changelog.. spamhaus drop fix

csirtgadgets · Jan 18, 2015 · f6a5943 · f6a5943
1 parent 69e1db0
commit f6a5943
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 5 deletions.
diff --git a/ChangeLog b/ChangeLog
@@ -1,5 +1,8 @@
 Revision history for cif-v1
 
+v1.0.4	2015-01-18
+    - fixed: https://github.com/collectiveintel/cif-v1/issues/83
+
 v1.0.3  2014-07-26
     - fixed default sorting for bin/cif
     - bugfix to domain/malware feed indexer

diff --git a/cif-smrt/lib/CIF/Smrt/Plugin/Preprocessor/Address.pm b/cif-smrt/lib/CIF/Smrt/Plugin/Preprocessor/Address.pm
@@ -16,12 +16,11 @@ sub process {
     $rec->{'address'} = lc($rec->{'address'});
 
     if($rec->{'address'} =~ /^$RE{'net'}{'CIDR'}{'IPv4'}{'-keep'}$/){
-    	my $max = $rules->{'max_prefix'} || 16;
+    	my $max = $rec->{'max_prefix'} || 14;
     	if ($2 < $max){
     		$rec->{'address'} = $1.'/'.$max;
     	}
     }
-
     return $rec;
 }
 

diff --git a/cif-smrt/rules/etc/spamhaus.cfg b/cif-smrt/rules/etc/spamhaus.cfg
@@ -10,13 +10,11 @@ regex_values = 'address,reference'
 assessment = 'suspicious'
 description = 'hijacked prefix'
 alternativeid = 'http://www.spamhaus.org/sbl/sbl.lasso?query=<reference>'
-max_prefix = 20
 
 [edrop]
 feed = 'http://www.spamhaus.org/drop/edrop.txt'
 regex = '^([^;][.\/0-9]+) ; (SBL[0-9]+)'
 regex_values = 'address,reference'
 assessment = 'suspicious'
 description = 'hijacked suballocation prefix' 
-alternativeid = 'http://www.spamhaus.org/sbl/sbl.lasso?query=<reference>'
-max_prefix = 16
+alternativeid = 'http://www.spamhaus.org/sbl/sbl.lasso?query=<reference>'