Skip to content
This repository

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse code

Ignore rwhois referrals, bumped version to 2.6

  • Loading branch information...
commit 988f5589b8501ddaeffcef7bfcc831a40700151a 1 parent ce68f88
Stefan Wold authored

Showing 2 changed files with 11 additions and 6 deletions. Show diff stats Hide diff stats

  1. +3 2 ChangeLog
  2. +8 4 ripecheck.tcl
5 ChangeLog
... ... @@ -1,6 +1,7 @@
1 1 ChangeLog:
2   -2.5:
3   - * Major bug fixed, ripecheck did not follow 'ReferralServer' from whois.
  2 +2.6: * Ignore rwhois referrals
  3 +
  4 +2.5: * Major bug fixed, ripecheck did not follow 'ReferralServer' from whois.
4 5 This could result in innocent hosts being banned. Unfortunatly a 'Country'
5 6 entry was available in Referral output, which of course ripecheck
6 7 used. Ripecheck should now have a lot less false positives.
12 ripecheck.tcl
... ... @@ -1,5 +1,5 @@
1 1 #
2   -# ripecheck.tcl Version: 2.5 Author: Stefan Wold <ratler@stderr.eu>
  2 +# ripecheck.tcl Version: 2.6 Author: Stefan Wold <ratler@stderr.eu>
3 3 ###
4 4 # Info:
5 5 # This script check unresolved ip addresses against a RIPE database
@@ -16,7 +16,7 @@
16 16 # * Now has help pages, see .help ripecheck
17 17 ###
18 18 # Require / Depends:
19   -# tcllib 1.8
  19 +# tcllib >= 1.8
20 20 ###
21 21 # Usage:
22 22 # Load the script and change the topdomains you
@@ -149,7 +149,7 @@ bind dcc -|- help _ripe_help_dcc
149 149 bind pub -|- !ripecheck _pubripecheck
150 150
151 151 # Global variables
152   -set ver "2.5"
  152 +set ver "2.6"
153 153 set maskarray [list]
154 154
155 155 # Parse ip list file
@@ -390,7 +390,7 @@ proc whois_callback { ip host nick channel orghost sock whoisdb test } {
390 390 putloglev $conflag * "ripecheck: DEBUG - Found whois referral server: $referral"
391 391
392 392 # Extract the whois server from $referral
393   - if {[regexp -line -nocase {r?whois://(.*[^/])/?} $referral -> referral]} {
  393 + if {[regexp -line -nocase {^whois://(.*[^/])/?} $referral -> referral]} {
394 394 foreach {referral whoisport} [split $referral :] { break }
395 395
396 396 # Set default port if empty
@@ -406,6 +406,10 @@ proc whois_callback { ip host nick channel orghost sock whoisdb test } {
406 406 whois_connect $ip $host $nick $channel $orghost $referral $whoisport $test
407 407
408 408 return 0
  409 + } elseif {[regexp -line -nocase {^rwhois://.*} $referral]} {
  410 + # Ignore rwhois for now
  411 + putloglev $conflag * "ripecheck: DEBUG - Ignoring rwhois referral"
  412 + continue
409 413 } else {
410 414 putlog "ripecheck: ERROR: Unknown referral type from '$whoisdb' for ip '$ip', please bug report this line."
411 415 close $sock; return -1

0 comments on commit 988f558

Please sign in to comment.
Something went wrong with that request. Please try again.