Subject: [Emailcore] Ticket #17: G.7.10. Further clarifications needed to deprecated source routes?

From: Alexey Melnikov <[email-masked]>
Date: Thu, 4 Nov 2021 20:45:43 +0000

Dear EMAILCORE WG participants,

I've started writing some suggestions about how to resolve this ticket, 
but the number of changes is potentially huge. So before I send a long 
email with suggestions, I would like to poll the WG about directions in 
regards to resolving this ticket.

Background: RFC 5321 says that source routes are deprecated since 1989, 
yet at the same time servers must accept them and there are various 
SHOULDs about whether they can be ignored or rejected by servers, and 
about when clients can generate them. It also talks about using source 
routing to work around temporary DNS problems and for mail system debugging.

So my question is, whether the document

a) should be stripped of all mentioning of handling of source routes in 
text and ABNF, other than to specify their historical use in RFC 821 and 
point to RFC 821 for implementations that want to implement them for 
backward compatibility;

  or

b) allow source routing in ABNF, but strengthen existing text to MUST 
NOT be used;

  or

c) make various parts of the document consistent in regards to allowing 
source routing only for "working around temporary DSN problems" and mail 
system debugging. Don't use the word "deprecated" when describing source 
routing, because basically this is not true in the 2 cases listed above

?

Maybe I missed some other alternatives.

Opionions?

Best Regards,

Alexey

---

From: Michael Peddemors <[email-masked]>
Date: Thu, 4 Nov 2021 14:09:00 -0700

> point to RFC 821 for implementations that want to implement them for 

+1

Unless of course, an argument can be made for a real world need to 
continue this.  Given the current state of email, and restrictions 
placed on accepted inbound traffic, it is highly doubtful that such mail 
can be uniformly delivered at all any more..

Bag it and tag it ;)

-- 
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 4 Nov 2021 19:16:27 -0400

> On 4 Nov 2021, at 4:45 pm, Alexey Melnikov <[email-masked]> wrote:
> 
> a) should be stripped of all mentioning of handling of source routes in text and ABNF, other than to specify their historical use in RFC 821 and point to RFC 821 for implementations that want to implement them for backward compatibility;

+1 for "a)".

Postfix ignores RFC821 source routes.  Instead, Postfix by default recognises
legacy Sendmail-compatible source route formats:

	"user%remote.example"@local.example
	"remote.example!user"@local.example

only from clients allowed to relay, refusing the recipient address otherwise:

    http://www.postfix.org/postconf.5.html#allow_percent_hack
    http://www.postfix.org/postconf.5.html#swap_bangpath

Neither of the legacy Sendmail-compatible source-route forms overlap with
the legacy source route syntax in the RFC.

One important reason to handle these forms is to not become an indirect
open relay when forwarding such recipient addresses as-is to internal
systems that may treat them source routes.

-- 
	Viktor.

---

From: "John Levine" <[email-masked]>
Date: 4 Nov 2021 20:18:56 -0400

>point to RFC 821 for implementations that want to implement them for 

How many MTAs still recognize them?  I just checked Gmail, AOLhoo, and Hotmail/Outlook
and none of them do.

At this point source routes deserve at most a historical footnote.

R's,
John

---

From: Viktor Dukhovni <[email-masked]>
Date: Thu, 4 Nov 2021 22:53:49 -0400

> On 4 Nov 2021, at 7:16 pm, Viktor Dukhovni <[email-masked]> wrote:
> 
> Postfix ignores RFC821 source routes. 

The above is perhaps unclear, in Postfix RFC821 source routes are
recognised and discarded:

	RCPT TO:<@somehop...:localpart@domain>

is treated as though it were simply:

	RCPT TO:<localpart@domain>

This at least makes sure they don't get passed along to any downstream
systems that still support them.  However I suspect we don't need any
ink spent on the topic in the standard, the historical syntax can be
found in earlier RFCs.

-- 
	Viktor.

---

From: Alessandro Vesely <[email-masked]>
Date: Fri, 5 Nov 2021 12:29:18 +0100

On Thu 04/Nov/2021 21:45:43 +0100 Alexey Melnikov wrote:
> 
> a) should be stripped of all mentioning of handling of source routes in text 
> and ABNF, other than to specify their historical use in RFC 821 and point to 
> RFC 821 for implementations that want to implement them for backward 
> compatibility;

+1 for (a).  The other options either waste ink (b) or will never work in 
practice (c).

Best
Ale
--

---

From: Jeremy Harris <[email-masked]>
Date: Fri, 5 Nov 2021 14:26:02 +0000

> How many MTAs still recognize them?  I just checked Gmail, AOLhoo, and Hotmail/Outlook

The support in Exim is not enabled as default; there is a config
option to do so.
-- 
Cheers,
   Jeremy