There is a bug in the policytest.c program, which makes Zmailer an OPEN RELY!!!

["Anton Shapiro" <ashapiro@bluecatnetworks.com>]

There is a bug in the policytest.c program, which makes Zmailer an OPEN RELY. Given simple smtp-policy.src file just to illustrate the problem.

#| Built-in Policies
[127.0.0.1]/32  fulltrustnet +  relaycustnet +
.       relaycustnet -

#| Allow delivery to all local names
test41  relaytarget +

#| Source Policy Entries
[0.0.0.0]/0     relaycustnet -

#| Sender Policy Entries
.       rejectsource -
hotmail.com     rejectsource +

#| Recipient Policy Entries
.       relaytarget -

If my understanding is correct, this setting will make it impossible to send mail to any recipient, but here is the fragment of SMTP conversation with Zmailer initialized with this policy file:

  
220-test41 Bluecat Networks Inc. Meridius Security Gateway
220 test41 ESMTP our local time is now Wed, 3 Mar 2004 11:10:08 -0500
helo
250 test41 Hello
mail from:<user@domain.com>
250 2.0.0 Ok (verified) Ok
rcpt to:<anotheruser@anotherdomain.com>
550 5.7.1 Hello [172.17.0.165], Policy rejection on the target address: <another
user@anotherdomain.com>
rcpt to:<anothet
501 5.1.7 Missing ending '>' bracket: anothet
rcpt to:<anybody@hotmail.com>
250 2.0.0 Ok (verified) Ok
data
354 Start mail input; end with <CRLF>.<CRLF>
This mail will be relayed!!
.
250 2.0.0 accepted; S97813AbUCCQNM


So we can see here that we are able to send mail to any body at hotmail.com, which make Zmailer to be an open relay. I traced down the problem and it appears that policytest.c file have a bug in finding right policy element. The idea is to select the most specific element, which in the case above is hotmail.com, and check it's parameters. But element hotmail.com does not have any parameters suitable in the recipient context, and there is no logic build, which allow finding right element, so at the end the default action is taken, which results in the acceptance of the mail. 

Matti, you may want to look at this.
This problem is present in 2.99.56 version and below, so all the versions below that one is affected.
I have attempted to solve the problem, and it seems to fix this issue. I can provide a code, which has the fix in it, if any body interested.

If you think I am wrong in some way, please correct me.

Anton.     

-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to majordomo@nic.funet.fi