Subject: Re: Misc. ABNF nits

From: "Charles Lindsey" <[email-masked]>
Date: Wed, 1 Jun 2005 11:16:57 GMT

In <[email-masked]> Frank Ellermann <[email-masked]> writes:

>Henry Spencer wrote:
> 
>> Underscores were indeed in use in UUCP names... but there has
>> also been some use of them in domain names, even though it is
>> technically against the rules.

>Only for "mailable FQDN".  Maybe the real problem is the MUST
>in USEPRO and not the underline in USEFOR ?  I like this MUST,
>but if we allow "unmailable" underlines we need a SHOULD.

I copmpletely fail to understand what you are complaining about.

In the Path header, you find <path-identity>s.

A <path-indentity> can be made up of any sequence of letters, digits, '-',
'.', ':' and '_' (except that it must begin with a letter or a digit).

Any arbitrary sequence will do, though some sequences are preferred to
others, and there is a specific REQUIREMENT for the <path-identity>
inserted by the injecting agent.

Some <path-identity>s will be in the form of a domain-name; some won't.
Those that are will clearly not include either of the characters ':' or
'_'. So what? That is no reason to forbid those characters in the other
cases.

So what is your problem?

-- 
Charles H. Lindsey ---------At Home, doing my own thing------------------------
Tel: +44 161 436 6131 Fax: +44 161 436 6133   Web: http://www.cs.man.ac.uk/~chl
Email: [email-masked]      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9      Fingerprint: 73 6D C2 51 93 A0 01 E7 65 E8 64 7E 14 A4 AB A5

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 01 Jun 2005 18:39:59 +0200

> So what is your problem?

Attackers could try to hide behind a foo_bar.example.com
path identity, because it doesn't work as an abuse@ FQDN

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 01 Jun 2005 17:54:24 +0100

>path identity, because it doesn't work as an abuse@ FQDN
How is it different from spoofing Received or From headers?

---

From: Frank Ellermann <[email-masked]>
Date: Wed, 01 Jun 2005 20:38:41 +0200

> How is it different from spoofing Received or From headers?

Henry explained that "_" was okay for UUCP hosts names, so my
first idea "get rid of it" was dubious.  But when we want it
for UUCP host names we can't say "MUST be a mailable FQDN".

Okay, USEPRO only says that it's a rule for identities _added_
to the path.  Maybe I didn't get the idea that USEPRO doesn't
cover UUCP (?).  It's just a minor potential inconsistency, I
was curious about the reasoning behind it.  After all the set
of characters allowed in a path-identity isn't arbitrary.  Bye

---

From: "Charles Lindsey" <[email-masked]>
Date: Thu, 2 Jun 2005 11:23:06 GMT

>path identity, because it doesn't work as an abuse@ FQDN

But even if '_' was forbidden as a <path-identity> character, the attacker
could still try to hide behind foobar.example.com, and I doubt
[email-masked] would work either (attackers are not in the habit
of using email addresses that "work", unless they are trying to generate a
mailbomb).