I just got the following in a spam message which was not identified by spamcopuri even though the numeric domain it is in sc.surbl.org
<a href=3D"http://69.63.161.232/?rid=3D1528%22%3E
The debug output shows that the uri is found by the SA modules but that SpamCopURI queries for the wrong hostname.
It should be querying 232.161.63.69.sc.surbl.org
debug: uri tests: Done uriRE debug: checking url: http://69.63.161.232/?rid%1528 debug: querying for 63.161..sc.surbl.org debug: Query failed for 63.161..sc.surbl.org
It looks like there are two problem is in SpamCopURI (v 0.15) in the routine _spamcop_uri
(1) # strip any non alpha characters off of the end # this is to fix a bug where url parsing in core SA # leaves parens and other junk on the URL that URI # parses to the host
This causes the domain to become 69.63.161. (including a trailing dot)
(2) The domain is stripped back to a two level domain even though it is/should be an ip address. It becomes 63.161. (including a trailing dot)
This domain then does not match an ip address format so it is not reversed and the lookup is done for 63.161. added on to .sc.surbl.org, i.e.:
63.161..sc.surbl.org
Eric, can you help?
John
I have this fixed now in my subversion tree. I will release 0.16 sometime tonight to fix this. This basically affects all hosts that have a number greater 9 in the last octet. Sorry about this.
--eric
On Fri, May 14, 2004 at 08:38:40PM +0200, John Fawcett wrote:
I just got the following in a spam message which was not identified by spamcopuri even though the numeric domain it is in sc.surbl.org
<a href=3D"http://69.63.161.232/?rid=3D1528%22%3E
The debug output shows that the uri is found by the SA modules but that SpamCopURI queries for the wrong hostname.
It should be querying 232.161.63.69.sc.surbl.org
debug: uri tests: Done uriRE debug: checking url: http://69.63.161.232/?rid%1528 debug: querying for 63.161..sc.surbl.org debug: Query failed for 63.161..sc.surbl.org
It looks like there are two problem is in SpamCopURI (v 0.15) in the routine _spamcop_uri
(1) # strip any non alpha characters off of the end # this is to fix a bug where url parsing in core SA # leaves parens and other junk on the URL that URI # parses to the host
This causes the domain to become 69.63.161. (including a trailing dot)
(2) The domain is stripped back to a two level domain even though it is/should be an ip address. It becomes 63.161. (including a trailing dot)
This domain then does not match an ip address format so it is not reversed and the lookup is done for 63.161. added on to .sc.surbl.org, i.e.:
63.161..sc.surbl.orgEric, can you help?
John _______________________________________________ Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss
----- Original Message ----- From: "Eric Kolve"
I have this fixed now in my subversion tree. I will release 0.16 sometime tonight to fix this. This basically affects all hosts that have a number greater 9 in the last octet. Sorry about this.
--eric
That was fast :-)
Thanks for all the work you put into SpamCopURI.
John
Just released 0.16. Nothing major other than the fix for IP handling.
http://sourceforge.net/projects/spamcopuri
--eric
On Sat, May 15, 2004 at 08:22:55AM +0200, John Fawcett wrote:
----- Original Message ----- From: "Eric Kolve"
I have this fixed now in my subversion tree. I will release 0.16 sometime tonight to fix this. This basically affects all hosts that have a number greater 9 in the last octet. Sorry about this.
--eric
That was fast :-)
Thanks for all the work you put into SpamCopURI.
John
Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss
-
Eric Kolve -
Jeff Chan -
John Fawcett