On 2009-07-29 14:07:53 -0500, Jared Johnson wrote: > We recently noticed a message in our postfix queue that thought it was > addressed to " foo.com". After examining it, it turned out that Qpsmtpd > accepted a MAIL FROM command formatted like so: > > MAIL FROM:<u...@d.com,foo.com>
Weird.
Ah, I see the problem. In line 187 of Qpsmtpd::Address the regexp for
the domain is initialized like this:
my $domain = "(?:$address_literal|$subdomain(?:\.$subdomain)*)";
(looks like I didn't know about qr// when I wrote that code)
That's a double quoted string, so "\." needs to be written as "\\.".
[...]
> it seems that QP never should have accepted the message in
> the first place.
Right.
> I tested using vanilla git Qpsmptd::Address as follows:
>
> perl -MQpsmtpd::Address -le \
> "print Qpsmtpd::Address->new('<u...@d.com,foo.com>')"
> <u...@d.com,foo.com>
>
> Taking a look at Qpsmtpd::Address, I noticed some comments and code that
> seemed to be looking for similar syntax:
For low values of similar.
> line
> # A-d-l = At-domain *( "," A-d-l )
> # ; Note that this form, the so-called "source route",
> # ; MUST BE accepted, SHOULD NOT be generated, and SHOULD be
> # ; ignored.
>
> ...
>
> # strip source route
> $path =~ s/^...@$domain(?:,\...@$domain)*://;
>
> It looks to me like it's trying to find syntax like:
>
> MAIL FROM:<u...@d.com,@foo.com>
>
> and make it equivalent to just MAIL FROM:<u...@d.com>
No, looks for something like
<@foo.com:u...@d.com>
or
<@foo.com,@bar.com:u...@d.com>
and makes it equivalent to <u...@d.com>.
As Chris pointed out, source routes are obsolete. However, even RFC 5321
still insists that the syntax MUST be recognized. So I don't think it's
a good idea to remove the syntax. However, canonify could set a flag so
that a plugin could reject any address with a source path. Don't think
it's worth the (small) effort, though.
> That doesn't seem to be what it actually does, though:
>
> perl -MQpsmtpd::Address -le \
> "print Qpsmtpd::Address->new('<u...@d.com,@foo.com>')"
> <"u...@d.com\,"@foo.com>
The address doesn't match the pattern, so the substitution does
nothing. For a real source route it does work, however:
103% perl -MQpsmtpd::Address -le \
"print Qpsmtpd::Address->new('<@d.com,@c.com:a...@foo.com>')"
<a...@foo.com>
hp
--
_ | Peter J. Holzer | Openmoko has already embedded
|_|_) | Sysadmin WSR | voting system.
| | | h...@hjp.at | Named "If you want it -- write it"
__/ | http://www.hjp.at/ | -- Ilja O. on commun...@lists.openmoko.org
signature.asc
Description: Digital signature
