gmane.mail.spam.spf.devel

Re:

May Ja — 2013-03-11T00:32:41

www.bangkok bank.com

May Ja <noiocon67< at >gmail.com> wrote:



-------------------------------------------
Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1007/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1007/6959932-f3d1312d
Modify Your Subscription: https://www.listbox.com/member/?member_id=6959932&id_secret=6959932-d95100fc
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=6959932&id_secret=6959932-4aedb9c4&post_id=20130310203231:26D77284-89E3-11E2-97FD-84F073884046
Powered by Listbox: http://www.listbox.com

(unknown)

May Ja — 2013-03-10T16:53:47


-------------------------------------------
Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1007/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1007/6959932-f3d1312d
Modify Your Subscription: https://www.listbox.com/member/?member_id=6959932&id_secret=6959932-d95100fc
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=6959932&id_secret=6959932-4aedb9c4&post_id=20130310125341:0DB0A432-89A3-11E2-B9D4-F65B79099B80
Powered by Listbox: http://www.listbox.com

Re: Actual results of testsuite runs, anyone?

William Ahern — 2012-09-05T17:09:16

PermError


Fail


Fail


These are for "spf.c", part of "dns.c" async DNS library.

Actual results of testsuite runs, anyone?

Alessandro Vesely — 2012-09-05T10:52:46

Hi,
some folks at the spfbis mailing list are wondering about how do
existing implementations treat the ambiguity of invalid-domain, when
there is no syntax error in an SPF record, but the domain is made
invalid by a macro expansion.

There are three relevant cases in the testsuite:

   invalid-domain-empty-label,
   invalid-domain-long, and
   invalid-domain-long-via-macro.

Those tests pass with either "permerror" or "fail".  Unfortunately,
only the success is usually reported, not the actual result.  If you
have such result for your product handy, would you please post it?

TIA

P.S.  I take this occasion to recall that RFC 6652 allows to request
reports of SPF evaluations, and limiting that to only errors is one of
its options.  For example, one can append to an SPF record the
modifiers "ra=spf-report rr=e", and see what spf-report< at >%{d} will get.

Catching DNS errors

Andre Nathan — 2012-06-21T15:06:58

Hello

Below is a simple C program using libspf2 to check the records for a
domain which is known not to have DNS problems:

$ host -t txt gwmail.bradescoseguros.com.br
;; connection timed out; no servers could be reached

When I call SPF_request_query_mailfrom(), I get an invalid result:

$ ./spf 
spf_compile.c:523    Debug: Parsing macro starting at Please%_see%
_http://www.openspf.org/Why?id=%{S}&ip=%{C}&receiver=%{R}
spf_compile.c:1210   Debug: Compiling record v=spf1 
spf_dns.c:54         Debug: DNS[cache] lookup:
gwmail.bradescoseguros.com.br SPF (99)
spf_dns.c:54         Debug: DNS[resolv] lookup:
gwmail.bradescoseguros.com.br SPF (99)
spf_dns_resolv.c:311 Debug: query failed: err = -1  Host name lookup
failure (2): gwmail.bradescoseguros.com.br
spf_dns.c:66         Debug: DNS[resolv] found record
spf_dns.c:69         Debug:     DOMAIN: gwmail.bradescoseguros.com.br
TYPE: SPF (99)
spf_dns.c:76         Debug:     TTL: 0  RR found: 0  herrno: 2  source:
resolv
spf_dns.c:66         Debug: DNS[cache] foun

LibSPF2 on windows

kevin.ray747 — 2012-04-23T08:56:43

Hi All,

Does anyone has successfully built libspf2-1.2.9 with Visual Studio on Windows? Even rebuild the sln file, there are still many errors. Like redefine and not defined.
Any help will be greatly appreciated.

Thanks



kevin.ray747


-------------------------------------------
Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]

Archives: https://www.listbox.com/member/archive/1007/=now
RSS Feed: https://www.listbox.com/member/archive/rss/1007/6959932-f3d1312d
Modify Your Subscription: https://www.listbox.com/member/?member_id=6959932&id_secret=6959932-d95100fc
Unsubscribe Now: https://www.listbox.com/unsubscribe/?member_id=6959932&id_secret=6959932-4aedb9c4&post_id=20120423045244:AF88B22E-8D21-11E1-86EE-B6962ED5CEF0
Powered by Listbox: http://www.listbox.com

libspf2 now managed on github

Shevek — 2012-01-28T09:03:45

It's only a little bit overdue (haha, really, haha) but you can now
submit patches to libspf2 as PRs on github.

https://github.com/shevek/libspf2

I will make an endeavour to get these in as soon as possible.

S.

Re: [Patch] fix unset received-spf header and return codes

Wolfgang Breyha — 2011-06-01T15:52:03

Hi again!

Sorry. I attached the wrong patch.

This is the right one now.

Greetings, Wolfgang

Wolfgang Breyha wrote, on 01.06.2011 17:46:

[Patch] fix unset received-spf header and return codes

Wolfgang Breyha — 2011-06-01T15:46:19

Hi!

The attached patch fixes two things in libspf2 1.2.9

*) if spf results to NONE or anything else without SPF record
   no received_header and comment was set

*) if DNS fails either temporary or permanent the result was (invalid).
   It returns TEMPERROR and PERMERROR now.

Greetings, Wolfgang

SPF_dns_lookup NO_DATA

2011-03-17T09:39:08

Hi,

I think I might have found a bug in the libspf2 library, please correct me
if I'm wrong. I wrote some code that uses SPF_dns_lookup to resolve an A
record. I get an answer, and the response includes the answer, but the
SPF_dns_lookup function returns NO_DATA (integer value of 4). As far as I
can see, this occurs when the response doesn't have an ADDITIONAL section.
I'll try to describe what the problem is below. In the function
SPF_dns_resolv_lookup the variable cnt is incremented per answer, but it is
reset per section (ns_sect) in the first for loop. Since I have no
ADDITIONAL section, which comes after the AUTHORITY section, cnt is reset
to 0 (zero). Outside the second for loop the following statement is placed:

spfrr->num_rr = cnt;

Then outside the first for loop the following if statement is placed.

if (spfrr->num_rr == 0)
     spfrr->herrno = NO_DATA;

I included some extra debug statements in the code, and the output looks as
follows:

spf_dns.c:54         Debug: DNS[cache] lookup: www.isc.or

[PATCH 2/2] spfquery: Simplify handling of the "result" buffer.

Florian Forster — 2011-01-23T14:51:12

From: Florian Forster <ff< at >octo.it>

This patch changes the "result" buffer to a character array of a fixed
size. Also, the result is now printed as

  status0,status1,status2

instead of:

  status0status1status2
---
 src/spfquery/spfquery.c |   33 ++++++++++++---------------------
 1 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/src/spfquery/spfquery.c b/src/spfquery/spfquery.c
index 1904c8a..a93a81c 100644
--- a/src/spfquery/spfquery.c
+++ b/src/spfquery/spfquery.c
< at >< at > -123,21 +123,16 < at >< at >
 #define WARN_ERROR do { res = 255; } while(0)
 #define FAIL_ERROR do { res = 255; goto error; } while(0)
 
-#define RESIZE_RESULT(n) do { \
-if (result == NULL) { \
-result_len = 256 + n; \
-result = malloc(result_len); \
-result[0] = '\0'; \
-} \
-else if (strlen(result) + n >= result_len) { \
-result_len = result_len + (result_len >> 1) + 8 + n; \
-result = realloc(result, result_len); \
-} \
-} while(0)
-#define APPEND_RESULT(n) do { \
-partial_result = SPF_strresult(n); \
-RESIZE_RESULT

[PATCH 1/2] spfquery: Fail with an appropriate error message when checking arguments.

Florian Forster — 2011-01-23T14:51:11

From: Florian Forster <ff< at >octo.it>

It's very annoying to be shown the "usage" output and not know *why*.

This patch prints an explanation to STDERR before the usage information,
so it's easier for users to recognize typos and misconceptions.
---
 src/spfquery/spfquery.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/spfquery/spfquery.c b/src/spfquery/spfquery.c
index c4dc5bb..1904c8a 100644
--- a/src/spfquery/spfquery.c
+++ b/src/spfquery/spfquery.c
< at >< at > -547,8 +547,13 < at >< at > int main( int argc, char *argv[] )
 else {
 fin = NULL;
 
-if ((req->ip == NULL) ||
-(req->sender == NULL && req->helo == NULL) ) {
+if (req->ip == NULL) {
+fprintf( stderr, "The required \"-ip\" option is missing.\n" );
+usage();
+FAIL_ERROR;
+}
+else if (req->sender == NULL && req->helo == NULL) {
+fprintf( stderr, "Either the \"-sender\" or \"-helo\" option is required.\n" );
 usage();
 FAIL_ERROR;
 }

[PATCH] libspf2/spf_request.c: Fix handling of email addresses in query_rcptto().

Florian Forster — 2011-01-23T14:47:53

From: Florian Forster <ff< at >octo.it>

The function SPF_request_query_rcptto() checks whether the "rcpt_to"
string argument contains the "< at >" character. If so, everything before the
at-sign is stripped. However, the at-sign itself left in front of the
string, so that the generated SPF record reads:

    v=spf1 mx:< at >example.com

The actual checking code then tries to resolve "< at >example.com" rather than
"example.com", fails and returns "neutral" even when it should return
"pass".

This patch adds the missing `rcpt_to_dom++` so the at-sign is stripped,
too.
---
 src/libspf2/spf_request.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/src/libspf2/spf_request.c b/src/libspf2/spf_request.c
index 7614141..b502fb2 100644
--- a/src/libspf2/spf_request.c
+++ b/src/libspf2/spf_request.c
< at >< at > -363,6 +363,8 < at >< at > SPF_request_query_rcptto(SPF_request_t *spf_request,
 rcpt_to_dom = strchr(rcpt_to, '< at >');
 if (rcpt_to_dom == NULL)
 rcpt_to_dom = rcpt_to;
+else
+rcpt_to_dom++;
 spf_request->cur_dom = r

Re: libspf2: "ip6" mechanism not working ?

Hajimu UMEMOTO — 2010-11-02T17:03:23

Hi,


Benoit> below is a message I posted some months ago about "ip6:" SPF mechanism
Benoit> not being handled correctly by libspf2.

Benoit> Googling in the mailing list archives, I found someone already
Benoit> encountered the problem and submitted a patch:

Benoit> http://www.gossamer-threads.com/lists/spf/devel/35098

The patch in mention is applied in FreeBSD ports, and it fixed the
problem.  However, there is one more patch related to an IPv6 issue.

http://cvsweb.netbsd.org/bsdweb.cgi/~checkout~/pkgsrc/mail/libspf2/patches/patch-aa?rev=1.1&content-type=text/plain&only_with_tag=MAIN

This one is also applied in FreeBSD ports.

Sincerely,

--
Hajimu UMEMOTO < at > Business Solution System Development Div., Hitachi Ltd.
E-Mail: ume< at >bisd.hitachi.co.jp ume< at >mahoroba.org  ume< at >{,jp.}FreeBSD.org
URL: http://www.imasy.org/~ume/

Re: libspf2: "ip6" mechanism not working ?

Benoit Branciard — 2010-11-02T16:13:07

Hi,

below is a message I posted some months ago about "ip6:" SPF mechanism 
not being handled correctly by libspf2.

Googling in the mailing list archives, I found someone already 
encountered the problem and submitted a patch:

http://www.gossamer-threads.com/lists/spf/devel/35098

(or 
http://www.listbox.com/member/archive/1007/2009/09/sort/time_rev/page/1/entry/0:2/20090927002136:3C4C62B2-AB1D-11DE-A128-DAF452F05D7F/, 
but without the patch attached).

I tested this patch (basically replacing an occurrence of 
INET_ADDRSTRLEN by INET6_ADDRSTRLEN in spf_compile.c), and I confirm it 
solves the "ip6" problem.

Could this patch be included in future releases of libspf2 ?


Le 18/02/2010 20:15, Benoit Branciard a écrit :

Re: Grammar Requires Backtracking

Julian Mehnle — 2010-04-27T10:11:44

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

William Ahern wrote:


For "v=spf1" it's never going to happen because it would invalidate a 
portion of the existing records.

For another revision of SPF the sky is the limit.

FWIW, I don't understand why you insist on using a 3rd party library for 
parsing the SPF grammar.  The grammar is rather trivial, really, despite 
the need for backtracking.

Or perhaps I'm talking out of my ass because I mostly use languages with 
built-in regular expression engines (with backtracking support).  Then 
again, there's pcre. :-)


You're welcome.

- -Julian

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkvWuGAACgkQwL7PKlBZWjsW4gCdEz2N+vL4LjEuZWZcepgAtgmw
pb8AnjCjSVuLkxqhxTAgyoIXnWje4j71
=A5D/
-----END PGP SIGNATURE-----

Re: Grammar Requires Backtracking

Stuart D. Gathman — 2010-04-19T02:44:23


The immediate need is to incorporate all errata into a non test track
RFC that is as compatible as possible with the existing installed base.

When that is done, there is SPF3, which is just a collection of ideas
at the moment.

Re: Grammar Requires Backtracking

William Ahern — 2010-04-18T18:01:46

<snip>

it wouldn't directly. but there are only 15 groups of tests, so it might be
useful for implementations forced to run the test suite the hard way, by
reloading zone data into BIND or NSD between test groups.

Re: Grammar Requires Backtracking

Alessandro Vesely — 2010-04-18T14:26:35

A rewriting of the spec has been due since a couple of years ago. 
Until we start that, we can presumably use 
http://www.openspf.org/Community/SPFv3 to annotate various issues 
(even if we won't eventually bump the version number.)

I've added a skeletal page in 
http://www.openspf.org/Community/SPFv3-Grammar . Please feel free to 
amend/complete it as appropriate.


How would that work for running the test suite, given that you need 
different zones --with conflicting names-- for different tests?

Grammar Requires Backtracking

William Ahern — 2010-04-17T19:50:48

Is anyone else bothered by the fact that the grammar requires backtracking?
Specifically, because a domain-spec can include forward slashes, and because
some of the terms allow cidr masks after a domain-spec, you have to support
backtracking.

Frankly I'm not sure I want to bother supporting this. I use Ragel to parse
the policies, which is a pure regular langage parser generator. I could use
Ragel's scanner feature, or just hack the support, but as a general rule I
don't like backtracking grammars for untrusted input.

Perhaps it would have been wise to have included a %-encoded forward-slash,
as was done for spaces.

Anybody open to such an amendment?

My asynchronous spf.c library passes 90% of the 2009.10 OpenSPF test suite
(I can't yet simulate timeouts to pass the TempError tests). Many, many
thanks to those who put in the time and effort to write those test
specifications.

I gratuitously wrote an RFC 1035 master file parser and composer in C (w/
Ragel), and am of course parsing the YAML tests from C

libspf2: "ip6" mechanism not working ?

Benoit Branciard — 2010-02-18T19:15:35

Hello,

If I publish a SPF record like this:

testspf.univ-paris1.fr descriptive text "v=spf1 ip6:2001:660:3305::71
ip4:193.55.96.71 -all"

then execute some queries on it using libspf2 (through the spfquery
command):

spfquery -i 193.55.96.71 -s testspf.univ-paris1.fr
-> pass

spfquery -i 2001:660:3305::71 -s testspf.univ-paris1.fr
-> fail

I would have expected both queries to return "pass".

Tested lipspf2/spfquery versions are: 1.2.5 and 1.2.9, with same faulty
results.
Testing environment is on Debian Lenny, libspf2 are from Debian packages
   (Lenny and Sid).

I arrived to the conclusion of a libspf2 bug after seeing a
libspf2-linked mail filter (milter-greylist) not behave as expected on
incoming SPF-enabled IPv6 SMTP connexions. After thoroughly examining
the faulty SPF record, I concluded the SPF test should have passed,
whereas it failed. Then I did some manual queries using spfquery on the
same SPF record with same results. I then created the above simple test
SPF record which obviously illustrate