Mailing List Archive: Polishing Mail::SPF::Query

> Without having seen your patch, I am very reluctant to apply this to the
> official M:S:Q repository, because it is essentially a gross hack. Let's
> face it, M:S:Q does have some deficiencies that will never be resolved.

Indeed. I think we should leave it as it is and not even try to fix it. I
was just trying to picture what I was talking about.

> It not being able to do HELO and MAIL FROM checks separately is one of
> them.

Is it? As far as I'm concerned, it is able to do that. If you feed it a
sender address that meets its expectations of a sender address, it will
perform a MAIL FROM check and not a HELO check. On the other hand, if it
can't find a sender address, it will perform a HELO check. In both cases,
the same algorithm is used. This is documented too.

> Is it of much value for postfix-policyd-spf to work around this
> limitation in such an awkward way?

I don't consider it to be awkward, but that may be because I don't really
understand what it is that you find awkward. Basically, a HELO and MAIL
FROM check are essentially the same operation, just with different input
values (and the result will in many cases be treated different too). IMHO,
an SPF checker should not even need to know (or care) whether it is
performing a HELO or MAIL FROM check, this could be left to the calling
implementation as well (like postfix-policyd-spf in this case).
Personally, I would definitly prefer to have it that way, in order to be
able to decide whether I want to do either or both of these checks and act
differently on the results.

Arjen

> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (GNU/Linux)
>
> iD8DBQFDlhUywL7PKlBZWjsRAnM0AJwNjTVGPXVCLtiAfuRU+AF+JRgykwCfZVds
> DAcpixUTHhuz8To6fQ6/nPo=
> =TvmC
> -----END PGP SIGNATURE-----
>
> -------
> To unsubscribe, change your address, or temporarily deactivate your
> subscription,
> please go to
> http://v2.listbox.com/member/?listname=spf-devel@v2.listbox.com
>
>

--
Eindhoven - The Netherlands
Key fingerprint - 66 4E 03 2C 9D B5 CB 9B 7A FE 7E C1 EE 88 BC 57

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-devel@v2.listbox.com

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Julian Mehnle wrote:
> Craig Whitmore wrote:
> > My Changes included (not not limited to)
> >
> > Checking for a: with numbers
> > Check for more than 10 DNS Queries
> > Checking for anything after all
> > Checking for mx with a valud FQDN
> > Checking for valid ip4:
> > Check for people trying to use v=spf2.0/mfrom spf2.0/pra (not really
> > needed)
>
> Most of it sounds great. M:S:Q shouldn't begin touching SPFv2.x records
> _now_, though. Also, IIRC having mechanisms after "all" isn't
> technically invalid and thus should produce a warning at best, but since
> such a warning can only go to the receiver and not the domain owner, it
> would be mostly useless.
>
> Craig, are there some more detailed records of your changes, i.e. a
> changelog with references to the code, or an old mailing list thread
> between Scott and you, that I can read up on?

I have now finally had a chance to thoroughly review Craig's modifications
to M:S:Q and apply some of them to the trunk. From today's commit message
for r118[1]:

trunk/Query.pm
* Restrict number of SPF record lookups to a maximum of 10 (was: 20).
* mech_a(), mech_mx(): Check if domain is a valid FQDN, i.e. ends in
("." toplabel).
* mech_ip4():
* Return "unknown" (PermError) if no argument was given to ip4 mechanism.
* Don't auto-complete "1.2.3" CIDR specs to "1.2.3.0" as such an
abbreviated syntax isn't allowed by the SPF spec in the first place.
(Thanks to Craig Whitmore for pointing out the above issues!)
* Removed recursion depth counting, it was redundant to lookup counting.
* Explicitly initialize lookup count to 0 in new().
* Removed unused global "$softfail_supported" flag.
* Minor code and comment clean-ups.

References:
1. http://www.openspf.org/source/mail-spf-query-perl/trunk/Query.pm?view=diff&r1=118&r2=117
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDoibSwL7PKlBZWjsRAv2EAJ9BAZ/W30aNXgtWBnJzssJMKVICBACgnP6/
iJ4vnsVOmLdK3o4Fj0c+fFM=
=sV1N
-----END PGP SIGNATURE-----

-------
To unsubscribe, change your address, or temporarily deactivate your subscription,
please go to http://v2.listbox.com/member/?listname=spf-devel@v2.listbox.com