Subject: [spfbis] Issue: Add IP4/IP6 Input check in section 5.6

From: Hector Santos <[email-masked]>
Date: Tue, 18 Sep 2012 02:32:55 -0400

Proposal, add the following (starter text) to 5.6.

   Receivers SHOULD check the ip4/ip6 and corresponding cidr malicious
   values which will always return a true masking match despite the
   client IP address. For example, a policy as follows will also 
return a true
   masking match:

       v=spf1 ip4:128.0.0.0/1 ip4:0.0.0.0/1 -all

Background:

I found the domain freepaylesscoupons.com in my recent logs the above 
SPF policy. IMO, this is an example of a malicious sender providing 
the illusion of a strong domain policy SPF holder with -ALL directive, 
yet provides an IP4 address that will always yield a positive IP4 
masking match against algorithms that do not check the input.

I check our SPF API IP4 match function and it does not do this check. 
I also check the 2004 and current versions of the open source libspf2 
and my quick reading shows they do not do input checks.

4408 has semantics for returning a PermError for an illegal IP4 
address. IMTO, the values 128.0.0.0 and 0.0.0.0 and/or any IP4/CIDR 
pairs should be considered illegal/invalid addresses if they always 
return a true masking match.

-- 
HLS