Good Netkeeping Seal of Approval (GNKSA)

Good Netkeeping Seal of Approval (GNKSA)

[Stig Sandbeck Mathisen]

One little question: Is it a goal to make Gnus pass the GNKSA test? It
seems to fail on a rather minor issue...

Ref: <URL:http://http.bsd.uchicago.edu/~t-pierce/news/gnus-5.3.txt>

-- 
 SSM - Stig Sandbeck Mathisen
  Trust the Computer, the Computer is your Friend

Re: Good Netkeeping Seal of Approval (GNKSA)

[Lars Magne Ingebrigtsen]

Stig Sandbeck Mathisen <ssm@online.no> writes:

> One little question: Is it a goal to make Gnus pass the GNKSA test?

Yes.

> It seems to fail on a rather minor issue...

I've made the From checks more thorough in Gnus 5.4, so it should pass
now.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen

Re: Good Netkeeping Seal of Approval (GNKSA)

[Lars Balker Rasmussen]

Stig Sandbeck Mathisen <ssm@online.no> writes:
> One little question: Is it a goal to make Gnus pass the GNKSA test? It
> seems to fail on a rather minor issue...
> 
> Ref: <URL:http://http.bsd.uchicago.edu/~t-pierce/news/gnus-5.3.txt>
 
>From 5.4.8 message.el:

       (cond
	((not from)
	 (message "There is no From line.  Posting is denied.")
	 nil)
	((or (not (string-match "@[^\\.]*\\." ad)) ;larsi@ifi
	     (string-match "\\.\\." ad) ;larsi@ifi..uio
	     (string-match "@\\." ad)	;larsi@.ifi.uio
	     (string-match "\\.$" ad)	;larsi@ifi.uio.
	     (not (string-match "^[^@]+@[^@]+$" ad)) ;larsi.ifi.uio
	     (string-match "(.*).*(.*)" from)) ;(lars) (lars)
	 (message
	  "Denied posting -- the From looks strange: \"%s\"." from)
	 nil)

It seems the current Gnus could pass the GNKSA.  Maybe Gareth Rees could
be persuaded to try again? ;-)
-- 
Lars Balker Rasmussen             <URL:http://www.daimi.aau.dk/~gnort/>

	      I am *not* selling crack from my cubicle!!!

Re: Good Netkeeping Seal of Approval (GNKSA)

[Hunter Kelly]

Lars Balker Rasmussen <gnort@daimi.aau.dk> writes:

> 	     (string-match "\\.$" ad)	;larsi@ifi.uio.

I thought that a trailing period was okay in fqdns?

Hunter

Re: Good Netkeeping Seal of Approval (GNKSA)

[Lars Balker Rasmussen]

Hunter Kelly <retnuh@corona.pixar.com> writes:
> Lars Balker Rasmussen <gnort@daimi.aau.dk> writes:
> > 	     (string-match "\\.$" ad)	;larsi@ifi.uio.
> 
> I thought that a trailing period was okay in fqdns?

Technically, yes, they should just be ignored.  But I can't see any
reason they should be allowed in email-addresses, however tyrannical and
paranoid that approach may seem ;)
-- 
Lars Balker Rasmussen             <URL:http://www.daimi.aau.dk/~gnort/>

	      I am *not* selling crack from my cubicle!!!

Re: Good Netkeeping Seal of Approval (GNKSA)

[Scott Blachowicz]

> > 	     (string-match "\\.$" ad)	;larsi@ifi.uio.
> 
> I thought that a trailing period was okay in fqdns?

Hmmm...for some reason, I thought it only applied to the named database
configuration files and not general hostname lookups?

Scott Blachowicz  Ph: 206/283-8802x240   Mathsoft (Data Analysis Products Div)
                                         1700 Westlake Ave N #500
scott@statsci.com                        Seattle, WA USA   98109
Scott.Blachowicz@seaslug.org

Re: Good Netkeeping Seal of Approval (GNKSA)

[William M. Perry]

Hunter Kelly writes:
>Lars Balker Rasmussen <gnort@daimi.aau.dk> writes:
>
>> 	     (string-match "\\.$" ad)	;larsi@ifi.uio.
>
>I thought that a trailing period was okay in fqdns?

  Theoretically, but in general its a good thing to check for.  80+% of the
time it will be indicative of a bad setup.

-bp

Re: Good Netkeeping Seal of Approval (GNKSA)

[Sudish Joseph]

Hunter Kelly writes:
> I thought that a trailing period was okay in fqdns?

I believe it's a hack to let people tell the resolver not to try
tacking on domains in it's search list (which is also considered a
hack, I believe).  

Disclaimer: All those "I believe"s translate to "somewhat certain but
too lazy to check".

-Sudish

Re: Good Netkeeping Seal of Approval (GNKSA)

[visigoth]

Lars Balker Rasmussen <gnort@daimi.aau.dk> writes:

> Technically, yes, they should just be ignored.  But I can't see any
> reason they should be allowed in email-addresses, however tyrannical and
> paranoid that approach may seem ;)

Uh.  The question is not should they be allowed, it's "is there any
reason not to allow them"?  If I mail to "foo@zub.fi", and there's an
fi subdomain here at CMU, but I really mean zub.fi (in finland), I
should be able to type "foo@zub.fi." to get it.

Do you see any reason why this shouldn't be allowed?

John.

Re: Good Netkeeping Seal of Approval (GNKSA)

[Rich Pieri]

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "HK" == Hunter Kelly <retnuh@corona.pixar.com> writes:

>> (string-match "\\.$" ad)	;larsi@ifi.uio.
HK> I thought that a trailing period was okay in fqdns?

Technically, if you do not have a trailing period, the name is not fully
qualified.  In practice it is not usually required as your resolver is
supposed to add it somewhere in its resolution loop.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv

iQCVAwUBMvJ5m56VRH7BJMxHAQGENwQApkx/sqjZ5ywVmtdXRT6+WubK/gOyIP82
qvrSxZwuB2Uh50Gh0zOAMcsuHMinVhGY7dVIHAmUmmyx3OMLQQGTMugw7jlaM03y
lRBC6ksGXVv6Wzqx8NZlkxJeJ7DGkex/pslNHBWpCdCj3klWkHwj+r8HDabdt+65
ASW+Lg/VtCg=
=HpJL
-----END PGP SIGNATURE-----
-- 
Rich Pieri <rich.pieri@prescienttech.com> | Happy Fun Ball may stick to certain
Prescient Technologies, Inc.              | types of skin.
A Stone & Webster Company                 | 
I speak for myself, not PTI or SWEC       | 

Re: Good Netkeeping Seal of Approval (GNKSA)

[Lars Balker Rasmussen]

visigoth@naiad.fac.cs.cmu.edu writes:
> Uh.  The question is not should they be allowed, it's "is there any
> reason not to allow them"?  If I mail to "foo@zub.fi", and there's an
> fi subdomain here at CMU, but I really mean zub.fi (in finland), I
> should be able to type "foo@zub.fi." to get it.

One could argue that if your site has subdomains with the same name as
your top-domain, you're getting what you deserve.  One could also argue
that you're right.  There IS no reason to not allowing names like
foo.com., ASSUMING your nameserver/sendmail-equivlant knows how to
handle it.  But I guess this is along the same lines as expecting
internet sites to have a postmaster-mailbox...

G'night,
-- 
Lars Balker Rasmussen             <URL:http://www.daimi.aau.dk/~gnort/>

	      I am *not* selling crack from my cubicle!!!

Re: Good Netkeeping Seal of Approval (GNKSA)

[Rich Pieri]

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "v" == visigoth <visigoth@naiad.fac.cs.cmu.edu> writes:

v> Uh.  The question is not should they be allowed, it's "is there any
v> reason not to allow them"?  If I mail to "foo@zub.fi", and there's an
v> fi subdomain here at CMU, but I really mean zub.fi (in finland), I
v> should be able to type "foo@zub.fi." to get it.

No, you should be able to type "foo@zub.fi".  To get at the "local" fi
subdomain you should be typing the full host name, which is required for
*ALL* Internet mail, even if zub.fi.cs.cmu.edu is literally right next
to the one you are sending from.  Local names should only be used
locally, that is, on the same machine (and really then only if the
machine is not on any network).

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv

iQCVAwUBMvKD9J6VRH7BJMxHAQHJMQQAn/oe+gfTYrNl0AN+PSkwrBYL19TFRV4w
0S5BvHN7m0Y2Hf63OsMFvncRKMPDdDDl+GuxIFoIupp0dnG8Vag+OXiKxdxKsUAG
QgLu6EYyF2x1YdUP4OFX0kX2BofvrwovBZN6RDpvyo3N2sryUo/Ovjy8LPMtIApN
3QxXWr+jTrI=
=itSV
-----END PGP SIGNATURE-----
-- 
Rich Pieri <rich.pieri@prescienttech.com> | Do not taunt Happy Fun Ball.
Prescient Technologies, Inc.              | 
A Stone & Webster Company                 | 
I speak for myself, not PTI or SWEC       | 

Re: Good Netkeeping Seal of Approval (GNKSA)

[Lars Magne Ingebrigtsen]

Hunter Kelly <retnuh@corona.pixar.com> writes:

> Lars Balker Rasmussen <gnort@daimi.aau.dk> writes:
> 
> > 	     (string-match "\\.$" ad)	;larsi@ifi.uio.
> 
> I thought that a trailing period was okay in fqdns?

I've now removed that check.

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen

Re: Good Netkeeping Seal of Approval (GNKSA)

[Sudish Joseph]

Sudish Joseph writes:
> I believe it's a hack to let people tell the resolver not to try
> tacking on domains in it's search list (which is also considered a
> hack, I believe).  

I went and checked 822 in the hopes of killing this thread before it
wells up. :/  Essentially, 822 doesn't allow it.

People use it with tools like dig/host/etc. coz they're used to having
that form short cut the resolver.  W/o the resolver hack, the trailing
period indicates the root domain and is therefore superfluous.  It's
illegal in mail.

The evidence follows,
-Sudish

[ Severely edited, from RFC 822 ]

address     =  mailbox
mailbox     =  addr-spec
addr-spec   =  local-part "@" domain
domain      =  sub-domain *("." sub-domain)
sub-domain  =  domain-ref / domain-literal
domain-ref  =  atom
atom        =  1*<any CHAR except specials, SPACE and CTLs>
specials    =  "(" / ")" / "<" / ">" / "@"  ; Must be in quoted-
            /  "," / ";" / ":" / "\" / <">  ;  string, to use
            /  "." / "[" / "]"              ;  within a word.

[ I.e., no "."'s in sub-domains, and all except the first subdomain
  are preceded by "."'s ]

[ From paragraphs 3 and 4 in section 6.2.1 of 822, "Domains" ]

        The root node is common to all addresses; consequently, it  is
        not  referenced. [...]

        The "top" of the domain addressing hierarchy -- a child of the
        root  --  is  indicated  by  the right-most field, in a domain
        specification. [...]

Re: Good Netkeeping Seal of Approval (GNKSA)

[Sudish Joseph]

Rich Pieri writes:
> No, you should be able to type "foo@zub.fi".  To get at the "local" fi
> subdomain you should be typing the full host name, which is required for
> *ALL* Internet mail, even if zub.fi.cs.cmu.edu is literally right next
> to the one you are sending from.  Local names should only be used
> locally, that is, on the same machine (and really then only if the
> machine is not on any network).

No.  822 explicitly allows compression of domain names--which is quite
funny, coz it has no relevance to what happens between co-operating
hosts.  Like that other pastime, they can do whatever it is that
tickles the parts they like tickled.

Here's the ref in the interests of stillborn speculation,
-Sudish

[ RFC 822, I snipped a page divider ]

     6.2.2.  ABBREVIATED DOMAIN SPECIFICATION

        Since any number of  levels  is  possible  within  the  domain
        hierarchy,  specification  of  a  fully  qualified address can
        become inconvenient.  This standard permits abbreviated domain
        specification, in a special case:

            For the address of  the  sender,  call  the  left-most
            sub-domain  Level  N.   In a header address, if all of
            the sub-domains above (i.e., to the right of) Level  N
            are  the same as those of the sender, then they do not
            have to appear in the specification.   Otherwise,  the
            address must be fully qualified.

            This feature is subject  to  approval  by  local  sub-
            domains.   Individual  sub-domains  may  require their
            member systems, which originate mail, to provide  full
            domain  specification only.  When permitted, abbrevia-
            tions may be present  only  while  the  message  stays
            within the sub-domain of the sender.

            Use of this mechanism requires the sender's sub-domain
            to reserve the names of all top-level domains, so that
            full specifications can be distinguished from abbrevi-
            ated specifications.

        For example, if a sender's address is:

                 sender@registry-A.registry-1.organization-X

        and one recipient's address is:

                recipient@registry-B.registry-1.organization-X

        and another's is:

                recipient@registry-C.registry-2.organization-X

        then ".registry-1.organization-X" need not be specified in the
        the  message,  but  "registry-C.registry-2"  DOES  have  to be
        specified.  That is, the first two addresses may  be  abbrevi-
        ated, but the third address must be fully specified.

        When a message crosses a domain boundary, all  addresses  must
        be  specified  in  the  full format, ending with the top-level
        name-domain in the right-most field.  It is the responsibility
        of  mail  forwarding services to ensure that addresses conform
        with this requirement.  In the case of abbreviated  addresses,
        the  relaying  service must make the necessary expansions.  It
        should be noted that it often is difficult for such a  service
        to locate all occurrences of address abbreviations.  For exam-
        ple, it will not be possible to find such abbreviations within
        the  body  of  the  message.   The "Return-Path" field can aid
        recipients in recovering from these errors.

Re: Good Netkeeping Seal of Approval (GNKSA)

[Lars Magne Ingebrigtsen]

Sudish Joseph <sudish@mindspring.com> writes:

> I went and checked 822 in the hopes of killing this thread before it
> wells up. :/  Essentially, 822 doesn't allow it.

Ok, I've put the check back in again.  :-)

-- 
(domestic pets only, the antidote for overdose, milk.)
  larsi@ifi.uio.no * Lars Ingebrigtsen

Re: Good Netkeeping Seal of Approval (GNKSA)

[Rich Pieri]

-----BEGIN PGP SIGNED MESSAGE-----

>>>>> "SJ" == Sudish Joseph <sudish@mindspring.com> writes:

SJ>             This feature is subject  to  approval  by  local  sub-
SJ>             domains.   Individual  sub-domains  may  require their
SJ>             member systems, which originate mail, to provide  full
SJ>             domain  specification only.  When permitted, abbrevia-
SJ>             tions may be present  only  while  the  message  stays
SJ>             within the sub-domain of the sender.

And in this case, where the sub-domain is identical to an outside,
higher-level domain, the message cannot be guaranteed to be "local"
within the sub-domain of the sender.  Therefore, the use of this feature
should not be approved for the sub-domain "foo.fi"; approving it would
make it such that mail to "baz@foo.fi" in Finland will never get out of
"foo.fi.com" in the US.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3a
Charset: noconv

iQCVAwUBMvP9zZ6VRH7BJMxHAQEGiQQAnrNEMw8TAyae8U3Z24XQLdJeyvM92gBw
YXSYDrp58Gf/CUQJvap0PBwtb34VfmV5INjmwP2GuQShKE1IXEtxnMq9Fwpd8Ktn
cUA4TvPQrElt6hw0ew6Zh5kjD2/O4EtwrEzkfQsaVvDXpoEePnrmuddmw3Kzi1pU
Pn8yvM0il/o=
=my+Y
-----END PGP SIGNATURE-----
-- 
Rich Pieri <rich.pieri@prescienttech.com> | If Happy Fun Ball begins to smoke,
Prescient Technologies, Inc.              | get away immediately. Seek shelter
A Stone & Webster Company                 | and cover head.
I speak for myself, not PTI or SWEC       |