I'm back. Unfortunately I'm not much liking what I see!

Eric S. Raymond esr at thyrsus.com
Wed Jan 22 21:21:43 CET 2003


Matthias Andree <matthias.andree at gmx.de>:
> You will need autoconf 2.53 and automake 1.6 or newer and then run:
> 
> autoreconf -f -i -s         # omitting the -s is safe
> 
> That's force, install-missing, symlink.

That worked.  Now, to whom do I apply for commit permissions so I can check
my changes in?   FYI, here's the current one...

--- token.c.~1.9.~	2003-01-22 15:01:35.000000000 -0500
+++ token.c	2003-01-22 15:12:37.000000000 -0500
@@ -150,6 +150,22 @@
 		const char *prefix="url:";
 		size_t len = strlen(prefix);
 		size_t avl = sizeof(save_text);
+		int q1, q2, q3;
+		/*
+		 * Trick collected by ESR in real time during John
+		 * Graham-Cummings's talk at Paul Graham's spam conference
+		 * in January 2003...  Some spammers know that people are
+		 * doing recognition on spamhaus IP addresses.  They use 
+		 * the fact that HTML clients normally interpret IP addresses 
+		 * by doing a simple accumulate-and-shift algorithm; they 
+		 * add large random multiples of 256 to the quads to
+		 * mask their origin.  Nuke the high bits to unmask the 
+		 * address.
+		 */
+		if (sscanf(save_text, "%d.%d.%d", &q1, &q2, &q3) == 3)
+		    /* safe because result string guaranteed to be shorter */
+		    sprintf(save_text, "%d.%d.%d", 
+			    q1 & 0xff, q2 & 0xff, q3 & 0xff);		    
 		yylval = save_text;
 		save_class = IPADDR;
 		avl -= strlcpy( yylval, "url:", avl);
-- 
		<a href="http://www.tuxedo.org/~esr/">Eric S. Raymond</a>




More information about the bogofilter-dev mailing list