Subject: [spfbis] New old issue: i18n for EAI compatibility

From: Alessandro Vesely <[email-masked]>
Date: Tue, 10 Apr 2012 11:27:20 +0200

Chairs, all:

Last year Frank wrote

  I'm willing to update or rewrite the SPF-EAI draft if somebody
  plans to implement it.  I intend to revive the SPF options draft
  when and if I feel that it helps for SPF "modifier registry" or
  "scope" discussions.
  http://www.ietf.org/mail-archive/web/spfbis/current/msg00012.html

He was referring to the active I-D
http://tools.ietf.org/html/draft-ellermann-spf-eai

I couldn't find an issue on the datatracker for SPF-EAI.  Is there
one?  Unfortunately, Frank suddenly disappears from the Internet every
now and then.  I guess that's why he missed to signal that issue at
the proper time for it.  Do we add it now?

TIA

---

From: S Moonesamy <[email-masked]>
Date: Tue, 10 Apr 2012 02:37:21 -0700

Hi Alessandro,
>the proper time for it.  Do we add it now?

No, it's better not to add more drafts for now.

Regards,
S. Moonesamy
SPFBIS co-chair

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 10 Apr 2012 12:34:07 +0200

Hi SM,

> No, it's better not to add more drafts for now.

Yeah, we only got the experiment I-D, as of now.  I meant a ticket on
the issue tracker, before we forget about EAI again.  I thought this
issue was already there, but I'm 92% sure it's actually missing.

---

From: S Moonesamy <[email-masked]>
Date: Tue, 10 Apr 2012 07:29:35 -0700

Hi Alessandro,
>issue was already there, but I'm 92% sure it's actually missing.

Let's assume that you are the chair of this working group.  This is 
what you know:

  1. The working group did not have any clue on how to conclude the experiment

  2. The working group has an I-D discussing about the conclusion

  3. The working group has a document editor for the I-D

  4. There are over five working group participants who have committed to work
     on the I-D

If you open a ticket now, there is one more problem to solve.

I'll leave it as an option for you, or anyone else, to raise this as 
an issue if/when there is a working group I-D for 4408bis.

Regards,
S. Moonesamy
SPFBIS WG co-chair

P.S. As an individual comment, I am ok if you raise an objection to the above.

---

From: S Moonesamy <[email-masked]>
Date: Tue, 10 Apr 2012 08:56:17 -0700

Hi Alessandro,
>issue was already there, but I'm 92% sure it's actually missing.

My co-chair performed a sanity check on the message I posted today ( 
http://www.ietf.org/mail-archive/web/spfbis/current/msg01096.html 
).  It makes sense to open a ticket (#28) based on the message you 
posted at http://www.ietf.org/mail-archive/web/spfbis/current/msg01085.html

Regards,
S. Moonesamy
SPFBIS WG co-chair

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 10 Apr 2012 19:37:45 +0200

On Tue 10/Apr/2012 19:35:24 +0200 S Moonesamy wrote:
> 
> It makes sense to open a ticket (#28) based on the message you posted
> at http://www.ietf.org/mail-archive/web/spfbis/current/msg01085.html

Thank you so much for that, also on behalf of Frank (as far as I can
guess...)

---

From: "John Levine" <[email-masked]>
Date: 13 Apr 2012 16:38:03 -0000

Hi there, catching up on mail after being mostly offline in a cottage
in a sheep pasture in Iceland.

The final version of EAI got rid of the two-address stuff, so the only
issue I'm aware of is that the bounce address or EHLO in an EAI
transaction can have the domain name coded in UTF-8 rather than as an
A-label.

The obvious fix is for 4408bis to say that if the domain being looked
up is UTF-8, turn it into an A-label before doing the rest of the SPF
processing.  This transformation will always work for any valid message.

R's,
John

---

From: Hector Santos <[email-masked]>
Date: Fri, 13 Apr 2012 15:40:10 -0400

John Levine wrote:
> up is UTF-8, turn it into an A-label before doing the rest of 
> the SPF processing.  This transformation will always work for 
> any valid message.

+1

-- 
Hector Santos, CTO
http://www.santronics.com
http://hector.wildcatblog.com

---

From: Douglas Otis <[email-masked]>
Date: Fri, 13 Apr 2012 15:24:45 -0700

On 4/13/12 9:38 AM, John Levine wrote:
>  The final version of EAI got rid of the two-address stuff, so the
>  only issue I'm aware of is that the bounce address or EHLO in an EAI
Dear John,

This is a common mistake clarified in Section 3.7.1 of RFC6531.
http://tools.ietf.org/html/rfc6531#section-3.7.1

The EAI concern only affects bounce addresses and not EHLO/HELO.

It is not clear how a change in processing or EAI awareness is 
signaled.  Clearly when the EHLO/HELO identity is identified as a basis 
for a check, the EAI issue can be ignored.  But when the bounce address 
results in a failure that might occur as a result of previously 
unspecified A-label conversions being omitted, how is EAI awareness 
(A-label conversion) indicated?  Secondly, it seems important to also 
indicate SPF Pass results conveyed to users may also expose them to 
various look-alike phishing vulnerabilities.  When this issue was raised 
in the DKIM WG, it was also pointed out that DNS operates with any UTF-8 
query string and that A-label conversion without additional checks will 
not prevent some exploitation methods.

Regards,
Douglas Otis

---

From: "John Levine" <[email-masked]>
Date: 13 Apr 2012 23:25:35 -0000

>The EAI concern only affects bounce addresses and not EHLO/HELO.

Oh, of course.  You can't use UTF-8 until you've checked the response
to EHLO and seen if the server supports EAI.

Nonetheless, the fix is still right, turn UTF-8 domains into A-labels.
Any UTF-8 that can't be turned into an A-label isn't a valid domain,
so you can do whatever SPF does with invalid domains now.

R's,
John