Subject: [fwtk-users] Possible bug in the smap RBL style lookup patch

From: "Michael St. Laurent" <[email-masked]>
Date: Mon, 14 Jan 2002 11:48:11 -0800

Recently a piece of spam was received here that I believe should have been
caught by the RBL DNS lookup style spam patch but was not.  I have the
following in my netperm-table file:

smap:           block-list "OSRELAY" block .relays.osirusoft.com:127.0.0.2
"%s/%s was found in the Osirusoft Verified Open Relays list (see
http://relays.osirusoft.com/)"
smap:           block-list "OSDUL" block .relays.osirusoft.com:127.0.0.3
"%s/%swas found in the Osirusoft Dialup Spam Source list (see
http://relays.osirusoft.com/)"
smap:           block-list "OSSRC" block .relays.osirusoft.com:127.0.0.4
"%s/%swas found in the Osirusoft Confirmed Spam Source list (see
http://relays.osirusoft.com/)"
smap:           block-list "OSSOFT" block .relays.osirusoft.com:127.0.0.6
"%s/%s was found in the Osirusoft Spamware Software Developers list (see
http://relays.osirusoft.com/)"
smap:           block-list "OSPROXY" block .relays.osirusoft.com:127.0.0.9
"%s/%s was found in the Osirusoft Open Proxy Servers list (see
http://relays.osirusoft.com/)"
smap:           block-list "SPEWS" block .spews.relays.osirusoft.com "%s/%s
wasfound in the SPEWS.ORG spamsource list (see http://www.spews.org/)"

But the following managed to slip through:

Jan 12 11:25:07 guardian smap[4832]: securityalert: possible spoof
icc.icc-conventions.net/216.151.192.26 != 216.139.200.251 name lookup
mismatch
Jan 12 11:25:07 guardian smap[4832]: connect host=unknown/216.151.192.26
Jan 12 11:25:07 guardian smap[4832]: EHLO icc.icc-conventions.net
host=unknown/216.151.192.26
Jan 12 11:25:07 guardian smap[4832]: mail from: <[email-masked]>
address=216.151.192.26 host=unknown
Jan 12 11:25:07 guardian smap[4832]: checking address
<[email-masked]>/home.ro
Jan 12 11:25:07 guardian smap[4832]: RCPT TO: <[email-masked]>
Jan 12 11:25:09 guardian smap[4832]: permit host=unknown/216.151.192.26 use
of gateway
Jan 12 11:25:09 guardian smap[4832]: host=unknown/216.151.192.26 bytes=2027
from=<[email-masked]> to=<[email-masked]> xma004832
Jan 12 11:25:09 guardian smap[4832]: exiting host=unknown/216.151.192.26
bytes=2027
Jan 12 11:25:34 guardian smapd[4833]: delivered file=sma004832 pid=4834
code=0

However, a check with the osirusoft database shows that the OSRELAY rule
should have caught this one.  Is it possible that the spoofing on the first
line of the log messages prevented the DNS check from working correctly?

--------------------
Michael St. Laurent
Hartwell Corporation

[root@earth] root# rm -rf /bin/laden

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Mon, 14 Jan 2002 21:55:13 -0500

>following in my netperm-table file:
...
>line of the log messages prevented the DNS check from working correctly?

That's strange - the entry in relays.osirusoft.com is there and returns the 
right value; it was added/updated on 12 December, so it's not a new entry.
The RBL lookups always use the source IP only - the failed reverse DNS 
lookup doesn't make a difference.

About my only guess is a nameserver hiccup of some kind or another.
         -Rick

---