[Bug 7211] New: ASN shows ipv4 ranges on ipv6 recieved range

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Bug ID: 7211
Summary: ASN shows ipv4 ranges on ipv6 recieved range
Product: Spamassassin
Version: 3.4.1
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Plugins
Assignee: ***@spamassassin.apache.org
Reporter: ***@junc.eu

X-Spam-ASN: AS3215 2.0.0.0/16

Received: from ns2.example.org (unknown
[IPv6:2002:29dd:5ac:0:21e:c9ff:fee9:c077])
by example.net (Postfix) with ESMTPS id B8DA7E3AA
for <***@example.net.org>; Tue, 16 Jun 2015 01:36:40 +0100 (BST)

imho the ASN should show ipv6 range, if its not a ASN plugin bug is it a error
in ASN database ?

in that case how should spamassassin handle this ?

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Kevin A. McGrail <***@pccc.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@pccc.com
Resolution|--- |WORKSFORME
Status|NEW |RESOLVED

--- Comment #1 from Kevin A. McGrail <***@pccc.com> ---
I think it's a configuration error. For example, the IPv6 address below in
your example in reverse notation becomes

7.7.0.c.9.e.e.f.f.f.9.c.e.1.2.0.0.0.0.0.c.a.5.0.d.d.9.2.2.0.0.2

So the lookup becomes:

dig
7.7.0.c.9.e.e.f.f.f.9.c.e.1.2.0.0.0.0.0.c.a.5.0.d.d.9.2.2.0.0.2.aspath.routeviews.org.
IN TXT

That returns: ;; ANSWER SECTION:
2.0.0.2.aspath.routeviews.org. 86400 IN TXT "293 5511 3215" "2.0.0.0" "16"

Which means either perhaps we aren't doing IPv6 lookups correctly or
routeviews.org doesn't support IPv6. I'm guessing the later since it is
truncating all but the last 4 octets received (note the ANSWER section and
compare to the answer section below).

So looking up one of my IPs and using origin6.asn.cymru.com, I see:

6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.0.0.0.a.2.0.5.5.0.1.0.0.2.origin6.asn.cymru.com.
14400 IN TXT "174 | 2001:550::/32 | US | arin | 2002-12-17"

So I think you need something like this from the note in the ASN.pm

# Some zones also support IPv6 lookups, for example:
# asn_lookup origin6.asn.cymru.com [_ASN_ _ASNCIDR_]

I don't use this plugin so feedback appreciated perhaps on dev list since I'm
going to close this as worksforme for now.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Benny Pedersen <***@junc.eu> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@junc.eu
Resolution|WORKSFORME |---
Status|RESOLVED |REOPENED

--- Comment #2 from Benny Pedersen <***@junc.eu> ---
i see the same problem as you did, so not a config error here, reopen

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

--- Comment #3 from Kevin A. McGrail <***@pccc.com> ---
(In reply to Benny Pedersen from comment #2)

Post by b***@bugzilla.spamassassin.org
i see the same problem as you did, so not a config error here, reopen

What does your config lines relevant to ASN look like exactly? How have you
switched to origin6.asn.cymru.com, for example?

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

--- Comment #4 from Benny Pedersen <***@junc.eu> ---
so it needs configs in local.cf to work ?

if so its a default config error in 3.4.1

close this bug here with a local.cf that works both ipv4 and ipv6

perldoc is not very helpfull for me :/

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Kevin A. McGrail <***@pccc.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution|--- |WORKSFORME

--- Comment #5 from Kevin A. McGrail <***@pccc.com> ---
(In reply to Benny Pedersen from comment #4)

Post by b***@bugzilla.spamassassin.org
so it needs configs in local.cf to work ?
if so its a default config error in 3.4.1
close this bug here with a local.cf that works both ipv4 and ipv6
perldoc is not very helpfull for me :/

I don't use the ASN plugin so suggest you discuss on the users and/or dev@

The docs might need clarifying but they do mention that IPv6 is supported by
some zones and I'm gathering the default zone does not support IPv6.

My assumption is that some sort of config line like asn_lookup
origin6.asn.cymru.com _ASN_ _ASNCIDR_ line tells your ASN plugin to use that
name server.

Or you configure a locally cached copy of the information. I don't know your
volume, etc.

Regards,
KAM

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Andy Smith <andy-***@strugglers.net> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |andy-***@strugglers.
| |net

--- Comment #6 from Andy Smith <andy-***@strugglers.net> ---
Having read the documentation, unless I am missing something I cannot see how
this plugin can work when email is received from both IPv4 and IPv6 hosts.

The only way to specify a zone is "asn_lookup". If you do:

asn_lookup origin.asn.cymru.com _ASN_ _ASNCIDR_

this will work fine for mails that come in from IPv4 addresses, but when you
get one from an IPv6 address that happens to match, it will erroneously bring
back a match for an IPv4 address like 2.0.0.0/16.

If instead you do:

asn_lookup origin6.asn.cymru.com _ASN_ _ASNCIDR_

then no IPv4 query will ever match, but it will work for IPv6 queries. That
won't be very useful for most people since most mail comes in from IPv4
addresses.

If you try adding both then all queries will go to both zones, so the erroneous
answers will still be returned.

Doesn't this plugin need to separate out zones that accept v4 queries and zones
that accept v6 queries, so that one could for example do:

asn_lookup origin.asn.cymru.com _ASN_ _ASNCIDR_
asn_lookup_v6 origin6.asn.cymru.com _ASN_ _ASNCIDR_

and then have the plugin send only v4 queries to the asn_lookup zones and only
v6 queries to the asn_lookup_v6 zones?

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Bernhard Schmidt <***@birkenwald.de> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@birkenwald.de

--- Comment #7 from Bernhard Schmidt <***@birkenwald.de> ---
Is (obviously) still happening with 3.4.2.

Could someone please reopen this bug report? I know it's not easy to fix
because you need to query different zones for IPv4 and IPv6, but at least this
issue should be tracked.

Received: from muffat.debian.org (muffat.debian.org
[IPv6:2607:f8f0:614:1::1274:33])

--> X-Spam-ASN: AS3215 2.6.0.0/16

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

--- Comment #8 from J <***@protonmail.com> ---
Created attachment 5630
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5630&action=edit
Split lookups for IPv4 and IPv6 origin addresses.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

J <***@protonmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@protonmail.com

--- Comment #9 from J <***@protonmail.com> ---
Attached is proof of concept patch to ASN.pm to split lookups for IPv4 and IPv6
origin addresses.

So with the following in local.cf:

loadplugin Mail::SpamAssassin::Plugin::ASN
asn_lookup origin.asn.cymru.com _ASN_ _ASNCIDR_
asn_lookup_ipv6 origin6.asn.cymru.com _ASN_ _ASNCIDR_
add_header all ASN _ASN_ _ASNCIDR_

ASN resolution will now use the appropriate server based on the IP type as
tested against the IPV4_ADDRESS constant.

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

--- Comment #10 from Benny Pedersen <***@junc.eu> ---
confirmed it works, but it have a lint error

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Benny Pedersen <***@junc.eu> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|WORKSFORME |---

--- Comment #11 from Benny Pedersen <***@junc.eu> ---
another thing to solve maybe is if client ip is in internal_networks ip listed,
then X-Spam-ASN: is just empty, can it list that asn is not done if
internal_networks eq

X-Spam-ASN: skipped internal_networks

or if trusted_networks

X-Spam-ASN: skipped trusted_networks

and visa versa for other resons if skipped testing

reopen

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

J <***@protonmail.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #5630|0 |1
is obsolete| |

--- Comment #12 from J <***@protonmail.com> ---
Created attachment 5631
--> https://bz.apache.org/SpamAssassin/attachment.cgi?id=5631&action=edit
Split lookups for IPv4 and IPv6 origin addresses v2

- resolves lint warnings
- add brief pod description
- keep existing behaviour (ie. use the same zone for both address families)
unchanged if asn_lookup_ipv6 is undefined

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

Benny Pedersen <***@junc.eu> changed:

What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|REOPENED |RESOLVED

--- Comment #13 from Benny Pedersen <***@junc.eu> ---
works for me now

[b***@bugzilla.spamassassin.org]

https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7211

--- Comment #14 from J <***@protonmail.com> ---
I've been using this patch with ASN lookups enabled on two dual stack instances
for the last week, without issue.

Could this fix be committed?