Flowchart?
"Gordon Fecyk - Home" <[email protected]> Sun, 26 Oct 2003 11:45:24 -0600
| Newsgroups | gmane.ietf.asrg.rmx |
|---|---|
| Message-ID | <[email protected]> |
This is the thing I was dreaming up after bringing up doing both HELO and MAIL verification. It has DMP written all over it, but you could s/DMP/whatever in this flowchart. Let me know if there are gaping holes in this chart that could be abused. I'm taking the approach of checking MAIL first, then HELO, based on some assumptions: * .forward without envelope modification isn't as common as it used to be, at least for most users who sit behind a Windows box or a Mac. Allow .forward with a little more DNS overhead. * Mailing lists modify the sender envelope more often than they don't. * RFC 2821 4.1.4 is important - this chart doesn't refuse mail SOLELY based on HELO, only if other conditions occur. * RFC 2821 7.1 is important - Folks should be able to send mail on behalf of others. I also believe this should be auditable. * A lookup algorithm should try more than once to look up a record, as a certain SERVFAIL results in a 451 (local processing error) always. The checks to see if a site publishes verification records could be omitted if these are somehow implied during the inital checks. RFC 1034 4.3.2 doesn't allow a wildcard record to span sub-domains explicitly defined, though many DNS servers ignore this for convenience. If such a lookup could be implied, it can respond NXDOMAIN on those lookups. It also assumes some server-side configuration switches: * Allow/disallow bypassing upon some other authentication * Allow/disallow non-publishing domains * Allow/disallow HELO/EHLO as a backup -- PGP key (0x0AFA039E): <http://www.pan-am.ca/[email protected]> What's a PGP Key? See <http://www.pan-am.ca/free.html> GOD BLESS AMER, er, THE INTERNET. <http://vmyths.com/rant.cfm?id=401&page=4> ============================== | Client issues HELO or EHLO | ============================== | ========================================= | Server stores HELO or EHLO identifier | | and responds normally | ========================================= | ============================== | Client issues MAIL command | ============================== | /------------------------------------------------\ | Is the client's address allowed to bypass DMP? | \------------------------------------------------/ | | Yes No | | | /-------------------------------------------\ | | Is the MAIL envelope null (MAIL FROM:<>)? | | \-------------------------------------------/ | | | | No Yes | | | | ============================== | | | Server performs DMP Lookup | | | | on envelope's domain | | | | and client network address | | | ============================== | | | | | /---------------------\ | | | What is the result? | | | \---------------------/ | | | | | |-----------|-------|-------|------------| | | | | | | | | allow SERVFAIL NXDOMAIN deny | | | | or invalid | | | | | DMP | | | | | | | | | | | =================== | | | | | | Server performs | | | | | | | DMP domain-only | | | | | | | lookup | | | | | | =================== | | | | | | | | | | | /-----------------\ | | | | | | Lookup result? | | | | | | \-----------------/ | | | | | | | | | | | | | SERVFAIL NXDOMAIN Yes | | | | | | or invalid | | | | | | |----| DMP | | | | | | | | |-|| | | | | | | || | | | | | /----------------\ || | | | | | | Accept non-DMP | || | | | | | | domain? | || | | | | | \----------------/ || | | | | | | | || | | | | | Yes No || | | | | | | | || | | | | | (Go to) | || | | | | | (allow) | || | | | | | | | || | | | |------------------| |---||| | | | | | | ||| | | | | | | /----------------\ | | | | |---|| | Allow HELO as | | | | | || | alternative? | | | | | || \----------------/ | | | | || | | | | | | || No Yes | | | | || | | | | | | || | ======================= | | | || | | Server performs DMP | | | | || | | on HELO/EHLO FQDN | | | | || | | and client address | | | | || | ======================= | | | || | | | | | || | /----------------\ | | | || | | Lookup result? | | | | || | \----------------/ | | | || | | | | | | | | || | allow | | deny | | | || | | | | | | | | || | (go to) | | | | | | || | (allow) | | | | | ||--------------------------------| | | | | | || || | | | | | | || || | SERVFAIL | | | | || || | | | | | | || || | (go to) | | | | || || | (fail ) | | | | || |||------------------------| | | | | || ||| | | (go to) | | || ||| | | (deny ) | | || ||| | | | | | || ||| ||-------------------| | | || ||| || | | | || ||| || | | | || ||| || | | | || ||| || NXDOMAIN | | || ||| || or invalid | | || ||| || DMP | | || ||| || | | | || ||| || =================== | | || ||| || | Server performs | | | || ||| || | DMP HELO-only | | | || ||| || | FQDN lookup | | | || ||| || =================== | | || ||| || | | | || ||| || /----------------\ | | || ||| || | Lookup result? | | | || ||| || \----------------/ | | || ||| || | | | | | || ||| || SERVFAIL | | | | || ||| || | | | | | || ||| || (go to) | | | | || ||| || (fail ) | | | | || ||| || | | | | | || ||||-------------------| Yes | | | || |||| || | | | | || |||| |||----------| | | | || |||| ||| | | | || |||| ||| NXDOMAIN | | || |||| ||| or invlid | | || |||| ||| DMP | | || |||| ||| | | | || |||| ||| /----------------\ | | || |||| ||| | Accept non-DMP | | | || |||| ||| | domain AND is | | | || |||| ||| | envelope null? | | | || |||| ||| \----------------/ | | || |||| ||| | | | | || |||| ||| Yes No | | || |||| ||| | | | | || |||| ||| (go to) | | | || |||| ||| (allow) | | | || |||| ||| | | | | |||---------------------------------| | | | ||| |||| ||| | | | ||| |||| ||||--------------| | | ||| |||| |||| =====(allow)==== =====(fail)===== ====(deny)====== | Server sends | | Server sends | | Server sends | | 250 OK and | | 451 Temp Err | | 550 Policy | | resumes SMTP | | resumes SMTP | | resumes SMTP | ================ ================ ================ [end]