Re: Re: Patches from Robert Millan

On Monday 30 July 2007 18:08, Julian Mehnle wrote:
> Magnus Holmgren wrote:
> > On Monday 30 July 2007 14:20, Julian Mehnle wrote:
> > > [...]
> > >
> > > However, existing software may not be calling these functions in this
> > > order, despite <http://www.libspf2.org/docs/api.html> recommending it,
> > > and would thus fail.
> > >
> > > Perhaps the above logic could be _copied_ to
> > > SPF_request_set_env_from() rather than _moved_?
> >
> > Perhaps. It's would still be more localized that way than if checking
> > for an empty domain in numerous places, and localized is a Good Thing.
>
> But breaking compatibility with unknown amounts of software is about the
> worst thing a library can do.

Absolutely. To to that we would have to bump the soname. Defining previously 
undefined behaviour is a different matter, though. So what do we have here?

Some applications, including spfquery, call SPF_request_set_env_from() with an 
empty 'from' argument. That sets the env_from field to "@postmaster" and the 
env_from_dp field to "" and causes libspf2 to go on and look up SPF records 
for "", which can't possibly be intended behaviour. IIUC, correct usage is to 
call SPF_request_set_env_from() with the HELO string, which is done 
automatically from SPF_request_set_helo_dom() already, or to do nothing if a 
HELO check, which is essentially the same thing, has already been carried 
out.

AFAICS, helo_dom is not used for anything else (outside all the legacy code 
still there, enclosed in "#if 0 ... #endif" - aaargh!) except display 
purposes (there is no SPF_request_query_helo() yet, and 
SPF_request_t.use_helo is not used; in SPF_i_set_header_comment() we have

	sender_dom = spf_request->env_from_dp;
	if (sender_dom == NULL)
		sender_dom = spf_request->helo_dom;

but spf_request->env_from_dp can't be NULL unless spf_request->helo_dom is 
also NULL). Perhaps this is planned to change, though.

In short, my proposed patch lets "" stand for to "postmaster@"+<HELO string> 
in the call to SPF_request_set_env_from(), nothing else. The problem is of 
course that even if this patch is applied to the version of libspf2 in Debian 
and Ubuntu, no software outside Debian and Ubuntu can depend on it.

(The patch also fixes a minor bug; that a sender address of "@domain.example" 
would become "postmaster@@domain.example", with env_from_dp incorrect.

-- 
Magnus Holmgren        [email protected]
                       (No Cc of list mail needed, thanks)

  "Exim is better at being younger, whereas sendmail is better for 
   Scrabble (50 point bonus for clearing your rack)" -- Dave Evans

-------------------------------------------
-----------------------------------------------------------------------
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to http://v2.listbox.com/member/?member_id=6959932&id_secret=26608741-716864
Powered by Listbox: http://www.listbox.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQBGrklsk7mRNn1h4+YRAmgXAJ4mD2KPfXPqRI7y4uyjjPzFC4yaQQCfbQfE
JNkEuVIFiqk87eVC3zhJ1zQ=
=D1va
-----END PGP SIGNATURE-----