Skip to content

Commit

Permalink
whitelist_auth to welcomelist_auth,
Browse files Browse the repository at this point in the history 
unwhitelist_auth to unwelcomelist_auth,
def_whitelist_auth to def_welcomelist_auth, 
check_forged_in_whitelist to check_forged_in_welcomelist, 
check_from_in_default_whitelist to check_from_in_default_welcomelist, 
check_uri_host_in_whitelist to check_uri_host_in_welcomelist, 
check_from_in_blacklist to check_from_in_blocklist,
check_to_in_blacklist to check_from_in_blocklist, 
check_to_in_blacklist to check_to_in_blocklist,
and whitelist_bounce_relays to welcomelist_bounce_relays for bug 7826

git-svn-id: https://svn.apache.org/repos/asf/spamassassin/trunk@1884922 13f79535-47bb-0310-9956-ffa450edef68
  • Loading branch information
Kevin A. McGrail committed Dec 29, 2020
1 parent f4c7868 commit b75dfe3
Show file tree
Hide file tree
Showing 15 changed files with 1,780 additions and 95 deletions.
3 changes: 3 additions & 0 deletions MANIFEST
View file
Expand Up @@ -253,6 +253,7 @@ t/bayessdbm.t
t/bayessdbm_seen_delete.t
t/bayessql.t
t/blacklist_autolearn.t
t/blocklist_autolearn.t
t/body_mod.t
t/body_str.t
t/check_implemented.t
Expand Down Expand Up @@ -535,6 +536,8 @@ t/rule_types.t
t/sa_awl.t
t/sa_check_spamd.t
t/sa_compile.t
t/freemail_welcome_block.t
t/spf_welcome_block.t
t/sha1.t
t/shortcircuit.t
t/shortcircuit_before_dns.t
Expand Down
45 changes: 27 additions & 18 deletions lib/Mail/SpamAssassin/Conf.pm
View file
Expand Up @@ -297,7 +297,7 @@ Used to whitelist sender addresses which send mail that is often tagged
Use of this setting is not recommended, since it blindly trusts the message,
which is routinely and easily forged by spammers and phish senders. The
recommended solution is to instead use C<whitelist_auth> or other authenticated
recommended solution is to instead use C<welcomelist_auth> or other authenticated
whitelisting methods, or C<welcomelist_from_rcvd>.
Whitelist and blacklist addresses are now file-glob-style patterns, so
Expand Down Expand Up @@ -624,7 +624,9 @@ be blacklisted. Same format as C<blacklist_from>.
type => $CONF_TYPE_ADDRLIST,
});

=item whitelist_auth user@example.com
=item welcomelist_auth user@example.com
Previously whitelist_auth which will work interchangeably until 4.1.
Used to specify addresses which send mail that is often tagged (incorrectly) as
spam. This is different from C<welcomelist_from> and C<welcomelist_from_rcvd> in
Expand All @@ -636,47 +638,54 @@ schemes: SPF (using C<Mail::SpamAssassin::Plugin::SPF>), or DKIM (using
C<Mail::SpamAssassin::Plugin::DKIM>). Note that those plugins must be active,
and working, for this to operate.
Using C<whitelist_auth> is roughly equivalent to specifying duplicate
Using C<welcomelist_auth> is roughly equivalent to specifying duplicate
C<whitelist_from_spf>, C<whitelist_from_dk>, and C<whitelist_from_dkim> lines
for each of the addresses specified.
e.g.
whitelist_auth joe@example.com fred@example.com
whitelist_auth *@example.com
welcomelist_auth joe@example.com fred@example.com
welcomelist_auth *@example.com
=item def_welcomelist_auth user@example.com
=item def_whitelist_auth user@example.com
Previously def_whitelist_auth which will work interchangeably until 4.1.
Same as C<whitelist_auth>, but used for the default whitelist entries
in the SpamAssassin distribution. The whitelist score is lower, because
Same as C<welcomelist_auth>, but used for the default welcomelist entries
in the SpamAssassin distribution. The welcomelist score is lower, because
these are often targets for spammer spoofing.
=cut

push (@cmds, {
setting => 'whitelist_auth',
setting => 'welcomelist_auth',
aliases => ['whitelist_auth'], # backward compatible - to be removed for 4.1
type => $CONF_TYPE_ADDRLIST,
});

push (@cmds, {
setting => 'def_whitelist_auth',
setting => 'def_welcomelist_auth',
aliases => ['def_whitelist_auth'], # backward compatible - to be removed for 4.1
type => $CONF_TYPE_ADDRLIST,
});

=item unwhitelist_auth user@example.com
Used to remove a C<whitelist_auth> or C<def_whitelist_auth> entry. The
Previously unwhitelist_auth which will work interchangeably until 4.1.
Used to remove a C<welcomelist_auth> or C<def_welcomelist_auth> entry. The
specified email address has to match exactly the address previously used.
e.g.
unwhitelist_auth joe@example.com fred@example.com
unwhitelist_auth *@example.com
unwelcomelist_auth joe@example.com fred@example.com
unwelcomelist_auth *@example.com
=cut

push (@cmds, {
setting => 'unwhitelist_auth',
setting => 'unwelcomelist_auth',
aliases => ['unwhitelist_auth'],
type => $CONF_TYPE_ADDRLIST,
code => sub {
my ($self, $key, $value, $line) = @_;
Expand All @@ -686,9 +695,9 @@ e.g.
unless ($value =~ /^(?:\S+(?:\s+\S+)*)$/) {
return $INVALID_VALUE;
}
$self->{parser}->remove_from_addrlist('whitelist_auth',
$self->{parser}->remove_from_addrlist('welcomelist_auth',
split (/\s+/, $value));
$self->{parser}->remove_from_addrlist('def_whitelist_auth',
$self->{parser}->remove_from_addrlist('def_welcomelist_auth',
split (/\s+/, $value));
}
});
Expand Down Expand Up @@ -4821,8 +4830,8 @@ sub new {
$self->{bayes_ignore_from} = { };
$self->{bayes_ignore_to} = { };

$self->{whitelist_auth} = { };
$self->{def_whitelist_auth} = { };
$self->{welcomelist_auth} = { };
$self->{def_welcomelist_auth} = { };
$self->{welcomelist_from} = { };
$self->{whitelist_allows_relays} = { };
$self->{blacklist_from} = { };
Expand Down
6 changes: 3 additions & 3 deletions lib/Mail/SpamAssassin/Plugin/DKIM.pm
View file
Expand Up @@ -659,7 +659,7 @@ sub check_for_def_dkim_whitelist_from {
my ($self, $pms) = @_;
$self->_check_dkim_whitelist($pms) if !$pms->{whitelist_checked};
return $pms->{dkim_match_in_def_whitelist_from_dkim} ||
$pms->{dkim_match_in_def_whitelist_auth};
$pms->{dkim_match_in_def_welcomelist_auth};
}

# ---------------------------------------------------------------------------
Expand Down Expand Up @@ -1152,11 +1152,11 @@ sub _check_dkim_whitelist {
$self->_wlcheck_acceptable_signature($pms, \@acceptable_sdid_tuples,
'def_whitelist_from_dkim');
$self->_wlcheck_author_signature($pms, \@acceptable_sdid_tuples,
'def_whitelist_auth');
'def_welcomelist_auth');
$self->_wlcheck_acceptable_signature($pms, \@acceptable_sdid_tuples,
'whitelist_from_dkim');
$self->_wlcheck_author_signature($pms, \@acceptable_sdid_tuples,
'whitelist_auth');
'welcomelist_auth');
if (!@acceptable_sdid_tuples) {
dbg("dkim: no wl entries match author %s, no need to verify sigs",
$authors_str);
Expand Down
16 changes: 9 additions & 7 deletions lib/Mail/SpamAssassin/Plugin/FreeMail.pm
View file
Expand Up @@ -53,14 +53,14 @@ freemail_whitelist email/domain ...
Emails or domains listed here are ignored (pretend they aren't
freemail). No wildcards!
freemail_import_whitelist_auth 1/0
freemail_import_welcomelist_auth 1/0
Entries in whitelist_auth will also be used to whitelist emails
Entries in welcomelist_auth will also be used to welcomelist emails
or domains from being freemail. Default is 0.
freemail_import_def_whitelist_auth 1/0
freemail_import_def_welcomelist_auth 1/0
Entries in def_whitelist_auth will also be used to whitelist emails
Entries in def_welcomelist_auth will also be used to whitelist emails
or domains from being freemail. Default is 0.
header FREEMAIL_REPLYTO eval:check_freemail_replyto(['option'])
Expand Down Expand Up @@ -215,15 +215,17 @@ sub set_config {
}
);
push(@cmds, {
setting => 'freemail_import_whitelist_auth',
setting => 'freemail_import_welcomelist_auth',
default => 0,
type => $Mail::SpamAssassin::Conf::CONF_TYPE_NUMERIC,
aliases => ['freemail_import_whitelist_auth'],
}
);
push(@cmds, {
setting => 'freemail_import_def_whitelist_auth',
setting => 'freemail_import_def_welcomelist_auth',
default => 0,
type => $Mail::SpamAssassin::Conf::CONF_TYPE_NUMERIC,
alias => ['freemail_import_def_welcomelist_auth']
}
);
$conf->{parser}->register_commands(\@cmds);
Expand Down Expand Up @@ -333,7 +335,7 @@ sub _is_freemail {
return 0;
}

foreach my $list ('whitelist_auth','def_whitelist_auth') {
foreach my $list ('welcomelist_auth','def_welcomelist_auth') {
if ($pms->{conf}->{"freemail_import_$list"}) {
foreach my $regexp (values %{$pms->{conf}->{$list}}) {
if ($email =~ /$regexp/o) {
Expand Down
4 changes: 2 additions & 2 deletions lib/Mail/SpamAssassin/Plugin/SPF.pm
View file
Expand Up @@ -763,7 +763,7 @@ sub _check_spf_whitelist {

$scanner->{spf_whitelist_from} =
$self->_wlcheck($scanner, 'whitelist_from_spf') ||
$self->_wlcheck($scanner, 'whitelist_auth');
$self->_wlcheck($scanner, 'welcomelist_auth');

# if the message doesn't pass SPF validation, it can't pass an SPF whitelist
if ($scanner->{spf_whitelist_from}) {
Expand Down Expand Up @@ -798,7 +798,7 @@ sub _check_def_spf_whitelist {

$scanner->{def_spf_whitelist_from} =
$self->_wlcheck($scanner, 'def_whitelist_from_spf') ||
$self->_wlcheck($scanner, 'def_whitelist_auth');
$self->_wlcheck($scanner, 'def_welcomelist_auth');

# if the message doesn't pass SPF validation, it can't pass an SPF whitelist
if ($scanner->{def_spf_whitelist_from}) {
Expand Down
27 changes: 17 additions & 10 deletions lib/Mail/SpamAssassin/Plugin/VBounce.pm
View file
Expand Up @@ -44,7 +44,7 @@ sub new {
bless ($self, $class);

$self->register_eval_rule("have_any_bounce_relays"); # type does not matter
$self->register_eval_rule("check_whitelist_bounce_relays"); # type does not matter
$self->register_eval_rule("check_welcomelist_bounce_relays"); # type does not matter

$self->set_config($mailsaobject->{conf});

Expand All @@ -63,7 +63,8 @@ SpamAssassin handles incoming email messages.
=over 4
=item whitelist_bounce_relays hostname [hostname2 ...]
=item welcomelist_bounce_relays hostname [hostname2 ...]
Previously whitelist_bounce_relays which will work interchangeably until 4.1.
This is used to 'rescue' legitimate bounce messages that were generated in
response to mail you really *did* send. List the MTA relay hostnames that
Expand All @@ -76,14 +77,15 @@ Specifically, C<*> and C<?> are allowed, but all other metacharacters are not.
Regular expressions are not used for security reasons.
Multiple addresses per line, separated by spaces, is OK. Multiple
C<whitelist_bounce_relays> lines are also OK.
C<welcomelist_bounce_relays> lines are also OK.
=back
=cut

push (@cmds, {
setting => 'whitelist_bounce_relays',
setting => 'welcomelist_bounce_relays',
aliases => ['whitelist_bounce_relays'], # backward compatible - to be removed for 4.1
type => $Mail::SpamAssassin::Conf::CONF_TYPE_ADDRLIST
});

Expand All @@ -92,11 +94,16 @@ C<whitelist_bounce_relays> lines are also OK.

sub have_any_bounce_relays {
my ($self, $pms) = @_;
return $pms->{conf}->{whitelist_bounce_relays} &&
%{$pms->{conf}->{whitelist_bounce_relays}} ? 1 : 0;
return $pms->{conf}->{welcomelist_bounce_relays} &&
%{$pms->{conf}->{welcomelist_bounce_relays}} ? 1 : 0;
}

#Stub for backwards compatibility - Remove in SA 4.1
sub check_whitelist_bounce_relays {
return check_welcomelist_bounce_relays(@_);
}

sub check_welcomelist_bounce_relays {
my ($self, $pms) = @_;

return 0 if !$self->have_any_bounce_relays($pms);
Expand All @@ -111,7 +118,7 @@ sub check_whitelist_bounce_relays {
foreach my $line (@{$body}) {
next unless ($line =~ /^[> ]*Received:/i);
while ($line =~ / (\S+\.\S+) /g) {
return 1 if $self->_relay_is_in_whitelist_bounce_relays($pms, $1);
return 1 if $self->_relay_is_in_welcomelist_bounce_relays($pms, $1);
}
}

Expand Down Expand Up @@ -143,17 +150,17 @@ sub check_whitelist_bounce_relays {

next unless ($fullhdr =~ /^[> ]*Received:/i);
while ($fullhdr =~ /\s(\S+\.\S+)\s/gs) {
return 1 if $self->_relay_is_in_whitelist_bounce_relays($pms, $1);
return 1 if $self->_relay_is_in_welcomelist_bounce_relays($pms, $1);
}
}

return 0;
}

sub _relay_is_in_whitelist_bounce_relays {
sub _relay_is_in_welcomelist_bounce_relays {
my ($self, $pms, $relay) = @_;
return 1 if $self->_relay_is_in_list(
$pms->{conf}->{whitelist_bounce_relays}, $pms, $relay);
$pms->{conf}->{welcomelist_bounce_relays}, $pms, $relay);
dbg("rules: relay $relay doesn't match any whitelist");

return 0;
Expand Down

0 comments on commit b75dfe3

Please sign in to comment.