Making the Botnet plugin work with IPv6

[Yves Goergen <no...@unclassified.de>]

Hi there,

I've been upgrading to IPv6 yesterday and needed to find out that the
Botnet plugin causes false positives on every message that comes in from
an IPv6 address. The only information that I've found on that was a
thread from January 2010 [1] that contains some debug output and a "good
luck" wish. The plugin author doesn't seem to exist anymore.

Now I'd definitely like to make this work again. I needed to disable the
plugin for now. But unfortunately I can hardly read Perl and not write
very much of it. So I'll likely break more than I repair.

A problem seems to exist in Botnet.pm from line 760 on where the octets
of an IPv4 address are split and computed in some way. I believe the
easiest fix for now (as IPv6 isn't so widespread yet) would be to make
that function return false when it is passed an IPv6 address (check for
colon in the $ip variable).

I'm currently testing a rather simple fix: I've added the following line
to Botnet.cf to ignore anything from IPv6 (hope it works):

botnet_skip_ip :

Can anybody assist me with this issue?

[1]
http://www.mail-archive.com/users@spamassassin.apache.org/msg70589.html
(and other copies)

-- 
Yves Goergen "LonelyPixel" <no...@unclassified.de>
Visit my web laboratory at http://beta.unclassified.de

Re: Making the Botnet plugin work with IPv6

[RW <rw...@googlemail.com>]

On Mon, 20 Sep 2010 20:03:43 +0200
Yves Goergen <no...@unclassified.de> wrote:

 
> I'm currently testing a rather simple fix: I've added the following
> line to Botnet.cf to ignore anything from IPv6 (hope it works):
 

Alternately you can do this by rewriting the  BOTNET rule as a
metarule (see Botnet.variants.txt) and incorporating an IPv6
check into that.  I haven't checked, but it may be that not all of the
subtests fail under IPv6 and something can be salvaged.  Also some of
the functionality might be recreated using header rules e.g.
BOTNET_NORDNS could supplemented by RDNS_NONE.

Re: Making the Botnet plugin work with IPv6

[Yves Goergen <no...@unclassified.de>]

On 20.09.2010 20:03 CE(S)T, Yves Goergen wrote:
> I'm currently testing a rather simple fix: I've added the following line
> to Botnet.cf to ignore anything from IPv6 (hope it works):
> 
> botnet_skip_ip :

It doesn't seem to work. I received an e-mail via IPv6 that was sent to
the other MTA from a dial-up address, and Botnet catched it. This skip
thing only seems to use the next IP address it finds, which is the
sender's one and that is most often a dynamic address.

Anyway, are there alternative recommendations that I could use instead
of the Botnet plugin? The concept seems to be quite good, but the
implementation isn't so safe (and future-proof) anymore.

-- 
Yves Goergen "LonelyPixel" <no...@unclassified.de>
Visit my web laboratory at http://beta.unclassified.de