Menu ▾ ▴

#61 Not using sha1 entries in razor-whitelist

open
Richard Soderberg
None
5
2006-07-10
2006-07-09
Anonymous
No

Version 2.82 does not appear to be using the sha1
signatures in the razor-whitelist file.

The code in Agent.pm seems to be missing a check for
values of sha1 that match the signature.

Jim
hostmaster@uuism.net

Discussion

  • Richard Soderberg

    Richard Soderberg - 2006-07-10
    • assigned_to: nobody --> coral
     

  • Jim Hermann

    Jim Hermann - 2006-10-28

    Logged In: YES
    user_id=1560474

    I can't seem to get Razor2 2.82 to ignore the signature for an almost-empty part
    of a two-part email message. I added the signature to my razor-whitelist file
    (see below) and ran razor-check -d on the problem message (see below). The
    first part of the message only contains the Content-Type: and Content-Transfer-
    Encoding: MIME Headers (see end). It is a very common signature.

    What am I doing wrong?

    [root@host root]# more .razor/razor-whitelist
    # very common sig for a while - 0
    sha1 D97Kd_xW_1oOAN-3F7RJ1YFbxdgA
    # Sermon from Oct 9 - 0
    sha1 3gJA9N19dYApDVMC26HUpvz_hR8A
    # play - 1
    sha1 CmwHRX1s-wtWuNJcC0FH_SNjhCkA
    # GMUUC Christmas Programs - 0 is all whitespace
    # Eco task force devon 2 - 0 is all whitespace
    # Undelivered Mail Returned to Sender - 0
    sha1 JudMQLN-L4uGbsGerXGnSrZf0Z8A
    # Hungarian attachment
    sha1 TOo0BfnapRgA
    sha1 TOo0BfnasnsA
    sha1 TOo0Bfnac78A
    sha1 TOo0BfnaFDwA
    sha1 TOo0BfnaA68A
    sha1 TOo0BfnafMMA
    sha1 TOo0BfnadpoA
    sha1 TOo0Bfna7UsA
    sha1 TOo0BfnawmUA
    sha1 TOo0BfnaVJUA
    # Hungarian email
    sha1 Zo0h2U0QssnhBNQj-mObW0jMPR4A
    sha1 8a_aC4syhaX8mO0-Whh200t_zEsA
    sha1 vd-pOTFH-yXWwIaHtM6SIzlt7X8A
    # blank messages
    sha1 zdGTYRw61hrsYQoLvVL2vWL1u_EA
    sha1 _SsH-KtgO9VSZa2dpZ4fHt9OeOcA
    sha1 Hv5WLPo9LTz96VJOTNKYM3618zQA
    sha1 GKXO6MQg0SCjpwnR6yP7PX_G--4A

    [root@host root]# razor-check -d /home/virtual/admin4/var/mail/ham
    Razor-Log: Computed razorhome from env: /root/.razor
    Razor-Log: Found razorhome: /root/.razor
    Razor-Log: read_file: 15 items read from /root/.razor/razor-agent.conf
    Jul 09 10:49:11.875911 check[24335]: [ 2] [bootup] Logging initiated
    LogDebugLevel=9 to stdout
    Jul 09 10:49:11.876400 check[24335]: [ 5] computed razorhome=/root/.razor,
    conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity
    Jul 09 10:49:11.876501 check[24335]: [ 2] Razor-Agents v2.82 starting razor-
    check -d /home/virtual/admin4/var/mail/ham
    Jul 09 10:49:11.878176 check[24335]: [ 9] uname -a: Linux host.uuserver.net
    2.6.10-1.771_FC2 #1 Mon Mar 28 00:50:14 EST 2005 i686 i686 i386 GNU/Linux
    Jul 09 10:49:11.878607 check[24335]: [ 8] reading mbox formatted mail
    from /home/virtual/admin4/var/mail/ham
    Jul 09 10:49:11.880389 check[24335]: [ 6] read 1 mail
    Jul 09 10:49:11.880645 check[24335]: [ 8] Client supported_engines: 4 8
    Jul 09 10:49:11.882518 check[24335]: [ 8] prep_mail done: mail 1 headers=671,
    mime0=115, mime1=43476
    Jul 09 10:49:11.883384 check[24335]: [ 5] read_file: 21 items read
    from /root/.razor/razor-whitelist
    Jul 09 10:49:11.883672 check[24335]: [ 8] loaded 1 different types of whitelist
    Jul 09 10:49:11.883893 check[24335]: [ 5] read_file: 1 items read
    from /root/.razor/servers.discovery.lst
    Jul 09 10:49:11.884115 check[24335]: [ 5] read_file: 2 items read
    from /root/.razor/servers.nomination.lst
    Jul 09 10:49:11.884441 check[24335]: [ 5] read_file: 3 items read
    from /root/.razor/servers.catalogue.lst
    Jul 09 10:49:11.884794 check[24335]: [ 9] Assigning defaults to joy.cloudmark.com
    Jul 09 10:49:11.884936 check[24335]: [ 9] Assigning defaults to
    folly.cloudmark.com
    Jul 09 10:49:11.885107 check[24335]: [ 9] Assigning defaults to
    c101.cloudmark.com
    Jul 09 10:49:11.885246 check[24335]: [ 9] Assigning defaults to
    shock.cloudmark.com
    Jul 09 10:49:11.885370 check[24335]: [ 9] Assigning defaults to
    c102.cloudmark.com
    Jul 09 10:49:11.886004 check[24335]: [ 5] read_file: 19 items read
    from /root/.razor/server.c101.cloudmark.com.conf
    Jul 09 10:49:11.886475 check[24335]: [ 5] read_file: 19 items read
    from /root/.razor/server.c101.cloudmark.com.conf
    Jul 09 10:49:11.886863 check[24335]: [ 5] read_file: 18 items read
    from /root/.razor/server.joy.cloudmark.com.conf
    Jul 09 10:49:11.887243 check[24335]: [ 5] read_file: 18 items read
    from /root/.razor/server.joy.cloudmark.com.conf
    Jul 09 10:49:11.887632 check[24335]: [ 5] read_file: 15 items read
    from /root/.razor/server.folly.cloudmark.com.conf
    Jul 09 10:49:11.887969 check[24335]: [ 5] read_file: 15 items read
    from /root/.razor/server.folly.cloudmark.com.conf
    Jul 09 10:49:11.888364 check[24335]: [ 5] read_file: 18 items read
    from /root/.razor/server.shock.cloudmark.com.conf
    Jul 09 10:49:11.888780 check[24335]: [ 5] read_file: 18 items read
    from /root/.razor/server.shock.cloudmark.com.conf
    Jul 09 10:49:11.889178 check[24335]: [ 5] read_file: 18 items read
    from /root/.razor/server.c102.cloudmark.com.conf
    Jul 09 10:49:11.889551 check[24335]: [ 5] read_file: 18 items read
    from /root/.razor/server.c102.cloudmark.com.conf
    Jul 09 10:49:11.889785 check[24335]: [ 5] 157819 seconds before closest server
    discovery
    Jul 09 10:49:11.889950 check[24335]: [ 6] c101.cloudmark.com is a Catalogue
    Server srl 5095; computed min_cf=21, Server se: C8
    Jul 09 10:49:11.890104 check[24335]: [ 8] Computed supported_engines: 4 8
    Jul 09 10:49:11.890308 check[24335]: [ 8] Using next closest server
    c101.cloudmark.com:2703, cached info srl 5095
    Jul 09 10:49:11.890528 check[24335]: [ 8] mail 1 Subject: Minutes from June 29
    board meeting
    Jul 09 10:49:11.890822 check[24335]: [ 6] preproc: mail 1.0 went from 115 bytes
    to 77
    Jul 09 10:49:11.895625 check[24335]: [ 6] preproc: mail 1.1 went from 43476
    bytes to 41401
    Jul 09 10:49:11.895795 check[24335]: [ 6] computing sigs for mail 1.0, len 77
    Jul 09 10:49:11.897293 check[24335]: [ 6] Engine (8) didn't produce a signature
    for mail 1.0
    Jul 09 10:49:11.897688 check[24335]: [ 6] computing sigs for mail 1.1, len 41401
    Jul 09 10:49:11.900527 check[24335]: [ 6] Engine (8) didn't produce a signature
    for mail 1.1
    Jul 09 10:49:11.900765 check[24335]: [ 5] 159746 seconds before closest server
    discovery
    Jul 09 10:49:11.900956 check[24335]: [ 6] shock.cloudmark.com is a Catalogue
    Server srl 5095; computed min_cf=21, Server se: C8
    Jul 09 10:49:11.901109 check[24335]: [ 8] Computed supported_engines: 4 8
    Jul 09 10:49:11.901230 check[24335]: [ 8] Using next closest server
    shock.cloudmark.com:2703, cached info srl 5095
    Jul 09 10:49:11.901394 check[24335]: [ 5] Connecting to shock.cloudmark.com ...
    Jul 09 10:49:12.046196 check[24335]: [ 8] Connection established
    Jul 09 10:49:12.046352 check[24335]: [ 4] shock.cloudmark.com >> 36 server
    greeting: sn=C&srl=5095&a=l&a=cg&ep4=7542-10
    Jul 09 10:49:12.046717 check[24335]: [ 4] shock.cloudmark.com << 25
    Jul 09 10:49:12.046854 check[24335]: [ 6] cn=razor-agents&cv=2.82
    Jul 09 10:49:12.047089 check[24335]: [ 6] shock.cloudmark.com is a Catalogue
    Server srl 5095; computed min_cf=21, Server se: C8
    Jul 09 10:49:12.047304 check[24335]: [ 8] Computed supported_engines: 4 8
    Jul 09 10:49:12.047481 check[24335]: [ 8] mail 1.0 e4 sig:
    GKXO6MQg0SCjpwnR6yP7PX_G--4A
    Jul 09 10:49:12.047608 check[24335]: [ 5] mail 1.0 e8 got no sig
    Jul 09 10:49:12.047692 check[24335]: [ 8] mail 1.1 e4 sig:
    qKsVqfgDb3wVXGbYM0iQf2hOsLsA
    Jul 09 10:49:12.047787 check[24335]: [ 5] mail 1.1 e8 got no sig
    Jul 09 10:49:12.047954 check[24335]: [ 8] preparing 2 queries
    Jul 09 10:49:12.048186 check[24335]: [ 8] sending 1 batches
    Jul 09 10:49:12.048311 check[24335]: [ 4] shock.cloudmark.com << 108
    Jul 09 10:49:12.048381 check[24335]: [ 6] -a=c&e=4&ep4=7542-
    10&s=GKXO6MQg0SCjpwnR6yP7PX_G--4A
    a=c&e=4&ep4=7542-10&s=qKsVqfgDb3wVXGbYM0iQf2hOsLsA
    .
    Jul 09 10:49:12.201817 check[24335]: [ 4] shock.cloudmark.com >> 21
    Jul 09 10:49:12.201902 check[24335]: [ 6] response to sent.2
    -p=1&cf=100
    p=0
    .
    Jul 09 10:49:12.202267 check[24335]: [ 6] mail 1.0 e=4
    sig=GKXO6MQg0SCjpwnR6yP7PX_G--4A: Is spam: cf 100 >= min_cf 21
    Jul 09 10:49:12.202356 check[24335]: [ 6] mail 1.1 e=4
    sig=qKsVqfgDb3wVXGbYM0iQf2hOsLsA: sig not found.
    Jul 09 10:49:12.202435 check[24335]: [ 7] method 4: mail 1.0: no-contention
    part, spam=1
    Jul 09 10:49:12.202494 check[24335]: [ 7] method 4: mail 1.1: no-contention
    part, spam=0
    Jul 09 10:49:12.202551 check[24335]: [ 7] method 4: mail 1: a non-contention
    part was spam, mail spam
    Jul 09 10:49:12.202609 check[24335]: [ 3] mail 1 is known spam.
    Jul 09 10:49:12.202679 check[24335]: [ 5] disconnecting from server
    shock.cloudmark.com
    Jul 09 10:49:12.202791 check[24335]: [ 4] shock.cloudmark.com << 5
    Jul 09 10:49:12.202844 check[24335]: [ 6] a=q
    Jul 09 10:49:12.202985 check[24335]: [ 8] razor-check finished successfully.

    [snip]
    MIME-Version: 1.0
    Content-Type: multipart/mixed;
    boundary="----=_NextPart_000_02EA_01C6A2C9.88E40950"
    X-Mailer: Microsoft Outlook, Build 10.0.6626
    X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2869
    Thread-index: AcafiAVN4AHLBpqJT6+1i2SXZv1oaA==
    X-OlkEid: ED6406202FF7A4D59EA399468E8D914D50A82138
    X-IMAPbase: 1152407328 1
    Status: RO
    X-Status:
    X-Keywords:
    X-UID: 1

    This is a multi-part message in MIME format.

    ------=_NextPart_000_02EA_01C6A2C9.88E40950
    Content-Type: text/plain;
    charset="us-ascii"
    Content-Transfer-Encoding: 7bit

    ------=_NextPart_000_02EA_01C6A2C9.88E40950
    Content-Type: application/msword;
    name="Jun 29 2006.rtf"
    Content-Transfer-Encoding: quoted-printable
    Content-Disposition: attachment;
    filename="Jun 29 2006.rtf"
    [snip]

    -----
    Jim Hermann <hostmaster@UUism.net>
    UUism Networks <http://www.UUism.net>
    Ministering to the Needs of Online UUs
    Web Hosting, Email Services, Mailing Lists
    -----

     

Log in to post a comment.