spf-discuss
[Top] [All Lists]

[spf-discuss] Re: Upcoming new test-suite release

2008-03-28 09:53:26
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Frank Ellermann wrote:
Stuart D. Gathman wrote:
I was for TempError myself.  But no match is ok.

Okay, let's say TempError is out, depending on how we read RFC 4408 that
alone is not necessarily an erratum.

Right.  The issues of how RFC 4408 as-is is to be interpreted and whether 
RFC 4408 should be amended via an erratum are generally separate.

There should probably be an errata to modify 2.5.7 if we go with no
match.

ACK, "no match" is not what 2.5.7 proposes, if we want "no match" it
needs an erratum.

<RFC authoring mode>
    Again, I'm pretty sure that 2.5.7/1/3 was a mistake.  Nowhere else
    does RFC 4408 suggest an "after-macro-expansion syntax checking"
    concept.
</RFC authoring mode>

<RFC interpretation mode>
    The question however is:  Given the present wording of RFC 4408,
    should we accept implementations generating a PermError on "broken"
    (i.e., valid syntax per RFC 4408 but invalid per RFCs 1034/1035/1123)
    <target-name>s, as wrong as it may occur to us based on the RFC 4408
    authoring background knowledge we posses?
</RFC interpretation mode>

<RFC authoring mode>
    If we decide to tolerate PermError on broken <target-name>s, we cannot
    simply remove 2.5.7/1/3 ...

    | Be aware that if the domain owner uses macros (Section 8), it is
    | possible that this result is due to the checked identities having an
    | unexpected format.

    ... because we will then want implementors to be aware of the issue as
    well!  So we will either have to leave it as it is or amend it to say
    that PermError is not an intended result for those cases, but that
    there may be implementations working like that due to a legitimate
    misinterpretation of earlier versions of the spec (including the
    unamended RFC 4408).

    If, however, we decide NOT to tolerate PermError, the best amendment
    is probably to simply delete 2.5.7/1/3.
</RFC authoring mode>

I think we should make decisions in this order.  The RFC 4408 test suite 
depends solely on how we interpret RFC 4408 as it is now.  Any RFC 4408 
errata should then amend the RFC to clarify what it already says (albeit 
contradictorily or otherwise ambiguously).  In any case, RFC 4408 errata 
are not supposed to modify the (originally intended) semantics of RFC 
4408.

A PermError is wrong because in the macro case, the error is *not*
permanent, but may depend on the sender.

Here we have a disconnect, the same MAIL FROM and HELO combo from the
same IP with the same policy will always, permanently, reproducible
fail.

Let's face it, PermError is far from clearly defined per RFC 4408.  From 
an entirely utilitarian point of view, all that can be said is that it 
covers all error conditions that are not already covered by TempError, 
whose semantics are a lot better defined in RFC 4408.

The real question then is:  Does a "broken" <target-name> (either verba- 
tim, e.g., "<more-than-63-chars>.com", or via macro expansion) need to be 
_flagged_as_an_error_condition_ in the first place?

Had you asked me that question two years ago, I'd have said: definitely 
yes!  You may recall me having fought long and hard for making 
SPF(NXDOMAIN) to be considered a case of PermError.  It was all in vain; 
the rough consensus was that checking for whether the authority domain 
(whose policy is to be evaluated) actually exists was not SPF's problem 
and that None should be returned.  Likewise, consider 5/10/3 in section 
5, "Mechanism Definitions":

| Several mechanisms rely on information fetched from DNS.  [...]  If the
| server returns "domain does not exist" (RCODE 3), then evaluation of the
| mechanism continues as if the server returned no error (RCODE 0) and
| zero answer records.

Now I think we ought to stick to that school of thought and treat "broken" 
<target-name>s as no-match, too.

After all, given a policy using %{h}, why should "HELO whacky..spammer" 
result in "PermError" when "HELO whacky.spammer" results in "Fail" or
"SoftFail"?  (If anyone argues that "whacky..spammer" isn't even a valid 
HELO per RFC 2821, consider %{l} and "MAIL 
FROM:<whacky(_dot_)(_dot_)spammer(_at_)(_dot_)(_dot_)(_dot_)>".)

As for the "mech:<more-than-63-chars>.com" case, I could be convinced that 
this is a separate issue from the macro expansion one, however since it 
clearly is NOT a syntax error per RFC 4408, it would still be hard to 
justify a PermError result.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFH7SEXwL7PKlBZWjsRAmLiAJ0bri0uFkfAHMJYkiwo4djI5McfPQCeLqSM
/gC6CxQ1qZgeB1fNXVm4D7Y=
=YsYr
-----END PGP SIGNATURE-----

-------------------------------------------
Sender Policy Framework: http://www.openspf.org
Modify Your Subscription: http://www.listbox.com/member/
Archives: http://www.listbox.com/member/archive/735/=now
RSS Feed: http://www.listbox.com/member/archive/rss/735/
Powered by Listbox: http://www.listbox.com

<Prev in Thread] Current Thread [Next in Thread>