[Bug 235254] Re: a: should allow IPv4 addresses

2008-05-27 Thread Scott Kitterman
The a: mechanism is not allowed to be an IP address.  Arguably this was
a poor design decision, but that is what's codified in RFC 4408.  See
http://www.openspf.org/RFC_4408#mech-a (and the rest of the ABNF) for
details.  Whenever feasible, the package design follows RFC 4408.  Note
that the wizard you are using is an old one.  The current one is
available on http://www.openspf.org/Project_Overview.

If you prefer not to reject on permanent errors (and this is a permanent
error), my recommendation is to switch to postfix-policyd-spf-python
(that's the name in the current release, it had a different name in
earlier releases).  It does not reject on permerror by default.  It also
is configurable in the package configuration file.

** Changed in: postfix-policyd-spf-perl (Ubuntu)
   Status: New = Invalid

-- 
a: should allow IPv4 addresses
https://bugs.launchpad.net/bugs/235254
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 235254] Re: a: should allow IPv4 addresses

2008-05-27 Thread Roger C. Pao
** Description changed:

- Binary package hint: postfix-policyd-spf-perl
+ Binary package hint: python-policyd-spf
  
  May 12 00:38:47 rolly-dmz postfix/smtpd[3808]: connect from 
sn16.seed.net.tw[139
  .175.54.16]
  May 12 00:38:47 rolly-dmz policyd-spf[3818]: SPF fail: 
REMOTEIP=139.175.54.16 
  HELO=seed.net.tw SENDER=[EMAIL PROTECTED] RECIPIENT=[EMAIL PROTECTED] 
QUE
  UEID= REASON=SPF Permanent Error: Use the ip4 mechanism for ip4 addresses: 
a:
  210.68.96.50
  May 12 00:38:47 rolly-dmz postfix/smtpd[3808]: NOQUEUE: reject: RCPT from 
sn16.s
  eed.net.tw[139.175.54.16]: 550 5.7.1 [EMAIL PROTECTED]: Recipient address 
reject
  ed: SPF Reports: SPF Permanent Error: Use the ip4 mechanism for ip4 
addresses: a
  :210.68.96.50; from=[EMAIL PROTECTED] to=[EMAIL PROTECTED] proto=ESMTP 
helo
  =seed.net.tw
  May 12 00:38:47 rolly-dmz postfix/smtpd[3808]: disconnect from 
sn16.seed.net.tw[
  139.175.54.16]
  
  Using the SPF Wizard at
  http://old.openspf.org/wizard.html?mydomain=seed.net.twsubmit=Go%21
  
  The SPF record:
  v=spf1 a:210.68.96.50 a:210.68.96.51 ip4:139.175.54.0/24 ?all
  
  can be explained as:
  [v=spf1]  v=spf1  This identifies the TXT record as an SPF string.
  [a:]  a:210.68.96.50  210.68.96.50 is also allowed to send mail from 
seed.net.tw.
  [a:]  a:210.68.96.51  210.68.96.51 is also allowed to send mail from 
seed.net.tw.
  [ip4:]ip4:139.175.54.0/24 Every host in the range 
139.175.54.0-139.175.54.255 is allowed to send mail from seed.net.tw.
  [all] ?allSPF queries that do not match any other mechanism will 
return neutral.
  Messages that are not sent from an approved server should still be accepted 
as if the SPF record did not exist. 
  
- Note the a: is allowed to be an IP address.  It is not an error.  And,
- it is marked as a soft fail (?all), so it should have allowed the e-mail
- to pass through and not reject.
+ Note the a: is allowed to be an IP address.  It is not marked as an
+ error.  And, the SPF record is marked as a soft fail (?all), so it
+ should have allowed the e-mail to pass through and not reject.
+ 
+ 
+ Package and Version information:
+ 
+ [EMAIL PROTECTED]:/var/log# dpkg --get-selections|grep spf
+ libmail-spf-perl  install
+ postfix-policyd-spf-perl  install
+ python-policyd-spfinstall
+ python-spfinstall
+ 
+ [EMAIL PROTECTED]:/etc/postfix# grep spf *
+ main.cf:check_policy_service unix:private/policy-spf,
+ main.cf:spf-policyd_time_limit = 3600s
+ master.cf:policy-spf  unix  -   n   n   -   0   spawn
+ master.cf: user=nobody argv=/usr/bin/policyd-spf
+ 
+ [EMAIL PROTECTED]:/etc/postfix# more /usr/bin/policyd-spf 
+ #!/usr/bin/python
+ #
+ #  Check SPF results and provide recommended action back to Postfix.
+ #
+ #  Tumgreyspf source
+ #  Copyright (c) 2004-2005, Sean Reifschneider, tummy.com, ltd.
+ #  [EMAIL PROTECTED]
+ #
+ #  pypolicyd-spf
+ #  Copyright (c) 2007, Scott Kitterman [EMAIL PROTECTED]
+ 
+ [EMAIL PROTECTED]:/etc/postfix# dpkg-query --show python-policyd-spf
+ python-policyd-spf0.2-0ubuntu2

-- 
a: should allow IPv4 addresses
https://bugs.launchpad.net/bugs/235254
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 235254] Re: a: should allow IPv4 addresses

2008-05-27 Thread Roger C. Pao
Thank you for your prompt reply.  I agree with your assessment that a:
does not allow IPv4.  I will follow up with seed.net.tw.

FYI: The wizard at http://www.openspf.org/Project_Overview will forward
to http://old.openspf.org/wizard.html?mydomain=seed.net.twsubmit=Go%21.

-- 
a: should allow IPv4 addresses
https://bugs.launchpad.net/bugs/235254
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


[Bug 235254] Re: a: should allow IPv4 addresses

2008-05-27 Thread Scott Kitterman
From the version, I see you are running Feisty.  The version of the
Python policy server in the regular release does not, in fact, have a
config file and, IIRC, rejects on permerror.  I substantially improved
one is available in feisty-backports.  That's the one that supports the
config file.

-- 
a: should allow IPv4 addresses
https://bugs.launchpad.net/bugs/235254
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs


Re: [Bug 235254] Re: a: should allow IPv4 addresses

2008-05-27 Thread Scott Kitterman
On Tuesday 27 May 2008 14:09, Roger C. Pao wrote:

 FYI: The wizard at http://www.openspf.org/Project_Overview will forward
 to http://old.openspf.org/wizard.html?mydomain=seed.net.twsubmit=Go%21.

Thanks.  I'd forgotten that.

-- 
a: should allow IPv4 addresses
https://bugs.launchpad.net/bugs/235254
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs