Yahoo Groups archive

Milter-greylist

Index last updated: 2026-04-28 23:32 UTC

Message

Re: [milter-greylist] Submitter DNS name resolution and forgery detection

2013-08-16 by Johann Klasek

On Fri, Aug 16, 2013 at 06:40:56PM +0200, manu@... wrote:
> Hajimu UMEMOTO <ume@...> wrote:
> 
> > manu> You mean we first have to strip "[" or "[IPv6:" ? 
> > 
> > JFYI, RFC 5321 defines address-literal as follows:
> > 
> > address-literal  = "[" ( IPv4-address-literal /
> >                    IPv6-address-literal /
> >                    General-address-literal ) "]"
> >                    ; See Section 4.1.3
> > 
> > IPv4-address-literal  = Snum 3("."  Snum)
> > 
> > IPv6-address-literal  = "IPv6:" IPv6-addr
> 
> I tried the test program published earlier on NetBSD, "::1" is resolved
> to "localhost", "IPv6:::1" is not. I guess IPv6: shall be stripped.

Got the same result on Solaris 8, Linux Fedora 15. In my opinion this is ok
(see below).

> 
> I get it working with this:
> 
>         if (strncmp(addr, "[IPv6:", 6) == 0) {
>                 (void)strncpy(abuf, addr + 6, len - 7);
>                 abuf[len - 7] = '\0';
>         } else {        /* Strip leading '[' and trailing ']' */
>                 (void)strncpy(abuf, addr + 1, len - 2);
>                 abuf[len - 2] = '\0';
>         }

Looks ok to me.

> I wonder if this is a but in NetBSD getnameinfo(3)

A bug?
No, getnameinfo() has no sense about brackated addresses at all, which is used in
RFC5321 (SMTP) context only.

Sendmail log contains always [IPv6:] style IPv6 addresses, even if they
are not resolveable:

Resolveable:
relay=mail.NetBSD.org [IPv6:2001:4f8:3:7::25]

Not resolveable:
relay=[IPv6:2a01:1b0:7999:446:0:2:8ed:2c78]

In the latter case sendmail sets the macros like this

client_name: [IPv6:2001:41d0:8:452c::1]
client_addr: IPv6:2001:41d0:8:452c::1

(always in compressed representation)

I found it interesting that even client_addr is a typical resolver
information and not directly related to SMTP, the IPv6 prefix is
preserved ...
(just to note for the ruleset hackers out there).




Johann

Attachments

Move to quarantaine

This moves the raw source file on disk only. The archive index is not changed automatically, so you still need to run a manual refresh afterward.