You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Anders Gustafsson <An...@pedago.fi> on 2018/10/29 13:55:19 UTC
Rule for a link with an numeric IP in body?
Is there such a rule already in 3.3.x? I would ideally want a version of that that adds to the spam score if it sees a x.x.x.x/unsubscribe link, possibly translated.
Asking here as regexps are not really my strong side.
--
Anders Gustafsson
Engineer, CNI, CNE6, ASE
Pedago, The Aaland Islands (N60 E20)
www.pedago.fi
phone +358 18 12060
mobile +358 40506 7099
Re: Rule for a link with an numeric IP in body?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Tue, 2018-10-30 at 13:56 +0000, RW wrote:
>
> I was using 3.4.2
>
> > simply appending /alphastring to the
> > bare IP caused it to be recognised by a URI rule. I was a little
> > surprised as I'd been expecting the httpd:// or https:// prefix
> > would
> > be required.
>
A thought: I wonder how many spammers put example.com/unsubscribe
rather than https://example.com/unsubscribe in the message body and so,
by inference would also use 127.0.0.1/unsubscribe rather than
https://127.0.0.1/unsubscribe
If this is what any of them do, then 3.4.2 should probably revert to
3.4.1 behaviour and recognise 111.222.333.444/somepathname as a URI.
Martin
Re: Rule for a link with an numeric IP in body?
Posted by RW <rw...@googlemail.com>.
On Mon, 29 Oct 2018 20:19:15 +0000
Martin Gregorie wrote:
> On Mon, 2018-10-29 at 18:18 +0000, RW wrote:
> > On Mon, 29 Oct 2018 17:26:29 +0000
> > Martin Gregorie wrote:
> >
> >
> > > describe MG_BARE_IP Bare IP in a URI
> > > body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
> > > uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/
> > > meta MG_BARE_IP (__MG_BAI0 || __MG_BAI1)
> > > score MG_BARE_IP 0.01
> > >
> > > Note that the bare IP - n.n.n.n - is NOT a URI and so must be a
> > > body
> > > text rule while the bare IP with a '/name' suffix is a URI and so
> > > is
> > > found by a URI rule.
> >
> > What I'm seeing is that an IP address is only identified as a URI if
> > there is a protocol. Having a path doesn't matter.
> >
> When I tested it here (SA 3.4.1),
I was using 3.4.2
> simply appending /alphastring to the
> bare IP caused it to be recognised by a URI rule. I was a little
> surprised as I'd been expecting the httpd:// or https:// prefix would
> be required.
Re: Rule for a link with an numeric IP in body?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2018-10-29 at 18:18 +0000, RW wrote:
> On Mon, 29 Oct 2018 17:26:29 +0000
> Martin Gregorie wrote:
>
>
> > describe MG_BARE_IP Bare IP in a URI
> > body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
> > uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/
> > meta MG_BARE_IP (__MG_BAI0 || __MG_BAI1)
> > score MG_BARE_IP 0.01
> >
> > Note that the bare IP - n.n.n.n - is NOT a URI and so must be a
> > body
> > text rule while the bare IP with a '/name' suffix is a URI and so
> > is
> > found by a URI rule.
>
> What I'm seeing is that an IP address is only identified as a URI if
> there is a protocol. Having a path doesn't matter.
>
When I tested it here (SA 3.4.1), simply appending /alphastring to the
bare IP caused it to be recognised by a URI rule. I was a little
surprised as I'd been expecting the httpd:// or https:// prefix would
be required.
Martin
Re: Rule for a link with an numeric IP in body?
Posted by RW <rw...@googlemail.com>.
On Mon, 29 Oct 2018 17:26:29 +0000
Martin Gregorie wrote:
> describe MG_BARE_IP Bare IP in a URI
> body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
> uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/
> meta MG_BARE_IP (__MG_BAI0 || __MG_BAI1)
> score MG_BARE_IP 0.01
>
> Note that the bare IP - n.n.n.n - is NOT a URI and so must be a body
> text rule while the bare IP with a '/name' suffix is a URI and so is
> found by a URI rule.
What I'm seeing is that an IP address is only identified as a URI if
there is a protocol. Having a path doesn't matter.
Re: Rule for a link with an numeric IP in body?
Posted by RW <rw...@googlemail.com>.
On Mon, 29 Oct 2018 14:53:51 -0500 (CDT)
David B Funk wrote:
> On Mon, 29 Oct 2018, Martin Gregorie wrote:
>
> > Note that technical computing discussions may validly contain bare
> > IPs, e.g. 127.0.0.1 is never a spam indication since it is the IP of
> > 'localhost' and so its appearance is not a spam indication. There
> > are other well-known IPs that are also not spam indications.
>
> Not to mention all the other ways that dotted-number strings can be
> used; EG version numbers of sofware.
The OP wants to detect unsubscribe links using IP addresses, so this is
a non-issue.
Re: Rule for a link with an numeric IP in body?
Posted by David B Funk <db...@engineering.uiowa.edu>.
On Mon, 29 Oct 2018, Martin Gregorie wrote:
> On Mon, 2018-10-29 at 15:55 +0200, Anders Gustafsson wrote:
>> Is there such a rule already in 3.3.x? I would ideally want a version
>> of that that adds to the spam score if it sees a x.x.x.x/unsubscribe
>> link, possibly translated.
>>
[snip..]
> describe MG_BARE_IP Bare IP in a URI
> body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
> uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/
> meta MG_BARE_IP (__MG_BAI0 || __MG_BAI1)
> score MG_BARE_IP 0.01
>
> Note that the bare IP - n.n.n.n - is NOT a URI and so must be a body
> text rule while the bare IP with a '/name' suffix is a URI and so is
> found by a URI rule. This is why I used two subrules joined by the
> meta-rule.
>
> Note that technical computing discussions may validly contain bare IPs,
> e.g. 127.0.0.1 is never a spam indication since it is the IP of
> 'localhost' and so its appearance is not a spam indication. There are
> other well-known IPs that are also not spam indications.
Not to mention all the other ways that dotted-number strings can be used;
EG version numbers of sofware.
I have libwmf installed on my machine and if I was discussing a programming
issue with it I might mention that the RPM I have is:
libwmf-0_2-7-0.2.8.4-lp150.2.6.x86_64
--
Dave Funk University of Iowa
<dbfunk (at) engineering.uiowa.edu> College of Engineering
319/335-5751 FAX: 319/384-0549 1256 Seamans Center
Sys_admin/Postmaster/cell_admin Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{
Re: Rule for a link with an numeric IP in body?
Posted by Martin Gregorie <ma...@gregorie.org>.
On Mon, 2018-10-29 at 15:55 +0200, Anders Gustafsson wrote:
> Is there such a rule already in 3.3.x? I would ideally want a version
> of that that adds to the spam score if it sees a x.x.x.x/unsubscribe
> link, possibly translated.
>
> Asking here as regexps are not really my strong side.
>
Here's a (partially) tested rule that can spot two forms of bare IP.
The the rule given below the __MG_BAI0 subrule recognises plain IPs.
i.e. n.n.n.n and the __MG_BAI1 recognises URIs like your example, i.e.
n.n.n.n/wwwww :
describe MG_BARE_IP Bare IP in a URI
body __MG_BAI0 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/
uri __MG_BAI1 /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\w*/
meta MG_BARE_IP (__MG_BAI0 || __MG_BAI1)
score MG_BARE_IP 0.01
Note that the bare IP - n.n.n.n - is NOT a URI and so must be a body
text rule while the bare IP with a '/name' suffix is a URI and so is
found by a URI rule. This is why I used two subrules joined by the
meta-rule.
Note that technical computing discussions may validly contain bare IPs,
e.g. 127.0.0.1 is never a spam indication since it is the IP of
'localhost' and so its appearance is not a spam indication. There are
other well-known IPs that are also not spam indications.
Martin
Sv: Re: Rule for a link with an numeric IP in body?
Posted by Anders Gustafsson <An...@pedago.fi>.
Thanks. I hd some issues installing 3.4, libc conflict IIRC so I Installed 3.3, but I have been planning to upgrade. I guess I will jut download the source tarball and build it on the system.
FWIW this system is not facing the internet. The MTA deposits incoming main into a folder where sa picks it up, processes and dumps into another, where the MTA picks it up.
Thanks for the ponters. I will have a peek.
>>> "Bill Cole" <sa...@billmail.scconsult.com> 2018-10-29 19:08 >>>
Do not run SpamAssassin 3.3.x. It is not safe. There have been multiple
serious security bugs fixed in the 3.4.x series.
Re: Rule for a link with an numeric IP in body?
Posted by Bill Cole <sa...@billmail.scconsult.com>.
On 29 Oct 2018, at 9:55, Anders Gustafsson wrote:
> Is there such a rule already in 3.3.x?
Do not run SpamAssassin 3.3.x. It is not safe. There have been multiple
serious security bugs fixed in the 3.4.x series.
However, the rules for 3.3.x and 3.4.x are identical. And yes, the rule
"NORMAL_HTTP_TO_IP" will catch http(s) URLs using dotted-quad IPs and
"NUMERIC_HTTP_ADDR" will catch http(s) URLs using a single decimal
number (which some resolvers will treat as an IP address)
> I would ideally want a version of that that adds to the spam score if
> it sees a x.x.x.x/unsubscribe link, possibly translated.
IP_LINK_PLUS does something similar that could be adapted pretty easily.
> Asking here as regexps are not really my strong side.
Well, if you look in the standard rule distribution (under
/var/lib/spamassassin/ or somewhere similar, depending on your platform)
you will find the file 20_uri_tests.cf, in which all of the standard
URI-based rules are defined, many with comments. Even if you're not a
wizard with regexps, you may be able to find rules there which you can
adapt to your own needs with simple changes.