Re: Re: Exim 4.41 + Exiscan 4.41-24 + libspf2 1.0.4

I just noticed this the other day too.  So I dug around in the Exiscan 
patch and in the libspf2 library to find out why.  It appears that 
Exiscan waits for the HELO/EHLO to send its spf_init call which sets up 
stuff so that it can run the SPF check.  Part of the reason for this I 
would imagine is that spf_init calls SPF_set_helo_dom.  The spf library 
uses the HELO/EHLO domain as a backup if it can't find one in the MAIL 
FROM.  So it's not really required but for some reason Exiscan makes it 
required.  To see If I could get the SPF check to work without a 
HELO/EHLO I patched the Exiscan patch with some changes and it seemed 
to work, though I haven't done extensive testing on it yet.  Now 
Exiscan will perform on an SPF check (that should work) even when it 
doesn't get a HELO/EHLO.  Can anyone see a reason why this would be a 
bad idea?

Scott Amory
eSoft Inc.

*** exiscan-acl-4.41-24.patch   Thu Jul 22 08:36:51 2004
--- SOURCES/exiscan-acl-4.41-24.patch   Thu Aug  5 09:05:20 2004
***************
*** 8091,8097 ****
   diff -urN exim-4.41-orig/src/spf.c exim-4.41/src/spf.c
   --- exim-4.41-orig/src/spf.c  Thu Jan  1 01:00:00 1970
   +++ exim-4.41/src/spf.c       Thu Jul 22 16:31:13 2004
! @@ -0,0 +1,131 @@
   +/*************************************************
   +*     Exim - an Internet mail transport agent    *
   +*************************************************/
--- 8091,8097 ----
   diff -urN exim-4.41-orig/src/spf.c exim-4.41/src/spf.c
   --- exim-4.41-orig/src/spf.c  Thu Jan  1 01:00:00 1970
   +++ exim-4.41/src/spf.c       Thu Jul 22 16:31:13 2004
! @@ -0,0 +1,136 @@
   +/*************************************************
   +*     Exim - an Internet mail transport agent    *
   +*************************************************/
***************
*** 8174,8182 ****
   +  int rc = SPF_RESULT_ERROR;
   +
   +  if (!(spfcid && spfdcid)) {
! +    /* no global context, assume temp error and skip to evaluation */
! +    rc = SPF_RESULT_ERROR;
! +    goto SPF_EVALUATE;
   +  };
   +
   +  if (SPF_set_env_from(spfcid, spf_envelope_sender)) {
--- 8174,8187 ----
   +  int rc = SPF_RESULT_ERROR;
   +
   +  if (!(spfcid && spfdcid)) {
! +    /* Its possible that there was no HELO so apf_init was never 
called.
! +       Try again one more time */
! +    spf_init(NULL,sender_host_address);
! +    if (!(spfcid && spfdcid)) {
! +      /* no global context, assume temp error and skip to evaluation 
*/
! +      rc = SPF_RESULT_ERROR;
! +      goto SPF_EVALUATE;
! +    }
   +  };
   +
   +  if (SPF_set_env_from(spfcid, spf_envelope_sender)) {
***************
*** 8239,8247 ****
   +
   +#ifdef SPF
   +
! +#include <spf_alt/spf.h>
! +#include <spf_alt/spf_dns_resolv.h>
! +#include <spf_alt/spf_dns_cache.h>
   +
   +typedef struct spf_result_id {
   +  uschar *name;
--- 8244,8252 ----
   +
   +#ifdef SPF
   +
! +#include <spf2/spf.h>
! +#include <spf2/spf_dns_resolv.h>
! +#include <spf2/spf_dns_cache.h>
   +
   +typedef struct spf_result_id {
   +  uschar *name;


On Jul 28, 2004, at 11:03 AM, Rich, WhidbeyNET NOC wrote:

> Well, we found out what was happening.
>
> Any connection that simply doesn't specify a syntactically correct 
> "helo/ehlo" domain will cause Exiscan's SPF to return error_temp (5).  
> One reason is:
>
> int spf_init(uschar *spf_helo_domain, uschar *spf_remote_addr) {
>
> It looks like we'll have to force a valid HELO first.
>
> Someone should put a note in the Exiscan docs that a HELO is required 
> for SPF.
>
> Rich
> [email protected]
>
> On Monday, July 26, 2004, at 02:54 PM, Rich, WhidbeyNET NOC wrote:
>
>> We've been using Exiscan for a while under Exim 4.30.  During our 
>> upgrade cycle to 4.41, we thought we'd try to implement SPF.
>>
>> After installing libspf2 1.0.4, we tried to compile Exim 4.41 with 
>> the latest Exiscan 4.41-24 patch, with the following in the Makefile:
>>
>> CFLAGS=-DSPF -I/usr/local/include
>> EXTRALIBS_EXIM=-L/usr/local/lib -lpam -lspf2
>> WITH_SPF=yes
>>
>> The only compile error was in "spf.h", for these 3 includes:
>>
>> #include <spf_alt/spf.h>
>> #include <spf_alt/spf_dns_resolv.h>
>> #include <spf_alt/spf_dns_cache.h>
>>
>> It looks like they weren't renamed to "spf2/" when libspf changed its 
>> name, so we changed them, and it compiled file.
>>
>> However we cannot get any SPF lookup to complete in Exim. Here's an 
>> example test ACL:
>>
>> acl_check_mail:
>>         deny    spf = !fail
>>                 message = SPF: $spf_header_comment Comment: 
>> $spf_smtp_comment
>>
>> It only generates this in exim -bd -d:
>>
>>  2488 SMTP<< mail from:[email protected]
>>  2488 using ACL "acl_check_mail"
>>  2488 processing "deny"
>>  2488 check spf = !fail
>>  2488 SPF result is error (5)
>>  2488 deny: condition test succeeded
>>  2488 SMTP>> 550 SPF:  Comment:
>>  2488 LOG: MAIN REJECT
>>  2488   H=[209.166.64.90] rejected MAIL [email protected]: SPF:  
>> Comment:
>>  2488 SMTP<< QUIT
>>
>> The only thing being returned is "error_temp" (5). Since there is 
>> nothing being returned for any spf return values we've tried, we are 
>> having trouble isolating the problem.
>>
>> The "spfquery" command-line tool functions just fine:
>>
>> ./spfquery -ip=209.166.64.124 [email protected]
>> pass
>> spfquery: domain of whidbey.net designates 209.166.64.124 as 
>> permitted sender
>>
>> We also tried removing, and then installing lower versions, of 
>> libspf2 with no success.
>>
>> Can anyone suggest some better debugging methods, short of going 
>> through Exim and the SPF code to insert breakpoints?
>>
>> Thanks!
>>
>> Rich
>> [email protected]
>>
>
>
>