mod_spamhaus whitelist example to allow a range of ips

Question

How would an example whitelist look like, that would whitelist a
range of all IPs from 123.123.0.0 - 123.123.255.255 ?

I have the whitelistfile in

/etc/spamhaus.wl

Answer 1

I spent a good half an hour searching the web and found absolutely no documentation regarding your question, neither in English nor in Italian (mod_spamhause author Luca Ercoli is Italian). We're not entirely out of luck, though. The mod_spamhause code was published on-line and we can have a look at how filters are handled in this unit. The part of the code relevant to your question is (in C++):

if ( (strchr(lista[count],'/') == NULL )){
  if ( strcmp(lista[count],r->connection->remote_ip) == 0  ) return 1;
}
else {
  sscanf(lista[count], "%[^/]/%u", ippi, &bitmask);
  sscanf(ippi, "%lu.%lu.%lu.%lu", &a, &b, &c, &d);
  first = (a << 24) + (b << 16) + (c << 8) + d;
  mask = (0xFFFFFFFF << (32 - bitmask));
  last = first + (~mask);
  first = htonl(first);
  last = htonl(last);
  in.s_addr = first;
  sscanf(inet_ntoa(in), "%d.%d.%d.%d", &a_min, &b_min, &c_min, &d_min);
  in.s_addr = last;
  sscanf(inet_ntoa(in), "%d.%d.%d.%d", &a_max, &b_max, &c_max, &d_max);
  sscanf(r->connection->remote_ip, "%d.%d.%d.%d", &a_daverificare, &b_daverificare, &c_daverificare, &d_daverificare);
  if (
     ((d_daverificare <=  d_max) && (d_daverificare >=  d_min)) &&
     ((c_daverificare <=  c_max) && (c_daverificare >=  c_min)) &&
     ((b_daverificare <=  b_max) && (b_daverificare >=  b_min)) &&
     ((a_daverificare <=  a_max) && (a_daverificare >=  a_min))
  ) return 1;
}

It's quite straight-forward, but if you don't read C++ then let's just sum it up that it will accept both individual IPs as well as CIDR ranges, formatted same as Apache does.

To answer your question then, according to this code, you can add a CIDR range 123.123.0.0/16 (that covers IPs 123.123.0.0 - 123.123.255.255) as a single line in your /etc/spamhaus.wl like so:

123.123.0.0/16

The published code would handle CIDR notation, however we have no way of knowing this code is actually in use with your mod_spamhaus build. If it doesn't work for you then I'd suggest you search for other builds, or compile your own version using SourceArchive.com published code.

Cheers!

Answer 2

After looking up the module, there is very little to no documentation on how it expects the whitelist to be. I would gather to guess that it will take CIDR based values or individual IPs.