On Fri, 29 Jan 2010 06:43:02 -0800 Bill Landry <b...@inetmsg.com> wrote:
> Mark Martinec wrote: > > On Thursday 28 January 2010 14:40:56 Graham Murray wrote: > >> Since upgrading to SA 3.3.0, botnet (version 0.8) is showing a > >> false positive on every email I receive via IPv6. > > > > Has anyone contacted the author? > > As most here on the list know: "Good luck with that". From what I've > seen botnet is an orphaned project, and the author is non-responsive > to reported issues and user requests. If you really want this fixed, > someone else other than the author will most likely need to provide a > patch. The BOTNET eval test is equivalent to: meta BOTNET (BOTNET_CLIENT || BOTNET_BADDNS || BOTNET_NORDNS) && ! BOTNET_SOHO As a workaround I would suggest BOTNET be redefined as above but with an additional IPV6 exclusion to avoid the FPs. Then take a look at the individual subtest results to see if any functionality can be salvaged for IPv6.
