From johnml@michaweb.net Fri May 14 20:39:02 2004
From: John Fawcett <johnml@michaweb.net>
To: discuss@lists.surbl.org
Subject: [SURBL-Discuss] Domain not identified by SpamCopURI
Date: Fri, 14 May 2004 20:38:40 +0200
Message-ID: <0d2d01c439e2$b6cac270$2001a8c0@michaweb.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============2541751396578137380=="

--===============2541751396578137380==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

I just got the following in a spam message  which was 
not identified by spamcopuri even though the numeric
domain it is in sc.surbl.org

<a href=3D"http://69.63.161.232/?rid=3D1528">

The debug output shows that the uri is found
by the SA modules but that SpamCopURI 
queries for the wrong hostname.

It should be querying 232.161.63.69.sc.surbl.org

> debug: uri tests: Done uriRE
> debug: checking url: http://69.63.161.232/?rid%1528
> debug: querying for 63.161..sc.surbl.org
> debug: Query failed for 63.161..sc.surbl.org

It looks like there are two problem is in SpamCopURI 
(v 0.15) in the routine _spamcop_uri 
 
(1)
    # strip any non alpha characters off of the end
    # this is to fix a bug where url parsing in core SA
    # leaves parens and other junk on the URL that URI
    # parses to the host

This causes the domain to become 69.63.161. 
(including a trailing dot)

(2) The domain is stripped back to a two level domain
even though it is/should be an ip address.
It becomes 63.161. (including a trailing dot)

This domain then does not match an ip address format
so it is not reversed and the lookup is done for 
63.161. added on to .sc.surbl.org, i.e.:

    63.161..sc.surbl.org

Eric, can you help?

John

--===============2541751396578137380==--


From ekolve@comcast.net Sat May 15 01:58:36 2004
From: Eric Kolve <ekolve@comcast.net>
To: discuss@lists.surbl.org
Subject: Re: [SURBL-Discuss] Domain not identified by SpamCopURI
Date: Fri, 14 May 2004 16:57:51 -0700
Message-ID: <20040514235751.GA13467@requiem>
In-Reply-To: <0d2d01c439e2$b6cac270$2001a8c0@michaweb.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============7558839844956865003=="

--===============7558839844956865003==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

I have this fixed now in my subversion tree.  I will release
0.16 sometime tonight to fix this.  This basically affects
all hosts that have a number greater 9 in the last octet.  Sorry
about this.

--eric


On Fri, May 14, 2004 at 08:38:40PM +0200, John Fawcett wrote:
> I just got the following in a spam message  which was 
> not identified by spamcopuri even though the numeric
> domain it is in sc.surbl.org
> 
> <a href=3D"http://69.63.161.232/?rid=3D1528">
> 
> The debug output shows that the uri is found
> by the SA modules but that SpamCopURI 
> queries for the wrong hostname.
> 
> It should be querying 232.161.63.69.sc.surbl.org
> 
> > debug: uri tests: Done uriRE
> > debug: checking url: http://69.63.161.232/?rid%1528
> > debug: querying for 63.161..sc.surbl.org
> > debug: Query failed for 63.161..sc.surbl.org
> 
> It looks like there are two problem is in SpamCopURI 
> (v 0.15) in the routine _spamcop_uri 
>  
> (1)
>     # strip any non alpha characters off of the end
>     # this is to fix a bug where url parsing in core SA
>     # leaves parens and other junk on the URL that URI
>     # parses to the host
> 
> This causes the domain to become 69.63.161. 
> (including a trailing dot)
> 
> (2) The domain is stripped back to a two level domain
> even though it is/should be an ip address.
> It becomes 63.161. (including a trailing dot)
> 
> This domain then does not match an ip address format
> so it is not reversed and the lookup is done for 
> 63.161. added on to .sc.surbl.org, i.e.:
> 
>     63.161..sc.surbl.org
> 
> Eric, can you help?
> 
> John
> _______________________________________________
> Discuss mailing list
> Discuss(a)lists.surbl.org
> http://lists.surbl.org/mailman/listinfo/discuss

--===============7558839844956865003==--


From jeffc@surbl.org Sat May 15 03:35:32 2004
From: Jeff Chan <jeffc@surbl.org>
To: discuss@lists.surbl.org
Subject: Re: [SURBL-Discuss] Domain not identified by SpamCopURI
Date: Fri, 14 May 2004 18:35:27 -0700
Message-ID: <184763205.20040514183527@supranet.net>
In-Reply-To: <20040514235751.GA13467@requiem>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8201583769210870097=="

--===============8201583769210870097==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

On Friday, May 14, 2004, 4:57:51 PM, Eric Kolve wrote:
> I have this fixed now in my subversion tree.  I will release
> 0.16 sometime tonight to fix this.  This basically affects
> all hosts that have a number greater 9 in the last octet.  Sorry
> about this.

Thanks!  :-)

Jeff C.

--===============8201583769210870097==--


From johnml@michaweb.net Sat May 15 08:23:12 2004
From: John Fawcett <johnml@michaweb.net>
To: discuss@lists.surbl.org
Subject: Re: [SURBL-Discuss] Domain not identified by SpamCopURI
Date: Sat, 15 May 2004 08:22:55 +0200
Message-ID: <0dec01c43a45$1432bb40$2001a8c0@michaweb.net>
In-Reply-To: <20040514235751.GA13467@requiem>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============6819012157985374863=="

--===============6819012157985374863==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

----- Original Message ----- 
From: "Eric Kolve" 
> I have this fixed now in my subversion tree.  I will release
> 0.16 sometime tonight to fix this.  This basically affects
> all hosts that have a number greater 9 in the last octet.  Sorry
> about this.
> 
> --eric

That was fast :-)

Thanks for all the work you put into SpamCopURI.

John

--===============6819012157985374863==--


From ekolve@comcast.net Sat May 15 10:05:44 2004
From: Eric Kolve <ekolve@comcast.net>
To: discuss@lists.surbl.org
Subject: Re: [SURBL-Discuss] Domain not identified by SpamCopURI
Date: Sat, 15 May 2004 01:05:06 -0700
Message-ID: <20040515080506.GA14670@requiem>
In-Reply-To: <0dec01c43a45$1432bb40$2001a8c0@michaweb.net>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============3442148435283482937=="

--===============3442148435283482937==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit

Just released 0.16.  Nothing major other than the fix for IP handling.


http://sourceforge.net/projects/spamcopuri


--eric



On Sat, May 15, 2004 at 08:22:55AM +0200, John Fawcett wrote:
> ----- Original Message ----- 
> From: "Eric Kolve" 
> > I have this fixed now in my subversion tree.  I will release
> > 0.16 sometime tonight to fix this.  This basically affects
> > all hosts that have a number greater 9 in the last octet.  Sorry
> > about this.
> > 
> > --eric
> 
> That was fast :-)
> 
> Thanks for all the work you put into SpamCopURI.
> 
> John
> 
> _______________________________________________
> Discuss mailing list
> Discuss(a)lists.surbl.org
> http://lists.surbl.org/mailman/listinfo/discuss

--===============3442148435283482937==--