-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Alex van den Bogaerdt wrote:
On Tue, Jan 16, 2007 at 04:09:32PM +0000, Julian Mehnle wrote:
Because the ABNF only describes the formal grammar, while the rest
describes the semantics. That doesn't mean that the grammar should
deliberately allow nonsensical constructs such as "ip4:4444.0.0.0" or
an empty "exp=", though.
Which implicitly expresses your opinion about an empty explanation
domain. Which poses the question: why was it included in the spec as-is,
what made all people involved do the wrong thing?
This is how it happened:
Time-line of the spec drafts[1]:
T draft-mengwong-spf.02.9.4
| draft-mengwong-spf-00
| draft-mengwong-spf-01
| draft-mengwong-spf-01.200406
time | draft-lentczner-spf-00
| draft-schlitt-spf-classic-00
| draft-schlitt-spf-classic-01
| draft-schlitt-spf-classic-02
V rfc4408
draft-mengwong-spf.02.9.4 said:
| exists = 'exists' ':' macro-string
draft-mengwong-spf-00 changed that to:
| exists = 'exists' ':' domain-spec
On the domain-spec definition, all drafts up to draft-mengwong-spf-
01.200406 said:
| domain-spec = domain-name / macro-string
| domain-name = domain-part *( "." domain-part ) [ "." ]
| domain-part = as defined in [RFC1034]
| macro-string = *( macro-char / VCHAR )
draft-lentczner-spf-00 changed that to something odd:
| domain-spec = *( macro-expand / macro-literal )
| macro-string = *( macro-expand / macro-literal / "/" )
The Lentczner draft also introduced the "If <domain-spec> is empty" part.
draft-schlitt-spf-classic-00 changed the grammar "back" to something
reasonable, however for the first time disallowing an empty string
(because domain-end cannot be empty) without dropping the "If <domain-
spec> is empty" part in the "exp=" definition:
| domain-spec = macro-string domain-end
| domain-end = ( "." toplabel ) / macro-expand
| toplabel = ALPHA / ALPHA *[ alphanum / "-" ] alphanum
| ; LDH rule (See [RFC3696])
| macro-string = *( macro-expand / macro-literal )
There were no further material changes after that.
Conclusion: The "exp=" argument was never intended to be empty. It has
been a domain-spec since draft-mengwong-spf-00, even though stricter
requirements for domain-spec were introduced only in draft-schlitt-spf-
classic-00. The loose domain-spec requirements can only be considered an
oversight in the earlier drafts. It appears as if the "If <domain-spec>
is empty" part wasn't removed again immediately after the Lentczner draft
despite the grammar change simply because it was overlooked.
It is difficult to say whether syntax errors in the "exp=" modifier were
ever intended NOT to throw a PermError, however that would have been and
would be a gross inconsistency with other mech/mod definitions, and I
don't think the special standing of the "exp=" modifier (which isn't
generally supposed to change the SPF result) could justify that gross
inconsistency.
References:
1. http://www.openspf.org/Specifications
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
iD8DBQFFrQsiwL7PKlBZWjsRAkGGAJ97jdLB4eYlqfwe3KGqhx+hUogyZQCcDZvJ
c1JGsl4qVLVTlxPgyHQEY4I=
=q5yB
-----END PGP SIGNATURE-----
-------
Sender Policy Framework: http://www.openspf.org/
Archives at http://archives.listbox.com/spf-discuss/current/
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?list_id=735