policyd-spf: IndexError: list index out of range
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
SPF Engine |
Fix Released
|
Medium
|
Scott Kitterman |
Bug Description
After updating from spf-engine version 2.9.3 to 3.0.3 (on FreeBSD) I'm getting the following errors from policyd-spf on my syslog:
Apr 6 09:33:17 mail policyd-spf[3692]: Traceback (most recent call last):
Apr 6 09:33:17 mail policyd-spf[3692]: File "/usr/local/
Apr 6 09:33:17 mail policyd-spf[3692]: File "/usr/local/
Apr 6 09:33:17 mail policyd-spf[3692]: IndexError: list index out of range
Downgrading to version 2.9.3 makes the problem go away again...
I've tracked the problem down to local network email messages containing recipients without a '@' - recipients like 'sysadmin' 'netadmin'
The originating systems are internal/local systems - and their ip/netmask is already added both to skip_adresses and Whitelists to keep them out of SPF checks - but these checks are never reached before policyd-spf errors out...
The problem is introduced in commit:
commit fa82ae0e8c57183
Author: Scott Kitterman <email address hidden>
AuthorDate: Sun Nov 27 19:35:58 2022 -0500
Commit: Scott Kitterman <email address hidden>
CommitDate: Sun Nov 27 19:36:29 2022 -0500
Changed recipient tracking to only use recipient host name (per RFC 7208) in the policy server if per user processing is not being used and as a result, changedHide_
Besides being a plain error - this could be misused as a denial-of-service vector by making lots of requests with recipients without '@' in their email addresses
Details: FreeBSD 13.1 with postfix 3.7.4
Changed in spf-engine: | |
status: | Fix Committed → Fix Released |
I think that's an odd recipient. Definitely not a case I'd considered, but it's easy enough to fix, so I'll take care of it. Thanks for the report.