Recent changes to bugs

-d argiment logs truncated in syslog startin message

2019-02-13T19:57:43.975000Z

sid-filter.c
main()
syslog(LOG_INFO, "%s v%s starting (%s)", SID_PRODUCT, SID_VERSION, argstr);

If argument list contains more than one domain in -d key like -d yahoo.com,dhl.com prints into syslog only first domain.
for line

./sid-filter -p inet:8896@localhost  -f -l -d yahoo.com,dhl.com -T 10 -h -r 2

produces syslog

sid-filter[18367]: Sendmail Sender-ID Filter v1.0.0 starting (args: -p inet:8896@localhost -f -l -d yahoo.com -T 10 -h -r 2)

I think it goes from
first: when command line swich parses ther does
domlist = optarg;
then
when domain list splits to records - commas replaces with nulls just in argv[n] array in code

        for (p = strtok(domlist, ",");
             p != NULL;
             p = strtok(NULL, ","))
            domains[n++] = p;

        domains[n] = NULL;

I think it can be fixed by copying data from argv[n] or making malloc and strncpy for domain names

#34 Compilation error on CentOS 5.4 64-bit

2016-08-23T14:21:48.602000Z

For building in CentOS7 it fixes as follows:

sid-filter/Makefile.m4:
define(`bldSOURCES', `sid-filter.c rfc2822.c util.c ')
 PREPENDDEF(`confLIBS', `-lmilter ')
+PREPENDDEF(`confLIBS', `-lresolv ')
 bldPRODUCT_END

a:domain/cidr does not work

2010-03-24T10:10:40Z

An spf record of this format:
v=spf1 a:widget.com/24 -all
should cause widget.com to be looked up and the top 24 bits of all IP addresses returned for that address should be used in the spf check.
However the code actually tries to look up widget.com/24.

One fix is to modify function sm_marid_dir_a to work as follows:

Replace this block of code:
/* Scan trailing cidr length(s) */
if ( (s = expr->smx_cidr_s) != NULL
&& (e = expr->smx_cidr_e) != NULL)
{
sm_marid_scan_cidr(s, &e, &smf->smf_cidr_ip4,
&smf->smf_cidr_ip6);
}
else
{
smf->smf_cidr_ip4 = 32;
smf->smf_cidr_ip6 = 128;
}

s = expr->smx_value_s;
e = expr->smx_value_e;

/* Expand the value of the right-hand side */
tmp = sm_marid_domain_spec(context, s, e);

with the following block:

/* Scan trailing cidr length(s) */
smf->smf_cidr_ip4 = 32;
smf->smf_cidr_ip6 = 128;
if ( (s = expr->smx_value_s) != NULL
&& (e = expr->smx_value_e) != NULL)
{
if ( sm_marid_scan_cidr(s, &e, &smf->smf_cidr_ip4,
&smf->smf_cidr_ip6) == 0 )
{
// e now excludes the cidr
}
else
{
e = expr->smx_value_e;
}
}

/* Expand the value of the right-hand side */
tmp = sm_marid_domain_spec(context, s, e);

Note the code above isnt perfect as it needs to restrict the cidr check to strings that have a cidr in, otherwise the cidr scan could match
a domain ending in numbers (not sure thats legal, but it might be one day).

The root of the fault seems to be that the sm_marid_scan_expression call for the spf record locates the widget.com/24 but returns
the whole string as the result. rather than performing further analysis to find the cidr.

Note I think the mx/cidr code is also broken as its structured in the same way,

Use of non-threadsafe inet-ntoa

2010-03-24T09:58:45Z

There are three non-thread safe uses of inet_ntoa.

The source should be changed to use its own threadsafe version of inet_ntoa (sid_inet_ntoa).

Compilation error on CentOS 5.4 64-bit

2010-02-27T01:53:19Z

Making all in:
/root/sid-milter-1.0.0/sid-filter
Configuration: pfx=, os=Linux, rel=2.6.18-164.11.1.el5, rbase=2, rroot=2.6.18-164.11.1, arch=x86_64, sfx=, variant=optimized
Making in /root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/sid-filter
make[1]: Entering directory `/root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/sid-filter'
cc -O2 -I. -I../../libar -I../../libmarid -I../../sendmail -I../../include -DUSE_ARLIB -D_REENTRANT -DXP_MT -c -o sid-filter.o sid-filter.c
cc -O2 -I. -I../../libar -I../../libmarid -I../../sendmail -I../../include -DUSE_ARLIB -D_REENTRANT -DXP_MT -c -o rfc2822.o rfc2822.c
cc -O2 -I. -I../../libar -I../../libmarid -I../../sendmail -I../../include -DUSE_ARLIB -D_REENTRANT -DXP_MT -c -o util.o util.c
cc -o sid-filter -lpthread sid-filter.o rfc2822.o util.o -lmilter /root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/libar/libar.a /root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/libmarid/libmarid.a /root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/libsm/libsm.a -ldl
sid-filter.o: In function `sid_decode_a':
sid-filter.c:(.text+0x7c3): undefined reference to `__dn_expand'
sid-filter.c:(.text+0x7ce): undefined reference to `__dn_skipname'
sid-filter.c:(.text+0x830): undefined reference to `__dn_expand'
sid-filter.o: In function `sid_marid_check':
sid-filter.c:(.text+0xcff): undefined reference to `__dn_expand'
sid-filter.c:(.text+0xd0a): undefined reference to `__dn_skipname'
sid-filter.c:(.text+0x1020): undefined reference to `__dn_expand'
sid-filter.c:(.text+0x15c3): undefined reference to `__dn_expand'
sid-filter.c:(.text+0x1691): undefined reference to `__dn_expand'
sid-filter.c:(.text+0x1796): undefined reference to `__dn_expand'
/root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/libar/libar.a(ar.o): In function `ar_sendquery':
ar.c:(.text+0x15e7): undefined reference to `__res_nmkquery'
/root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/libar/libar.a(ar.o): In function `ar_dispatcher':
ar.c:(.text+0x2053): undefined reference to `__dn_skipname'
ar.c:(.text+0x207a): undefined reference to `__dn_skipname'
ar.c:(.text+0x20d3): undefined reference to `__dn_expand'
collect2: ld returned 1 exit status
make[1]: *** [sid-filter] Error 1
make[1]: Leaving directory `/root/sid-milter-1.0.0/obj.Linux.2.6.18-164.11.1.el5.x86_64/sid-filter'
make: *** [all] Error 2

IPv6 peerlist does not work

2009-10-07T03:40:15Z

I am not sure it is a bug or not. I am testing sid-milter-1.0.0 with the peerlist patch. I wrote peerlist file like this.
----------
192.168.0.0/24
127.0.0.1/32
2002:1111:2222::/64
::1/128
----------
Those IPv4 addresses are working, but IPv6 addresses are not. Please suggest me.

Documented -c option not accepted

2009-04-07T23:28:01Z

-c option added in 1.0.0 mentioned in RELNOTES and usage
causes usage message if used.

-n argument doesn't work

2009-03-08T18:16:08Z

According to man page, -n option should exclude spf1 policies for PRA checks, but it doesn't do that.

The attached patch fixes that beside improving the way PRA policy gets selected.

I think it could be improved by doing rcount-- just after memset. I also think that memset and rcount-- should be performed on all TXT records that are not valid SID/SPF policies.

ip6 parseing broken

2009-02-04T05:40:44Z

Parsing of ip6 fields in the SPF records broken
(i.e. cause permerror status)

See:
freebsd.org. 600 IN TXT "v=spf1 ip4:69.147.83.53 ip4:69.147.83.54 ip6:2001:4f8:fff6::35 ip6:2001:4f8:fff6::36 ~all"

Get mail via ipv6 while running sid-milter and you
get permerror.

Wrongly parsed TXT fields, not releated to SPF/PRA

2008-11-28T12:30:47Z

Example of how the Authentication-Results header complains about DNS reply/DNS failure:

Authentication-Results: xxxxxxxx; sender-id=softfail (DNS reply garbled) header.from=jcm@sics.se; spf=softfail (DNS failure) smtp.mfrom=jcm@sics.se

So, doing dig TXT against domain sics.se to see if there's something wrong, reveals this:

# dig TXT sics.se

; <<>> DiG 9.4.1-P1 <<>> TXT sics.se
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 22446
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 4, ADDITIONAL: 5

;; QUESTION SECTION:
;sics.se. IN TXT

;; ANSWER SECTION:
sics.se. 84653 IN TXT "SE-164 29 KISTA, SWEDEN"
sics.se. 84653 IN TXT "Swedish Institute of Computer Science"
sics.se. 84653 IN TXT "PO Box 1263"
sics.se. 84653 IN TXT "Fax: +46 8 751 72 30"
sics.se. 84653 IN TXT "Tel: +46 8 633 15 00"

;; AUTHORITY SECTION:
sics.se. 25309 IN NS fnord.sics.se.
sics.se. 25309 IN NS sics.se.
sics.se. 25309 IN NS a.ns.kth.se.
sics.se. 25309 IN NS brahma.sics.se.

There are (several) TXT RRs, but none contains either v=spf1 nor v=pra/2.0, so sid-milter should ignore these records (without complaining).