Re: A Quickhack

On Sun, Oct 26, 2003 at 09:44:57PM +0100, Hadmut Danisch wrote:
> On Sun, Oct 26, 2003 at 01:32:37PM -0500, Alan DeKok wrote:
> > 
> >   Let's try an example.
> > 
> >   mail.example.com == 1.2.3.4
> >   ftp.example.com  == 1.2.3.5
> >   *.3.2.1._asrg_rmx_.example.com = "permitted to send smtp"
> > 
> >   A recipient MTA receives a request from 1.2.3.4, but the EHLO says
> > "ftp.example.com". 
> 
> 
> I think this is a bad example, because the machine is misconfigured.
> Misconfigured machines are alway a problem of their own.

Misconfigured machines will always be a problem, I agree.

> I would give another example which is not far away, but 
> meets my experiences, the already mentioned NAT problem:
> 
> 
> relay.example.com    = 192.168.1.1
> firewall.example.com = 1.2.3.4
> 
> 
> Now the relay opens a connection and gets NATted to 1.2.3.4, 
> while the DNS A PTR for relay.example.com is 192.168.1.1
> 
> This is a common mistake in DNS configuration.
> 
> Do we require people to have a proper DNS configuration or do 
> we do a "workaround" for bad DNS entries?

No workaround needed for DRIP.   the relevant records in example.com's
space would be


relay               IN A 192.168.1.1                (non routable, but valid)
firewall            IN A 1.2.3.4

1_2_3_4.ipv4.relays._email_.relay   IN A 1.2.3.4    (how it appears)

It allows a host to go through the NAT through the firewall
and if a remote MTA that is DRIP aware could get a HELO request
from 1.2.3.4 claiming to be relay.example.com, and it would be
accepted as ok.

and this is actually how I have my wife's machine configured in DRIP
(to expect the NAT's IP)

66_92_144_211.IPv4.relays._email_.gamerz.net. 3600 IN A	66.92.144.211
66_92_144_211.IPv4.relays._email_.nat.gamerz.net. 3600 IN A 66.92.144.211


66.92.144.211 is our shared firewall/NAT.   her box claims a HELO of
gamerz.net.   

-- 
 /  \__  | Richard Rognlie / Sultan of Sendmail / Gamerz.NET Lackey
 \__/  \ | http://www.gamerz.net/rrognlie/ <rrognlie at gamerz.net>
 /  \__/ | 
 \__/    | CAUTION: may contain Mature material......but I doubt it.