github-starred/sendmailanalyzer
2
0
Fork 0
mirror of https://github.com/darold/sendmailanalyzer.git synced 2026-05-15 22:02:32 -06:00
Code Issues 3 Projects Packages Wiki Activity Actions

Fix wrong report of DNSBL Spam blocked that was inluding all 550 5.7.1 messages even those not related to RBL. It now attempts to find keywords "see" or "listed" in the rejection status.

Browse source
This commit is contained in:
Gilles Darold 2017-09-15 23:09:51 +02:00
parent b008420421
commit cf30e95e27
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
sendmailanalyzer
View file

@ -1227,7 +1227,7 @@ sub parse_sendmail
my $reject = $5;
$arg1 =~ s/[<>]+//g;
# Test Sendmail DNSBL spam scan
if (($reject =~ /553 5\.3\.0/i) || ($reject =~ /550 5\.7\.1/i)) {
if (($reject =~ /553 5\.3\.0/i) || ($reject =~ /550 5\.7\.1/i && $reject =~ / see[:\s]| listed/i)) {
$SPAM{$host}{$id}{relay} = $relay;
$SPAM{$host}{$id}{rule} = $rule;
$SPAM{$host}{$id}{spam} = 'DNSBL Spam blocked';
@ -1258,7 +1258,7 @@ sub parse_sendmail
$arg1 =~ s/[<>]+//g;
my $id = &get_uniqueid();
# Test Sendmail DNSBL spam scan
if ($reject =~ /(553 5\.3\.0|550 5\.7\.1)/i) {
if (($reject =~ /553 5\.3\.0/i) || ($reject =~ /550 5\.7\.1/i && $reject =~ / see[:\s]| listed/i)) {
$SPAM{$host}{$id}{relay} = $relay;
$SPAM{$host}{$id}{rule} = $rule;
$SPAM{$host}{$id}{spam} = 'DNSBL Spam blocked';
@ -2052,7 +2052,6 @@ sub parse_spamd
# Some message id can be truncated in from log and full in spamd message
if ($SPAM{$host}{$id}{mid} =~ /^\Q$FROM{$host}{$mid}{msgid}\E/) {
$SPAM{$host}{$mid}{from} = $FROM{$host}{$mid}{sender};
$SPAM{$host}{$mid}{spam} = $SPAM{$host}{$id}{spam};
$SPAM{$host}{$mid}{date} = $SPAM{$host}{$id}{date};
@ -2902,6 +2901,8 @@ sub clear_status
return $1;
} elsif ($status =~ /(You are still greylisted)/i) {
return $1;
} elsif ($status =~ /(.*): (possible SMTP attack): (.*)/i) {
return "$2 from $1 ($3)";
} elsif ($status =~ /(Domain of sender address) ([^\s]+) (.*)/i) {
return "$1 $3: $2";
} elsif ($status =~ /\d{3} \d\.\d\.\d <[^>]+>[:\s\.]*(.*)/) {