Re: Implementation certification procedure

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Stefano Bagnara wrote:
> Stuart D. Gathman ha scritto:
> > Agreed.  But I'm pretty sure it is due to not having come up with an
> > actual procedure rather than self promotion.  Maybe you could
> > volunteer to test implementations using your live DNS test framework?
> > That would at least get yours done :-)
>
> I'm already testing jSPF with my tester :-)
>
> My effort to make the tester "implementation agnostic" is really to
> gain some more trust from you when you see that my tester correctly
> check your implementations.

Testing implementations from an additional angle is good; any disparity 
between testing results from the different angles is likely to help 
exposing bugs.  The reason that I, personally, haven't invested the 
necessary time to implement an online-DNS tester yet is simply that I 
felt the benefit to be expected wouldn't justify the (time) cost.  But if 
you're willing to set this up, please go for it!

> It is OpenSPF that have to tell how an implementation is certified.
> What tests have Mail::SPF and pyspf 2.0 passed in order to be listed
> there?? I bet jSPF passed the same tests.

You have to pass the RFC 4408 test suite that can be downloaded from

  http://www.openspf.org/Test_Suite

More precisely, you have to convince someone who is able to edit the SPF 
project's website that the implementation passes the test suite.

> In fact we always had selftests based on the yaml file you publish and
> we have some more unit test in place to increase the coverage, too.

That's good, but unfortunately it was too difficult (for me, who had first 
given it a try) to verify that.  See my previous mail.

> I'd happily complete the live dns tester tool but in order to check
> implementations they have to return an "spfquery" like result, 4 lines
> where the 1st is the result, the 2nd is the explanation, the 4th is the
> Received-SPF: header. Then they also have the ability to use a specific
> dns server for their queries (e.g: --dnsserver|-s <IP>[:PORT]).
> I can make parameters configurable, but that dnsserver option is needed
> in order to run my tester. AFAIK no implementation currently support
> this (jSPF will support this in the next release).

Can we instead agree instead on having a public DNS zone delegated to your 
server and have it serve test records from there?  That seems cleaner to 
me than forcing implementations to use a specific resolver server.

> Using the "commandline interface" is the only way I found to test
> different implementations using a single tester.

Or you could use the spfd interface: pipe test data into STDIN, get 
results from STDOUT.  See http://search.cpan.org/dist/Mail-SPF/sbin/spfd 
for a good documentation of that interface.  (spfd uses a TCP or UNIX 
socket, but you could just as well implement the interface using a pipe.)

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkir6ykACgkQwL7PKlBZWjtv9ACgpcJ/E6TMzLBe9OpQLFaYkZ3p
v5sAoO7cFoqQ5DZmK7A1Jn6iDrPnMVWL
=xd8F
-----END PGP SIGNATURE-----