View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0002812 | unreal | ircd | public | 2006-02-11 16:52 | 2006-02-11 17:05 |
| Reporter | djGrrr | Assigned To | |||
| Priority | normal | Severity | major | Reproducibility | have not tried |
| Status | closed | Resolution | no change required | ||
| Product Version | 3.2.4 | ||||
| Summary | 0002812: use of * in spamfilter incorectly matches all clients. | ||||
| Description | Basically, we added a spamfilter, because we were trying to stop a botnet that had the real name of "q-u-a-d-r-a", and although the spamfilter was not setup correctly, it definetly shouldn't have matched all users, heres the log of the spamfilters added to try and stop the botnet, all of which for some reason did not wotk [16:54:31] [N] *** Spamfilter added: '.*!.*@.*:q-u-a-d-r-a' [target: u] [action: gzline] [reason: botnet] on Sat Feb 11 20:22:37 2006 GMT (from [email protected]) [17:06:56] [N] [email protected] removed Spamfilter '.*!.*@.*:q-u-a-d-r-a' (set at Sat Feb 11 20:22:37 2006) [17:07:09] [N] *** Spamfilter added: '.*!.*@.*:q.u.a.d.r.a' [target: u] [action: gzline] [reason: botnet] on Sat Feb 11 20:35:15 2006 GMT (from [email protected]) [17:30:33] [N] *** Spamfilter added: '.*:q.u.a.d.r.a' [target: u] [action: gzline] [reason: botnet] on Sat Feb 11 20:58:38 2006 GMT (from [email protected]) [17:30:42] [N] *** Spamfilter added: 'q.u.a.d.r.a' [target: u] [action: gzline] [reason: botnet] on Sat Feb 11 20:58:47 2006 GMT (from [email protected]) [17:30:52] [N] tkl update for u@Z/reason='q.u.a.d.r.a'/[email protected]/set=1139691527/expire=0 [causedby: operhome.p2p-irc.net] [17:31:33] [N] *** Spamfilter added: 'q\-u\-a\-d\-r\-a' [target: u] [action: gzline] [reason: botnet] on Sat Feb 11 20:59:39 2006 GMT (from [email protected]) [17:31:49] [N] *** Spamfilter added: 'q*u*a*d*r*a' [target: u] [action: gzline] [reason: botnet] on Sat Feb 11 20:59:55 2006 GMT (from [email protected]) this was the last spamfilter, and it was the one that matched nearly all clients. instantly after that filter was added, over half of our clients got gzlined before we could get the spamfilter removed. | ||||
| Steps To Reproduce | obviously, we did not want to try and reprocude this bug as it would likely zline all users | ||||
| Additional Information | As a side note, we are still in the process of upgrading all our servers to 3.2.4 and are running a mixed environment. The spamfilter was added from a 3.2.4 server, but gzlines were added from all servers, independant of the server versions. | ||||
| 3rd party modules | |||||
|
|
actually come to think of it, its not a bug, q*u*a*d*r*a will match everything with an "a" in it, because of the *'s sorry for the report, we'll have to be more carefull next time, it zlined over 1000 clients :( |
|
|
Actually it is correct; the regex "q*u*a*d*r*a" is well.. bad.. or at least not what you want :P q*u*a*d*r*a means: 0 or more q's 0 or more u's [etc] Hence, anything (and nothing) matches this regex. EDIT: Hmm you are right, the last one is an 'a' so yeah.. anything with an 'a' is zlined ;p Just a hint when you are switched over to 3.2.4: use the 'warn' target when adding a regex, to check if it works ok, and if so.. remove it and add it with 'zline' or whatever you want ;). |
|
|
right ;) Well, hope my hint/tip will help to save you some future trouble ;). Is indeed NOT fun :P |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2006-02-11 16:52 | djGrrr | New Issue | |
| 2006-02-11 17:02 | djGrrr | Note Added: 0011211 | |
| 2006-02-11 17:04 | syzop | Note Added: 0011212 | |
| 2006-02-11 17:05 | syzop | Status | new => closed |
| 2006-02-11 17:05 | syzop | Note Added: 0011213 | |
| 2006-02-11 17:05 | syzop | Resolution | open => no change required |
| 2006-02-11 17:05 | syzop | Note Edited: 0011212 |
