Bug #40734 for Net-DNSBL-Monitor: missing dependencies

Thu Nov 06 17:46:22 2008 croco-gnu [...] openwall.com - Ticket created

Subject:	missing dependencies
Date:	Fri, 7 Nov 2008 01:45:50 +0300
To:	bug-Net-DNSBL-Monitor [...] rt.cpan.org
From:	"Andrey V. Stolyarov" <croco-gnu [...] openwall.com>

Hi there, the Net-DNSBL-Monitor-0.06 doesn't list the modules Net::NBsocket and Proc::PidUtil as dependencies, but actually at least the script 'dnsblmon' does depends on them, so that it won't run until these two are installed manually. I think it is a bug. Since I'm writing you anyway, could you please consider to provide a way to _ignore_ particular return codes such as 127.0.0.2, 127.0.0.12 etc, and report the listing regardless of what ip address is returned by the request? The trouble is that all MTAs I know do not pay attention to particular address, instead blocking email from a host for which _any_ response exists, _and_ I know at least one (private) DNSBL zone in which the address in each A RR is used to represent the date/time when the listing occured, so it is impossible to explicitly list all the possible 'return codes'. Thank you for the great job you do! -- Andrey V Stolyarov a.k.a. Croco Openwall, Inc.

Thu Nov 06 19:20:57 2008 michael [...] arangen.net - Correspondence added

Subject:	Re: [rt.cpan.org #40734] missing dependencies
Date:	Thu, 06 Nov 2008 16:20:45 -0800
To:	bug-Net-DNSBL-Monitor [...] rt.cpan.org
From:	michael [...] arangen.net

Show quoted text

> Thu Nov 06 17:46:22 2008: Request 40734 was acted upon. > Transaction: Ticket created by croco-gnu@openwall.com > Queue: Net-DNSBL-Monitor > Subject: missing dependencies > Broken in: (no value) > Severity: (no value) > Owner: Nobody > Requestors: croco-gnu@openwall.com > Status: new > Ticket <URL: http://rt.cpan.org/Ticket/Display.html?id=40734 > > > > > Hi there, > > the Net-DNSBL-Monitor-0.06 doesn't list the modules Net::NBsocket and > Proc::PidUtil as dependencies, but actually at least the script > 'dnsblmon' does depends on them, so that it won't run until these two > are installed manually. > > I think it is a bug. >

Ah.... yes. those are in the sample script but not the module itself. Yes, I will add those to the Makefile.PL. Thanks for letting me know. Show quoted text

> Since I'm writing you anyway, could you please consider to provide a > way to _ignore_ particular return codes such as 127.0.0.2, 127.0.0.12 > etc, and report the listing regardless of what ip address is returned > by the request?

something like specifying 0.0.0.0 and having that me "everything"? That might work and I don't think it will break anything. Show quoted text

> The trouble is that all MTAs I know do not pay > attention to particular address, instead blocking email from a host

most MTA's I can think of allow you to explicitly specify the return address they will honor. That's not the default behavior however. You might consider running Net::DSNBL::MultiDaemon and use it to sort all that out as well as prioritize the lookups to reduce DNS loading. Show quoted text

> for which _any_ response exists, _and_ I know at least one (private) > DNSBL zone in which the address in each A RR is used to represent the > date/time when the listing occured, so it is impossible to explicitly > list all the possible 'return codes'. >

That's a design issue. Probably not the best way to implement a DNSBL. There is something broken in the tests that I have to sort out, on some platforms the test numbers don't come out in the right order. Does not affect operation but messes up testing. Show quoted text

> > Thank you for the great job you do! >

You are welcome. I'll try to get an update out in the next week or two when I get some spare time. Michael

Thu Nov 06 19:20:58 2008 The RT System itself - Status changed from 'new' to 'open'

Fri Nov 07 03:41:28 2008 croco [...] openwall.com - Correspondence added

Subject:	Re: [rt.cpan.org #40734] missing dependencies
Date:	Fri, 7 Nov 2008 11:40:57 +0300
To:	"michael [...] arangen.net via RT" <bug-Net-DNSBL-Monitor [...] rt.cpan.org>
From:	"Andrey V. Stolyarov" <croco [...] openwall.com>

Hi Michael, thank you for the prompt answer! On Thu, Nov 06, 2008 at 07:20:59PM -0500, michael@arangen.net via RT wrote: Show quoted text

> something like specifying 0.0.0.0 and having that me "everything"? > That might work and I don't think it will break anything.

Yes, such a thing will work unless someone decides to use 0.0.0.0 as an 'answer code' for a specific purpose :-) (there are many strange people around, you know). I think it could be better to allow the user specify smth. like 'accept => any', or 'accept_any => "comment"', etc, but, well, you are the author so you decide. For my current task, it doesn't matter what code is returned, it only matters whether there's an answer (as such) or not: I've got a list of ip addresses and what I need is a periodic checking whether any of them is listed anywhere, just to let the customer know (s)he has a (potential) problem. Show quoted text

> > The trouble is that all MTAs I know do not pay > > attention to particular address, instead blocking email from a host

> > most MTA's I can think of allow you to explicitly specify the return > address they will honor. That's not the default behavior however.

This doesn't help me in solving my problem. The problem is to promptly notify my customer whether his/her address is listed anywhere at all, that is, whether mail from it could be rejected by some mailservers around the world. Obviously I can't force all the world to reconfigure their mailservers. Show quoted text

> > for which _any_ response exists, _and_ I know at least one (private) > > DNSBL zone in which the address in each A RR is used to represent the > > date/time when the listing occured, so it is impossible to explicitly > > list all the possible 'return codes'.

> > That's a design issue. Probably not the best way to implement a > DNSBL.

I agree -- that is, I wouldn't implement my own DNSBL this way. Show quoted text

> You are welcome. I'll try to get an update out in the next week or > two when I get some spare time. > > Michael

Thanks in advance! -- Croco

Fri Nov 07 18:44:50 2008 michael [...] arangen.net - Correspondence added

Subject:	Re: [rt.cpan.org #40734] missing dependencies
Date:	Fri, 07 Nov 2008 15:44:25 -0800
To:	bug-Net-DNSBL-Monitor [...] rt.cpan.org
From:	michael [...] arangen.net

Show quoted text

> Queue: Net-DNSBL-Monitor > Ticket <URL: http://rt.cpan.org/Ticket/Display.html?id=40734 > > > Hi Michael, > > thank you for the prompt answer! > > On Thu, Nov 06, 2008 at 07:20:59PM -0500, michael@arangen.net via RT > wrote: >

> > something like specifying 0.0.0.0 and having that me "everything"? > > That might work and I don't think it will break anything.

> > Yes, such a thing will work unless someone decides to use 0.0.0.0 as > an 'answer code' for a specific purpose :-) (there are many strange > people around, you know). I think it could be better to allow the > user specify smth. like 'accept => any', or 'accept_any => > "comment"', etc, but, well, you are the author so you decide. For my > current task, it doesn't matter what code is returned, it only matters

Excellent idea. I'll look into implementing something like that. I don't recall what that particular piece of code looks like as it is quite old but the idea is workable. Michael Show quoted text

> whether there's an answer (as such) or not: I've got a list of ip > addresses and what I need is a periodic checking whether any of them > is listed anywhere, just to let the customer know (s)he has a > (potential) problem. >

> > > The trouble is that all MTAs I know do not pay > > > attention to particular address, instead blocking email from a > > > host

> > > > most MTA's I can think of allow you to explicitly specify the return > > address they will honor. That's not the default behavior however.

> > This doesn't help me in solving my problem. The problem is to > promptly notify my customer whether his/her address is listed anywhere > at all, that is, whether mail from it could be rejected by some > mailservers around the world. Obviously I can't force all the world > to reconfigure their mailservers. >

> > > for which _any_ response exists, _and_ I know at least one > > > (private) DNSBL zone in which the address in each A RR is used to > > > represent the date/time when the listing occured, so it is > > > impossible to explicitly list all the possible 'return codes'.

> > > > That's a design issue. Probably not the best way to implement a > > DNSBL.

> > I agree -- that is, I wouldn't implement my own DNSBL this way. >

> > You are welcome. I'll try to get an update out in the next week or > > two when I get some spare time. > > > > Michael

> > > Thanks in advance! > > > -- > Croco

Tue Nov 18 22:35:16 2008 michael [...] bizsystems.com - Correspondence added

Dependencies in Makefile.pl for most recent release

Tue Nov 18 22:35:18 2008 michael [...] bizsystems.com - Status changed from 'open' to 'resolved'