Re: Expired and invalid dated addresses go right through

2009/1/5 David Grimberg <[email protected]>:
> Kevin,
>
> Tagged addresses are not checked until after all the incoming rules have
> been checked.  The reason for this is simple.  If you generate a tagged
> keyword address and it gets compromised, the only ways to eliminate it are
> to a) black list it, or b) change your key file.  If tagged addresses were
> checked before your incoming rules you wouldn't be able to black list a bad
> tagged address, leaving only the changing of our key file which would
> invalidate ALL of your current tagged addresses.
>
> Therefore, your incoming rules are processed before the tagged addresses are
> checked for validity, and hence it's getting accepted by that "from * ok"
> rule at the end of your incoming rules.
>

I can see from the code that this is correct. However, I would have
expected invalid addresses to be discarded before the filter checks,
and valid addresses to still be checked by filters. In your example,
the hash check would pass but the blacklist filter would still kill
the mail. An invalid keyword address, on the other hand, would
indicate likely spam (a bad address harvester or using a shotgun
approach), and would be killed immediately.

I recognize now that there is at least one problem with this: An
expired dated address from a whitelisted person would be killed before
ever reaching the whitelist check.

I can imagine ways to get the best of both worlds. If filters could be
specified to match failed addresses (and, separately, expired
addresses) for example. Or if tags were checked first, and one of the
possible actions for a failed tag was "filter".

-Kevin

------------------------------------------------------------------------------
_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users