Re: [Assp-test] preHeaderRe not working as expected, Chinese hack attempts HEAD /favicon.ico HTTP/1.0

2016-05-16 Thread K Post
We could do a 421 or 521 but with whatever message we wanted, like simply "terminated." That way malicious actors wouldn't be able to easily identify ASSP as the one saying that. A little security through obscurity - but it's really not important. If it's a pain to implement, don't. not worth

[Assp-test] fixes in assp 2.5.2 build 16137

2016-05-16 Thread Thomas Eckardt
Hi all, fixed in assp 2.5.2 build 16137: - the termination reply, if 'preHeaderRe' matched, was send to the wrong peer Thomas DISCLAIMER: *** This email and any files transmitted with it may be confidential, legally privileged and

Re: [Assp-test] preHeaderRe not working as expected, Chinese hack attempts HEAD /favicon.ico HTTP/1.0

2016-05-16 Thread Thomas Eckardt
>1) Give us the ability to customize the 421 message What else would you send? Reasonable and possibly better would be the permanent error - 521 I'll think about, if the permanent error is right in every state of the SMTP session. >2) Give us the ability to give the ip the extreme score

Re: [Assp-test] preHeaderRe not working as expected, Chinese hack attempts HEAD /favicon.ico HTTP/1.0

2016-05-16 Thread K Post
Thanks for working to fix this. Will you be changing it to send a close to our smtp server (or is that even necessary)? Would it be a big deal (and worthwhile) to: 1) Give us the ability to customize the 421 message 2) Give us the ability to give the ip the extreme score so that future attempts

Re: [Assp-test] preHeaderRe not working as expected, Chinese hack attempts HEAD /favicon.ico HTTP/1.0

2016-05-16 Thread Thomas Eckardt
The 421 is sent to wrong peer for preHeaderRe - this will be fixed. >Also, is there a way to have specific matches from preHeaderRe make the ip score extreme right away No. preHeaderRe is designed and used to protect assp from dangerous content. If a match is found for preHeaderRe, the