Bug#851388: Affects mtpolicyd

[gregor herrmann]

On Sun, 15 Jan 2017 01:55:13 -0500, Scott Kitterman wrote:

> In the mtpolicyd plugin for querying a spamassassin AWL database for 
> reputation there is:
> 
> lib/Mail/MtPolicyd/Plugin/SaAwlLookup.pm:    my $addr = NetAddr::IP->new6( 
> $ip.'/48' );
> 
> If I understand the bug correctly, then it's affected.

I don't think so.
The issue we're seeing is that resolving hostnames which have both an
IPv4 and IPv6 address fails. In this case here, the function
truncate_ip_v6 has the quoted line; $ip smells like an IP address and
not a hostname; truncate_ip_v6 is called from truncate_ip:

    if( $ip =~ /:/) {
        return $self->truncate_ip_v6($ip);
    }

which called from query_awl:

    my $ip_key = $self->truncate_ip( $ip );

which called from run():
	my $ip = $r->attr('client_address');
..
		sub { $self->query_awl( $addr, $ip ) } );


I don't think that $ip is a hostname in any of these functions.


Cheers.
gregor

-- 
 .''`.  https://info.comodo.priv.at/ - Debian Developer https://www.debian.org
 : :' : OpenPGP fingerprint D1E1 316E 93A7 60A8 104D  85FA BB3A 6801 8649 AA06
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: hons: feel
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: Digital Signature
URL: <http://lists.alioth.debian.org/pipermail/pkg-perl-maintainers/attachments/20170115/661fe371/attachment.sig>