[packages/exim-surbl] Release 2. Fix SURBL decoding, configurable resolvers, fresh TLD lists.
arekm
arekm at pld-linux.org
Mon Aug 24 14:11:29 CEST 2026
commit ab1f353ef855111783884970d51e7f3e2f15ca58
Author: Arkadiusz Miśkiewicz <arekm at maven.pl>
Date: Mon Aug 24 14:11:00 2026 +0200
Release 2. Fix SURBL decoding, configurable resolvers, fresh TLD lists.
config.patch | 2 +
exim-surbl.spec | 9 +++-
ip-meaning.patch | 50 +++++++++++++--------
path.patch | 2 +
public_resolvers.patch | 115 +++++++++++++++++--------------------------------
5 files changed, 84 insertions(+), 94 deletions(-)
---
diff --git a/exim-surbl.spec b/exim-surbl.spec
index 08ff949..3cd99ca 100644
--- a/exim-surbl.spec
+++ b/exim-surbl.spec
@@ -1,11 +1,15 @@
Summary: Blocking Spam in Exim with URI Block Lists
Name: exim-surbl
Version: 2.4
-Release: 1
+Release: 2
License: GPL
Group: Networking/Daemons/SMTP
Source0: https://www.teuton.org/~ejm/exim_surbl/exim_surbl-%{version}.tar.gz
# Source0-md5: 8aefd22e5c19207b0452e75aa016020f
+Source1: https://www.surbl.org/static/two-level-tlds
+# Source1-md5: b5a4ebb7f4ac311e41173d397e64f36a
+Source2: https://www.surbl.org/static/three-level-tlds
+# Source2-md5: d85f3d18f5d3c1959f500b3804399412
Patch0: path.patch
Patch1: config.patch
Patch2: public_resolvers.patch
@@ -45,7 +49,8 @@ install -d $RPM_BUILD_ROOT%{_datadir}/%{name}
chmod 755 exim_surbl.pl
cp -p exim_surbl.pl $RPM_BUILD_ROOT%{_datadir}/%{name}
-cp -p config.ini surbl_whitelist.txt three-level-tlds two-level-tlds $RPM_BUILD_ROOT%{_sysconfdir}/%{name}
+cp -p config.ini surbl_whitelist.txt $RPM_BUILD_ROOT%{_sysconfdir}/%{name}
+cp -p %{SOURCE1} %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/%{name}
%clean
rm -rf $RPM_BUILD_ROOT
diff --git a/config.patch b/config.patch
index 3a661d6..e2d7d2e 100644
--- a/config.patch
+++ b/config.patch
@@ -1,3 +1,5 @@
+Move the hardcoded tunables into /etc/exim-surbl/config.ini so they can be
+changed without editing the script.
diff -urN exim_surbl-2.3.org/config.ini exim_surbl-2.3/config.ini
--- exim_surbl-2.3.org/config.ini 1970-01-01 01:00:00.000000000 +0100
+++ exim_surbl-2.3/config.ini 2019-05-13 13:26:40.581571134 +0200
diff --git a/ip-meaning.patch b/ip-meaning.patch
index 49d3c6d..3fcc321 100644
--- a/ip-meaning.patch
+++ b/ip-meaning.patch
@@ -1,39 +1,55 @@
-diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
---- exim_surbl-2.3.org/exim_surbl.pl 2021-04-29 14:20:06.491533142 +0200
-+++ exim_surbl-2.3/exim_surbl.pl 2021-04-29 14:29:08.875363883 +0200
-@@ -120,6 +120,10 @@
+Don't treat "query blocked" and other non-listing answers as listings.
+SURBL and URIBL flag a refused query with bit 0 of the last octet; Spamhaus
+DBL uses codes outside its 127.0.1.0/24 listing range. Answers outside a
+list's own range are ignored too, so a resolver that rewrites NXDOMAIN
+cannot turn every URL into a reject.
+diff -urN exim_surbl-2.4.orig/exim_surbl.pl exim_surbl-2.4/exim_surbl.pl
+--- exim_surbl-2.4.orig/exim_surbl.pl 2026-08-24 13:38:35.801903706 +0200
++++ exim_surbl-2.4/exim_surbl.pl 2026-08-24 13:40:28.887554293 +0200
+@@ -123,8 +123,16 @@
# If gethostbyname() returned anything, build a return message.
$return_string = "";
if (scalar(@dnsbladdr) != 0) {
-+ if (inet_ntoa($dnsbladdr[0]) eq "127.0.0.1") {
-+ # query blacklisted
+- $return_string = "Blacklisted URL in message. (".$params[0].") in";
+ @surblipaddr = unpack('C4',($dnsbladdr[0])[0]);
++ if ($surblipaddr[0] != 127 || $surblipaddr[1] != 0 || $surblipaddr[2] != 0) {
++ # not a listing code
+ return "";
+ }
- $return_string = "Blacklisted URL in message. (".$params[0].") in";
- @surblipaddr = unpack('C4',($dnsbladdr[4])[0]);
++ if ($surblipaddr[3] & 1) {
++ # query blocked; no SURBL list uses bit 0
++ return "";
++ }
++ $return_string = "Blacklisted URL in message. (".$params[0].") in";
if ($surblipaddr[3] & 128) {
-@@ -150,6 +154,10 @@
+ $return_string .= " [CR]";
+ }
+@@ -151,8 +159,16 @@
+ # If gethostbyname() returned anything, build a return message.
+ $return_string = "";
if (scalar(@dnsbladdr) != 0) {
- $return_string = "Blacklisted URL in message. (".$params[0].") in";
+- $return_string = "Blacklisted URL in message. (".$params[0].") in";
@ipaddr = unpack('C4',($dnsbladdr[0])[0]);
++ if ($ipaddr[0] != 127 || $ipaddr[1] != 0 || $ipaddr[2] != 0) {
++ # not a listing code
++ return "";
++ }
+ if ($ipaddr[3] & 1) {
+ # query blocked
+ return "";
+ }
++ $return_string = "Blacklisted URL in message. (".$params[0].") in";
if ($ipaddr[3] & 8) {
$return_string .= " [red]";
}
-@@ -173,6 +181,15 @@
+@@ -176,6 +192,12 @@
# If gethostbyname() returned anything, build a return message.
$return_string = "";
if (scalar(@dnsbladdr) != 0) {
+ my $ip = inet_ntoa($dnsbladdr[0]);
-+ if ($ip eq "127.0.1.255") {
-+ # query blocked
-+ return "";
-+ }
-+ if (substr($ip, 0, length("127.0.1.")) ne "127.0.1.") {
-+ # non blocked meaning of ip
++ if (substr($ip, 0, length("127.0.1.")) ne "127.0.1."
++ || $ip eq "127.0.1.255") {
++ # query blocked or not a listing code
+ return "";
+ }
$return_string = "Blacklisted URL in message: ".$params[0];
diff --git a/path.patch b/path.patch
index 7b1dbe9..ae6c3eb 100644
--- a/path.patch
+++ b/path.patch
@@ -1,3 +1,5 @@
+Look for the TLD and whitelist data files in /etc/exim-surbl, where this
+package installs them, rather than upstream's /etc/exim.
diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
--- exim_surbl-2.3.org/exim_surbl.pl 2012-03-07 04:16:45.000000000 +0100
+++ exim_surbl-2.3/exim_surbl.pl 2019-05-13 12:52:14.053011594 +0200
diff --git a/public_resolvers.patch b/public_resolvers.patch
index 448bc91..cbc3a12 100644
--- a/public_resolvers.patch
+++ b/public_resolvers.patch
@@ -1,6 +1,23 @@
-diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
---- exim_surbl-2.3.org/exim_surbl.pl 2021-04-29 14:34:34.375671999 +0200
-+++ exim_surbl-2.3/exim_surbl.pl 2021-04-29 14:34:22.831973042 +0200
+Resolve blocklist names with Net::DNS instead of gethostbyname() so the
+nameservers can be set in config.ini; empty means /etc/resolv.conf. SURBL,
+URIBL and Spamhaus refuse queries arriving via public resolvers.
+getips() returns a plain address list, not gethostbyname()'s 5-element list,
+so the answer index in both callers becomes [0].
+diff -urN exim_surbl-2.4.orig/config.ini exim_surbl-2.4/config.ini
+--- exim_surbl-2.4.orig/config.ini 2026-08-24 13:38:11.826574679 +0200
++++ exim_surbl-2.4/config.ini 2026-08-24 13:52:55.571807814 +0200
+@@ -3,3 +3,8 @@
+ surbl_enable = 1
+ uribl_enable = 1
+ dbl_enable = 1
++# DNS servers for blocklist lookups, comma or space separated.
++# Empty means /etc/resolv.conf. SURBL, URIBL and Spamhaus refuse queries
++# arriving via public resolvers (8.8.8.8, 1.1.1.1), so prefer a local one.
++# nameservers = 127.0.0.1, 192.0.2.53
++nameservers =
+diff -urN exim_surbl-2.4.orig/exim_surbl.pl exim_surbl-2.4/exim_surbl.pl
+--- exim_surbl-2.4.orig/exim_surbl.pl 2026-08-24 13:38:11.827113210 +0200
++++ exim_surbl-2.4/exim_surbl.pl 2026-08-24 13:45:42.996272097 +0200
@@ -21,6 +21,27 @@
# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@@ -13,7 +30,7 @@ diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
+ my @params = @_;
+ my @addresses;
+ my $res = Net::DNS::Resolver->new(
-+ nameservers => ['8.8.8.8', '8.8.4.4', '1.1.1.1', '1.0.0.1'],
++ @nameservers ? (nameservers => \@nameservers) : ()
+ );
+ my $reply = $res->search($params[0], 'A');
+ if ($reply) {
@@ -29,7 +46,17 @@ diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
sub surblspamcheck
{
-@@ -93,7 +114,7 @@
+@@ -67,6 +88,9 @@
+ my $surbl_enable = $cfg->val('config', 'surbl_enable', 1);
+ my $uribl_enable = $cfg->val('config', 'uribl_enable', 0);
+ my $dbl_enable = $cfg->val('config', 'dbl_enable', 1);
++
++ # Package global: getips() is defined outside this sub and reads it there.
++ @nameservers = grep { length } split(/[,\s]+/, $cfg->val('config', 'nameservers', ''));
+
+ # Check to see if a decode MIME attachment is being checked or
+ # just a plain old text message with no attachments
+@@ -95,12 +119,12 @@
# the return message for the SURBL lookup.
my @params = @_;
my $surbldomain = ".multi.surbl.org";
@@ -38,7 +65,13 @@ diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
# If gethostbyname() returned anything, build a return message.
$return_string = "";
if (scalar(@dnsbladdr) != 0) {
-@@ -127,12 +148,12 @@
+ $return_string = "Blacklisted URL in message. (".$params[0].") in";
+- @surblipaddr = unpack('C4',($dnsbladdr[4])[0]);
++ @surblipaddr = unpack('C4',($dnsbladdr[0])[0]);
+ if ($surblipaddr[3] & 128) {
+ $return_string .= " [CR]";
+ }
+@@ -123,12 +147,12 @@
# the return message for the URIBL check.
my @params = @_;
my $uribldomain = ".black.uribl.com";
@@ -53,7 +86,7 @@ diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
if ($ipaddr[3] & 8) {
$return_string .= " [red]";
}
-@@ -152,7 +173,7 @@
+@@ -148,7 +172,7 @@
# the return message for the Spamhaus DBL check.
my @params = @_;
my $dbldomain = ".dbl.spamhaus.org";
@@ -62,71 +95,3 @@ diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
# If gethostbyname() returned anything, build a return message.
$return_string = "";
if (scalar(@dnsbladdr) != 0) {
-diff -urN exim_surbl-2.3.org/public_resolvers.patch exim_surbl-2.3/public_resolvers.patch
---- exim_surbl-2.3.org/public_resolvers.patch 1970-01-01 01:00:00.000000000 +0100
-+++ exim_surbl-2.3/public_resolvers.patch 2021-04-29 14:20:15.018469445 +0200
-@@ -0,0 +1,64 @@
-+diff -urN exim_surbl-2.3.org/exim_surbl.pl exim_surbl-2.3/exim_surbl.pl
-+--- exim_surbl-2.3.org/exim_surbl.pl 2012-03-07 04:16:45.000000000 +0100
-++++ exim_surbl-2.3/exim_surbl.pl 2021-04-29 14:20:06.491533142 +0200
-+@@ -19,6 +19,27 @@
-+ # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+ # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
-+ # THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-++use Net::DNS::Resolver;
-++use Socket;
-++
-++sub getips
-++{
-++ my @params = @_;
-++ my @addresses;
-++ my $res = Net::DNS::Resolver->new(
-++ nameservers => ['8.8.8.8', '8.8.4.4', '1.1.1.1', '1.0.0.1'],
-++ );
-++ my $reply = $res->search($params[0], 'A');
-++ if ($reply) {
-++ foreach my $rr ($reply->answer) {
-++ next unless $rr->type eq "A";
-++ #print $rr->address, "\n";
-++ push @addresses, inet_aton($rr->address);
-++ return $rr->address;
-++ }
-++ }
-++ return @addresses;
-++}
-+
-+ sub surblspamcheck
-+ {
-+@@ -91,7 +112,7 @@
-+ # the return message for the SURBL lookup.
-+ my @params = @_;
-+ my $surbldomain = ".multi.surbl.org";
-+- @dnsbladdr=gethostbyname($params[0].$surbldomain);
-++ @dnsbladdr=getips($params[0].$surbldomain);
-+ # If gethostbyname() returned anything, build a return message.
-+ $return_string = "";
-+ if (scalar(@dnsbladdr) != 0) {
-+@@ -125,12 +146,12 @@
-+ # the return message for the URIBL check.
-+ my @params = @_;
-+ my $uribldomain = ".black.uribl.com";
-+- @dnsbladdr=gethostbyname($params[0].$uribldomain);
-++ @dnsbladdr=getips($params[0].$uribldomain);
-+ # If gethostbyname() returned anything, build a return message.
-+ $return_string = "";
-+ if (scalar(@dnsbladdr) != 0) {
-+ $return_string = "Blacklisted URL in message. (".$params[0].") in";
-+- @ipaddr = unpack('C4',($dnsbladdr[4])[0]);
-++ @ipaddr = unpack('C4',($dnsbladdr[0])[0]);
-+ if ($ipaddr[3] & 8) {
-+ $return_string .= " [red]";
-+ }
-+@@ -150,7 +171,7 @@
-+ # the return message for the Spamhaus DBL check.
-+ my @params = @_;
-+ my $dbldomain = ".dbl.spamhaus.org";
-+- @dnsbladdr=gethostbyname($params[0].$dbldomain);
-++ @dnsbladdr=getips($params[0].$dbldomain);
-+ # If gethostbyname() returned anything, build a return message.
-+ $return_string = "";
-+ if (scalar(@dnsbladdr) != 0) {
================================================================
---- gitweb:
http://git.pld-linux.org/gitweb.cgi/packages/exim-surbl.git/commitdiff/ab1f353ef855111783884970d51e7f3e2f15ca58
More information about the pld-cvs-commit
mailing list