Mailing List Archive: libspf2: "ip6" mechanism not working ?

libspf2: "ip6" mechanism not working ?

Feb 18, 2010, 11:15 AM

Post #1 of 3 (5665 views)

Hello,

If I publish a SPF record like this:

testspf.univ-paris1.fr descriptive text "v=spf1 ip6:2001:660:3305::71
ip4:193.55.96.71 -all"

then execute some queries on it using libspf2 (through the spfquery
command):

spfquery -i 193.55.96.71 -s testspf.univ-paris1.fr
-> pass

spfquery -i 2001:660:3305::71 -s testspf.univ-paris1.fr
-> fail

I would have expected both queries to return "pass".

Tested lipspf2/spfquery versions are: 1.2.5 and 1.2.9, with same faulty
results.
Testing environment is on Debian Lenny, libspf2 are from Debian packages
(Lenny and Sid).

I arrived to the conclusion of a libspf2 bug after seeing a
libspf2-linked mail filter (milter-greylist) not behave as expected on
incoming SPF-enabled IPv6 SMTP connexions. After thoroughly examining
the faulty SPF record, I concluded the SPF test should have passed,
whereas it failed. Then I did some manual queries using spfquery on the
same SPF record with same results. I then created the above simple test
SPF record which obviously illustrates the bug.

Could someone have a look at it ?

Best regards,

--
Benoit BRANCIARD
Pôle Infrastructures
Centre de ressources informatiques et du réseau (CRIR)
Université Paris 1 Panthéon-Sorbonne
http://crir.univ-paris1.fr
Tel. 01 44 07 89 68

--
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.

-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1007/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1007/
Powered by Listbox: http://www.listbox.com

Re: libspf2: "ip6" mechanism not working ? [ In reply to ]

Benoit.Branciard at univ-paris1

Nov 2, 2010, 9:13 AM

Post #2 of 3 (5064 views)

Permalink

Hi,

below is a message I posted some months ago about "ip6:" SPF mechanism
not being handled correctly by libspf2.

Googling in the mailing list archives, I found someone already
encountered the problem and submitted a patch:

http://www.gossamer-threads.com/lists/spf/devel/35098

(or
http://www.listbox.com/member/archive/1007/2009/09/sort/time_rev/page/1/entry/0:2/20090927002136:3C4C62B2-AB1D-11DE-A128-DAF452F05D7F/,
but without the patch attached).

I tested this patch (basically replacing an occurrence of
INET_ADDRSTRLEN by INET6_ADDRSTRLEN in spf_compile.c), and I confirm it
solves the "ip6" problem.

Could this patch be included in future releases of libspf2 ?

Le 18/02/2010 20:15, Benoit Branciard a écrit :
> Hello,
>
> If I publish a SPF record like this:
>
> testspf.univ-paris1.fr descriptive text "v=spf1 ip6:2001:660:3305::71
> ip4:193.55.96.71 -all"
>
> then execute some queries on it using libspf2 (through the spfquery
> command):
>
> spfquery -i 193.55.96.71 -s testspf.univ-paris1.fr
> -> pass
>
> spfquery -i 2001:660:3305::71 -s testspf.univ-paris1.fr
> -> fail
>
> I would have expected both queries to return "pass".
>
> Tested lipspf2/spfquery versions are: 1.2.5 and 1.2.9, with same faulty
> results.
> Testing environment is on Debian Lenny, libspf2 are from Debian packages
> (Lenny and Sid).
>
> I arrived to the conclusion of a libspf2 bug after seeing a
> libspf2-linked mail filter (milter-greylist) not behave as expected on
> incoming SPF-enabled IPv6 SMTP connexions. After thoroughly examining
> the faulty SPF record, I concluded the SPF test should have passed,
> whereas it failed. Then I did some manual queries using spfquery on the
> same SPF record with same results. I then created the above simple test
> SPF record which obviously illustrates the bug.
>
> Could someone have a look at it ?
>
>
> Best regards,
>

--
Benoit BRANCIARD

CRIR - SIS
Centre de Ressources Informatiques et du Réseau,
Service Infrastructures
http://crir.univ-paris1.fr
Université Paris 1 Panthéon-Sorbonne

Tel. 01 44 07 89 68

--
Ce message a ete verifie par MailScanner
pour des virus ou des polluriels et rien de
suspect n'a ete trouve.

-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1007/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1007/1311533-9e42a648
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311533&id_secret=1311533-d322f1f1
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311533&id_secret=1311533-d59c80a0&post_id=20101102121314:170FB588-E69C-11DF-B5C3-A439631276BD
Powered by Listbox: http://www.listbox.com

Re: libspf2: "ip6" mechanism not working ? [ In reply to ]

ume at mahoroba

Nov 2, 2010, 10:03 AM

Post #3 of 3 (5054 views)

Permalink

Hi,

>>>>> On Tue, 02 Nov 2010 17:13:07 +0100
>>>>> Benoit Branciard <Benoit.Branciard@univ-paris1.fr> said:

Benoit> below is a message I posted some months ago about "ip6:" SPF mechanism
Benoit> not being handled correctly by libspf2.

Benoit> Googling in the mailing list archives, I found someone already
Benoit> encountered the problem and submitted a patch:

Benoit> http://www.gossamer-threads.com/lists/spf/devel/35098

The patch in mention is applied in FreeBSD ports, and it fixed the
problem. However, there is one more patch related to an IPv6 issue.

http://cvsweb.netbsd.org/bsdweb.cgi/~checkout~/pkgsrc/mail/libspf2/patches/patch-aa?rev=1.1&content-type=text/plain&only_with_tag=MAIN

This one is also applied in FreeBSD ports.

Sincerely,

--
Hajimu UMEMOTO @ Business Solution System Development Div., Hitachi Ltd.
E-Mail: ume@bisd.hitachi.co.jp ume@mahoroba.org ume@{,jp.}FreeBSD.org
URL: http://www.imasy.org/~ume/

-------------------------------------------
Sender Policy Framework: http://www.openspf.org [http://www.openspf.org]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1007/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1007/1311533-9e42a648
Modify Your Subscription: https://www.listbox.com/member/?member_id=1311533&id_secret=1311533-d322f1f1
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=1311533&id_secret=1311533-d59c80a0&post_id=20101102130341:23B21CB6-E6A3-11DF-BE3E-991FAAC86864
Powered by Listbox: http://www.listbox.com