Re: [AMaViS-user] p0f problem

[Vytautas K. <vy...@pl...>]

Thanks,
That works. Strange that I'm first who facing this problem on Fedora11 
with courier-0.62.1, amavisd-new-2.6.4 and p0f-2.0.8-5.fc11.

Mark Martinec rašė:
>> Seems your OS is providing IPv4 addresses in a form of 'IPv4-mapped
>> IPv6 addresses'. The p0f daemon only supports IPv4 addresses, and the
>> p0f-analyzer.pl does not rewrite an 'IPv4-mapped IPv6 addresses' into
>> an IPv4 address, so the query is ignored.
>>  
>> I can provide a patch for p0f-analyzer to rewrite 'IPv4-mapped IPv6
>>   addresses' into an IPv4 address for the sake of p0f daemon,
> 
> Try the following patch to p0f-analyzer.pl, which should treat
> an 'IPv4-mapped IPv6 addresses' as an IPv4 address:
> 
> 
> --- p0f-analyzer.pl~	2009-09-28 20:43:50.000000000 +0200
> +++ p0f-analyzer.pl	2009-09-28 20:43:24.000000000 +0200
> @@ -123,6 +123,15 @@
>              if ($src_ip =~ /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\z/) {
>                # IPv4
> -            } elsif ($src_ip =~ /^ (?: IPv6: )? [0-9a-f]{0,4}
> -                       (?: : [0-9a-f]{0,4} | \. [0-9]{1,3} ){2,8} \z/xsi) {
> +            } elsif ($src_ip =~ /^
> +                       (?: (?: IPv6: )? 0{0,4} (?: : 0{0,4} ){1,4} : FFFF : )?
> +                       ( \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} )\z/xsi) {
> +              $src_ip = $1;  # IPv4-mapped IPv6 address, alternative dec, form
> +            } elsif ($src_ip =~ /^ (?: IPv6: )?
> +                                   [0-9a-f]{0,4} (?: : [0-9a-f]{0,4} ){2,7}
> +                                 \z/xsi) {
> +              $src_ip =~ s/^IPv6://i;
> +            } elsif ($src_ip =~ /^ (?: IPv6: )?
> +                                   [0-9a-f]{0,4} (?: : [0-9a-f]{0,4} ){2,5} :
> +                                   \d{1,3} (?: \. \d{1,3} ){3} \z/xsi) {
>                $src_ip =~ s/^IPv6://i;
>              } else { undef $src_ip }
> 
> 
> 
> Mark
> 
> ------------------------------------------------------------------------------
> Come build with us! The BlackBerry® Developer Conference in SF, CA
> is the only developer event you need to attend this year. Jumpstart your
> developing skills, take BlackBerry mobile applications to market and stay 
> ahead of the curve. Join us from November 9-12, 2009. Register now!
> http://p.sf.net/sfu/devconf
> _______________________________________________
> AMaViS-user mailing list
> AMa...@li... 
> https://lists.sourceforge.net/lists/listinfo/amavis-user 
>  AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 
>  AMaViS-HowTos:http://www.amavis.org/howto/ 
>