Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: exim: users

HELO id check too strict?

 

 

exim users RSS feed   Index | Next | Previous | View Threaded


randy at psg

Nov 27, 2009, 6:32 PM

Post #1 of 14 (1828 views)
Permalink
HELO id check too strict?

4.70 on freebsd 8.0-release

rejected HELO from [202.123.56.189]: syntactically invalid argument(s): isaaa_kc.IRRI.CGIARAD.ORG

looks like a perfectly fine fqdn to me.

randy

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


espresso at bogus

Nov 27, 2009, 6:31 PM

Post #2 of 14 (1772 views)
Permalink
HELO id check too strict? [In reply to]

4.70 on freebsd 8.0-release

rejected HELO from [202.123.56.189]: syntactically invalid argument(s): isaaa_kc.IRRI.CGIARAD.ORG

looks like a perfectly fine fqdn to me.

randy

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


lennon at orcon

Nov 27, 2009, 6:52 PM

Post #3 of 14 (1768 views)
Permalink
Re: HELO id check too strict? [In reply to]

On Sat, 2009-11-28 at 11:31 +0900, Espresso Saarinen wrote:
> 4.70 on freebsd 8.0-release
>
> rejected HELO from [202.123.56.189]: syntactically invalid argument(s): isaaa_kc.IRRI.CGIARAD.ORG
>
> looks like a perfectly fine fqdn to me.

hostnames (and FQDN's) aren't allowed to have _'s in them so exim is
rejecting it correctly.

Thanks




--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


randy at psg

Nov 27, 2009, 7:01 PM

Post #4 of 14 (1773 views)
Permalink
Re: HELO id check too strict? [In reply to]

> hostnames (and FQDN's) aren't allowed to have _'s in them so exim is
> rejecting it correctly.

fqdns can have anything in them. just wait for idn deployment.

how can i turn this off now?

randy

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


exim-users at spodhuis

Nov 27, 2009, 7:07 PM

Post #5 of 14 (1775 views)
Permalink
Re: HELO id check too strict? [In reply to]

On 2009-11-28 at 11:32 +0900, Randy Bush wrote:
> 4.70 on freebsd 8.0-release
>
> rejected HELO from [202.123.56.189]: syntactically invalid argument(s): isaaa_kc.IRRI.CGIARAD.ORG
>
> looks like a perfectly fine fqdn to me.

----------------------------8< cut here >8------------------------------
+----------------+---------+------------+--------------+
|helo_allow_chars|Use: main|Type: string|Default: unset|
+----------------+---------+------------+--------------+

This option can be set to a string of rogue characters that are permitted in
all EHLO and HELO names in addition to the standard letters, digits, hyphens,
and dots. If you really must allow underscores, you can set

helo_allow_chars = _

Note that the value is one string, not a list.
----------------------------8< cut here >8------------------------------

Regards,
-Phil

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


lennon at orcon

Nov 27, 2009, 7:45 PM

Post #6 of 14 (1774 views)
Permalink
Re: HELO id check too strict? [In reply to]

On Sat, 2009-11-28 at 12:01 +0900, Randy Bush wrote:
> > hostnames (and FQDN's) aren't allowed to have _'s in them so exim is
> > rejecting it correctly.
>
> fqdns can have anything in them. just wait for idn deployment.

hostnames cannot have _'s in them.. _'s can be used but not for
hostnames of computers on the internet. (feel free to use them if you
are not connected to the internet)

I don't want to argue.. read the RFC's.. read
http://en.wikipedia.org/wiki/Hostname


if you want to put a _ in your hostname or accept _'s in HELO's then its
up to you.. but aren't playing nice on the internet


have a nice day :-)

Thanks



--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


randy at psg

Nov 27, 2009, 7:57 PM

Post #7 of 14 (1769 views)
Permalink
Re: HELO id check too strict? [In reply to]

> hostnames cannot have _'s in them.. _'s can be used but not for
> hostnames of computers on the internet. (feel free to use them if you
> are not connected to the internet)
>
> I don't want to argue.. read the RFC's.. read
> http://en.wikipedia.org/wiki/Hostname
>
>
> if you want to put a _ in your hostname or accept _'s in HELO's then its
> up to you.. but aren't playing nice on the internet

thanks for telling me. i just have no clue about the dns.

randy

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


exim-users at spodhuis

Nov 27, 2009, 8:13 PM

Post #8 of 14 (1781 views)
Permalink
Re: HELO id check too strict? [In reply to]

On 2009-11-28 at 16:45 +1300, Craig Whitmore wrote:
> On Sat, 2009-11-28 at 12:01 +0900, Randy Bush wrote:
> > > hostnames (and FQDN's) aren't allowed to have _'s in them so exim is
> > > rejecting it correctly.
> >
> > fqdns can have anything in them. just wait for idn deployment.
>
> hostnames cannot have _'s in them.. _'s can be used but not for
> hostnames of computers on the internet. (feel free to use them if you
> are not connected to the internet)
>
> I don't want to argue.. read the RFC's.. read
> http://en.wikipedia.org/wiki/Hostname
>
>
> if you want to put a _ in your hostname or accept _'s in HELO's then its
> up to you.. but aren't playing nice on the internet

Just as a minor heads-up, you're talking to the author/co-author of,
amongst others (I'm limiting this to DNS-related ones):

RFC 2181 Clarifications to the DNS Specification.
RFC 2182 Selection and Operation of Secondary DNS Servers. [BCP 16]
RFC 2870 Root Name Server Operational Requirements. [BCP 40]
RFC 2901 Guide to Administrative Procedures of the
Internet Infrastructure.
RFC 3152 Delegation of IP6.ARPA. [BCP 49]
RFC 3363 Representing Internet Protocol version 6 (IPv6) Addresses
in the Domain Name System (DNS).
RFC 3681 Delegation of E.F.F.3.IP6.ARPA.

So you're asking the author of many of the operational RFCs relating to
DNS to ... uhm ... nevermind.

Standards-track RFCs reflect the consensus standard of the IETF
participants at a given time; things change. Internationalisation of
domain-names is forcing a change of many previous assumptions; this is
part of why Exim has the dns_check_names_pattern option and documents
how to use this with allow_utf8_domains.

Most resolver libraries long ago stopped caring. It would be an
interesting world, where one can use 观音 as a hostname, but can't
include an underscore. So I think that prohibitions on underscores will
disappear within five years, in practice if not de jure.

For now, I'd be inclined to allow underscore on the submission port but
not the MX port. This isn't currently possible in Exim.

Regards,
-Phil

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


randy at psg

Nov 27, 2009, 10:05 PM

Post #9 of 14 (1766 views)
Permalink
Re: HELO id check too strict? [In reply to]

> Just as a minor heads-up, you're talking to the author/co-author of,

whoops! uncloaked. i am just another bozo on this bus.

the hostname pissing contest is way old. i fall on the liberal side.
e.g. in this case, some poor end user stuck an underscore in their
config. i just can't expect them to be well-versed in hostname arcana.
to the best of my memory, that HELO check was just to catch when there
is no fqdn.

and, for your daily pedantic amusement, in pure dns, foo.bar.com might
reall be "foo.bar," a single lhs name, in the com domain. dns is 8-bit
clean, with segments having lenth, not being dot delimited. so dots can
be in name segments.

randy

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


randy at psg

Nov 27, 2009, 10:06 PM

Post #10 of 14 (1765 views)
Permalink
Re: HELO id check too strict? [In reply to]

> helo_allow_chars = _

<blush> thanks

randy

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


wbh at conducive

Nov 27, 2009, 11:20 PM

Post #11 of 14 (1750 views)
Permalink
Re: HELO id check too strict? [In reply to]

Phil Pennock wrote:
> On 2009-11-28 at 16:45 +1300, Craig Whitmore wrote:
>> On Sat, 2009-11-28 at 12:01 +0900, Randy Bush wrote:
>>>> hostnames (and FQDN's) aren't allowed to have _'s in them so exim is
>>>> rejecting it correctly.
>>> fqdns can have anything in them. just wait for idn deployment.
>> hostnames cannot have _'s in them.. _'s can be used but not for
>> hostnames of computers on the internet. (feel free to use them if you
>> are not connected to the internet)
>>
>> I don't want to argue.. read the RFC's.. read
>> http://en.wikipedia.org/wiki/Hostname
>>
>>
>> if you want to put a _ in your hostname or accept _'s in HELO's then its
>> up to you.. but aren't playing nice on the internet
>
> Just as a minor heads-up, you're talking to the author/co-author of,
> amongst others (I'm limiting this to DNS-related ones):
>
> RFC 2181 Clarifications to the DNS Specification.
> RFC 2182 Selection and Operation of Secondary DNS Servers. [BCP 16]
> RFC 2870 Root Name Server Operational Requirements. [BCP 40]
> RFC 2901 Guide to Administrative Procedures of the
> Internet Infrastructure.
> RFC 3152 Delegation of IP6.ARPA. [BCP 49]
> RFC 3363 Representing Internet Protocol version 6 (IPv6) Addresses
> in the Domain Name System (DNS).
> RFC 3681 Delegation of E.F.F.3.IP6.ARPA.
>
> So you're asking the author of many of the operational RFCs relating to
> DNS to ... uhm ... nevermind.
>
> Standards-track RFCs reflect the consensus standard of the IETF
> participants at a given time; things change. Internationalisation of
> domain-names is forcing a change of many previous assumptions; this is
> part of why Exim has the dns_check_names_pattern option and documents
> how to use this with allow_utf8_domains.
>
> Most resolver libraries long ago stopped caring. It would be an
> interesting world, where one can use 观音 as a hostname, but can't
> include an underscore. So I think that prohibitions on underscores will
> disappear within five years, in practice if not de jure.
>

Good stuff, and realistic (speaking 'from, but not for', China...).

> For now, I'd be inclined to allow underscore on the submission port but
> not the MX port. This isn't currently possible in Exim.
>
> Regards,
> -Phil
>

..not possible as tick-a-box, but not hard, either:

- Presuming the [underscore|whatever] has already been allowed in the general
case, as discussed - THEN in an acl_smtp_helo clause:

===

[warn|deny]

!condition = ${if eq{$interface_port}{587}}
condition = [any of many parsing or lookup methods for offending character(s)]

===

Plus appropriate 'message' and 'log_message', yada, yada...

(In daily use - but firing on something other than underscores...)

Bill


--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


exim-users at spodhuis

Nov 27, 2009, 11:30 PM

Post #12 of 14 (1747 views)
Permalink
Re: HELO id check too strict? [In reply to]

On 2009-11-28 at 15:05 +0900, Randy Bush wrote:
> > Just as a minor heads-up, you're talking to the author/co-author of,
>
> whoops! uncloaked. i am just another bozo on this bus.
>
> the hostname pissing contest is way old. i fall on the liberal side.
> e.g. in this case, some poor end user stuck an underscore in their
> config. i just can't expect them to be well-versed in hostname arcana.
> to the best of my memory, that HELO check was just to catch when there
> is no fqdn.
>
> and, for your daily pedantic amusement, in pure dns, foo.bar.com might
> reall be "foo.bar," a single lhs name, in the com domain. dns is 8-bit
> clean, with segments having lenth, not being dot delimited. so dots can
> be in name segments.

I have a test zone with such interesting items in it. test.globnix.net.

% host foo.bar.test.globnix.net
foo.bar.test.globnix.net has address 192.0.2.3
% host 'foo\.bar.test.globnix.net'
foo\.bar.test.globnix.net has address 192.0.2.4
% host 'shoot-self-in-foot\..test.globnix.net'
shoot-self-in-foot\..test.globnix.net has address 192.0.2.6
% host 'Philip Pennock woz ere.test.globnix.net'
Philip\032Pennock\032woz\032ere.test.globnix.net has address 192.0.2.5

Interesting seeing what breaks.

-Phil

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


randy at psg

Nov 28, 2009, 12:45 AM

Post #13 of 14 (1742 views)
Permalink
Re: HELO id check too strict? [In reply to]

> % host foo.bar.test.globnix.net
> foo.bar.test.globnix.net has address 192.0.2.3
> % host 'foo\.bar.test.globnix.net'
> foo\.bar.test.globnix.net has address 192.0.2.4
> % host 'shoot-self-in-foot\..test.globnix.net'
> shoot-self-in-foot\..test.globnix.net has address 192.0.2.6
> % host 'Philip Pennock woz ere.test.globnix.net'
> Philip\032Pennock\032woz\032ere.test.globnix.net has address 192.0.2.5

yummy. post this to dns-operations so folk throw things at it

randy

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/


exim-users at lists

Nov 28, 2009, 3:47 AM

Post #14 of 14 (1747 views)
Permalink
Re: HELO id check too strict? [In reply to]

Phil Pennock wrote:

> For now, I'd be inclined to allow underscore on the submission port but
> not the MX port. This isn't currently possible in Exim.

helo_allow_chars = _

deny condition = ${if eq{$received_port}{25}}
condition = ${if match{$sender_helo_name}{_}}
message = Underscores not allowed on the MX port

--
Mike Cardwell - IT Consultant and LAMP developer
Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
Technical Blog: https://secure.grepular.com/blog/

--
## List details at http://lists.exim.org/mailman/listinfo/exim-users
## Exim details at http://www.exim.org/
## Please use the Wiki with this list - http://wiki.exim.org/

exim users RSS feed   Index | Next | Previous | View Threaded
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.