendmail[23468]: j1AGcYDf023468: 
>from=<bounce-9985-user=windwireless.net@...>, size=6682, 
>class=0, nrcpts=1, 
>msgid=<200502101638.j1AGcYDf023468@...>, proto=SMTP, 
>daemon=MTA, relay=mta1.m.freeride.com [64.192.229.17]
>
>   Sendmail correctly shows the entire from address, the milter is only
>getting the tail end of it starting at the equals sign.  I checked in
>the greylist.db file, it's broken there also.
>

Yes, I've noticed the same thing with the "=" sign on V-1.75. I've been
cleaning them out on occasion.

Also, my db AUTO whitelist section keeps filling up with huge amounts of
the "dictionary" attacks or "joe-jobs" looking through the alphabet for
user names that respond. I've got sendmail recipts limited to a low figure
for a single connection, but they come right back and grab another few on a
fresh connection, since it is a "bot."


Happy trails,
Jack L. Stone

System Admin
Sage-american

At 11:37 AM 02/11/2005, Jack L. Stone wrote:

>At 10:00 AM 2.11.2005 -0800, Brian W. Antoine wrote:
> >
> >   It appears that there is a bug in the way from addresses are parsed if
> >an equals sign appears in them.
> >
> >Example:
> >
> >Feb 10 08:38:35 mxa milter-greylist: j1AGcYDf023468: addr 64.192.229.17
> >from =windwireless.net@...> rcpt <user@...>:
> >autowhitelisted for more 120:00:00
> >Feb 10 08:38:36 mxa sendmail[23468]: j1AGcYDf023468:
> >from=<bounce-9985-user=windwireless.net@...>, size=6682,
> >class=0, nrcpts=1,
> >msgid=<200502101638.j1AGcYDf023468@...>, proto=SMTP,
> >daemon=MTA, relay=mta1.m.freeride.com [64.192.229.17]
> >
> >   Sendmail correctly shows the entire from address, the milter is only
> >getting the tail end of it starting at the equals sign.  I checked in
> >the greylist.db file, it's broken there also.
> >
>
>Yes, I've noticed the same thing with the "=" sign on V-1.75. I've been
>cleaning them out on occasion.

   I found them writing a report for our users showing what we'd filtered
from their accounts, I couldn't find the matching milter entry for the
sendmail entry sometimes.  The other effect is whitelisting more senders
than should be once it gets into the db that way.