Mark Martinec wrote the following on 17/10/2006 13:51:
>
> You mean how to store p0f fingerprint to SQL logging database?
>
> Try the following:
>
> - add a field 'p0f' to table msgs:
> ALTER TABLE msgs ADD p0f varchar(255) DEFAULT '';
>
> - and apply the following change to amavisd:
>
>
> --- amavisd.orig Sat Oct 14 21:56:22 2006
> +++ amavisd Tue Oct 17 14:50:09 2006
> @@ -851,5 +851,6 @@
> 'upd_msg' =>
> 'UPDATE msgs SET content=?, quar_type=?, quar_loc=?, dsn_sent=?,'.
> - ' spam_level=?, message_id=?, from_addr=?, subject=? WHERE mail_id=?',
> + ' spam_level=?, message_id=?, from_addr=?, subject=?, p0f=?'.
> + ' WHERE mail_id=?',
> # 'ins_rcp' =>
> # 'INSERT INTO msgrcpt (mail_id, rid, time_num,'.
> @@ -14315,4 +14316,6 @@
> }
> $q_to = defined $q_to ? untaint($q_to) : '';
> + my($os_fp) = $msginfo->client_os_fingerprint;
> + $os_fp = substr($os_fp,0,255) if length($os_fp) > 255;
> my($content_type) = $msginfo->setting_by_contents_category({
> CC_VIRUS,'V', CC_BANNED,'B', CC_SPAM,'S', CC_SPAMMY,'s',
> @@ -14322,12 +14325,12 @@
> for ($quar_type,$content_type) { $_ = ' ' if !defined || /^ *\z/ }
> do_log(4,"save_info_final %s, %s, %s, %s, %s, %s, ".
> - "Message-ID: %s, From: '%s', Subject: '%s'",
> + "Message-ID: %s, From: '%s', Subject: '%s', p0f: '%s'",
> $mail_id, $content_type, $quar_type, $q_to, $dsn_sent,
> - $spam_level, $m_id, $from, $subj);
> + $spam_level, $m_id, $from, $subj, $os_fp);
> # update message record with additional information
> $conn_h->execute($sql_cl_r->{'upd_msg'},
> $content_type, $quar_type, $q_to, $dsn_sent,
> untaint($spam_level), untaint($m_id), untaint($from),
> - untaint($subj), $mail_id);
> + untaint($subj), untaint($os_fp), $mail_id);
> $conn_h->commit;
> };
>
Marc
In 2.4.4 I've uncommented the "# , p0f=?" in the sql statement. As this is not
logging into the p0f field in msgs I presumed some additional changes are still
required?
Can you let me know what they need to be?
Thanks
Alan
-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/
