Andrew C Aitchison via Exim-users wrote on 15.11.2023 21:00:
>> Let's resolve the TXT record of the perrigo.com domain.
>>
>> # pkg info -E exim
>> exim-4.96.2
>>
>> # echo '${lookup dnsdb{>\n; defer_never,txt=perrigo.com}}' | exim -be |
>> grep v=spf1
>> v=spf1 include:spf-00157e01.pphosted.com
>> include:spf-00157e03.pphosted.com include:spf.protection.outlook.com
>> include:spf.natchcloud.com include:spf.messagelabs.com
>> include:spf.mailjet.com a:smtp5.silae.fr include:_spf-dc8.sapsf.co#
>> include:_spf-dc4.sapsf.com ip4:70.42.227.151/32 ip4:70.42.227.152/32
>> ip4:65.221.8.29/32 ip4:65.221.12.128/2 ip4:65.221.12.148/32
>> ip4:198.11.114.29/32 ~all
>
> git bisect finds that
> commit f6b1f8e7d642f82d830a71b78699a4349e0158e1
> Date: Tue Oct 10 23:03:28 2023 +0100
>
> Harden dnsdb against crafted DNS responses. Bug 3033
>
> (cherry picked from commit 8787c8994f07c23c3664d76926e02f07314d699d)
> is to blame.
>
> [ I note that the '#' in include:_spf-dc8.sapsf.co# is actually 0x9c. ]
But host returns value without 0x9c:
# host -t txt perrigo.com | grep v=spf
perrigo.com descriptive text "v=spf1 include:spf-00157e01.pphosted.com
include:spf-00157e03.pphosted.com include:spf.protection.outlook.com
include:spf.natchcloud.com include:spf.messagelabs.com
include:spf.mailjet.com a:smtp5.silae.fr include:_spf-dc8.sapsf.com" "
^^^^
include:_spf-dc4.sapsf.com ip4:70.42.227.151/32 ip4:70.42.227.152/32
ip4:65.221.8.29/32 ip4:65.221.12.128/32 ip4:65.221.12.148/32
ip4:198.11.114.29/32 ~all"
This TXT record is too long and wrapped.
For testing purposes I created such entry this way:
test IN TXT (
"v=spf1
include:spf-00157e01.pphosted.com include:spf-00157e03.pphosted.com
include:spf.protection.outlook.com include:spf.natchcloud.com
include:spf.messagelabs.com include:spf.mailjet.com a:smtp5.silae.fr
include:_spf-dc8.sapsf.com"
" include:_spf-dc44.sapsf.com
ip4:70.42.227.151/32 ip4:70.42.227.152/32 ip4:65.221.8.29/32
ip4:65.221.12.128/32 ip4:65.221.12.148/32 ip4:198.11.114.29/32 ~all"
)
This isn't "crafted DNS responses".
exim shows 0x9c exactly at the end of the first string:
# echo '${lookup dnsdb{>\n; defer_never,txt=test.mx.org.ua}}' | exim -be
| grep v=spf1
v=spf1 include:spf-00157e01.pphosted.com
include:spf-00157e03.pphosted.com include:spf.protection.outlook.com
include:spf.natchcloud.com include:spf.messagelabs.com
include:spf.mailjet.com a:smtp5.silae.fr include:_spf-dc8.sapsf.co#
^^^^
include:_spf-dc44.sapsf.com ip4:70.42.227.151/32 ip4:70.42.227.152/32
ip4:65.221.8.29/32 ip4:65.221.12.12832 ip4:65.221.12.148/32
ip4:198.11.114.29/32 ~ll
host dowsn't show 0x9c:
# host -t txt test.mx.org.ua | grep v=spf
test.mx.org.ua descriptive text "v=spf1
include:spf-00157e01.pphosted.com include:spf-00157e03.pphosted.com
include:spf.protection.outlook.com include:spf.natchcloud.com
include:spf.messagelabs.com include:spf.mailjet.com a:smtp5.silae.fr
include:_spf-dc8.sapsf.com" " include:_spf-dc44.sapsf.com
^^^^^^^
ip4:70.42.227.151/32 ip4:70.42.227.152/32 ip4:65.221.8.29/32
ip4:65.221.12.128/32 ip4:65.221.12.148/32 ip4:198.11.114.29/32 ~all"
Maybe this is also a bug?
--
Best wishes Victor Ustugov
mailto:victor@corvax.kiev.ua
public GnuPG/PGP key: https://victor.corvax.kiev.ua/corvax.asc
--
## subscription configuration (requires account):
##
https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/
## unsubscribe (doesn't require an account):
## exim-users-unsubscribe@???
## Exim details at
http://www.exim.org/
## Please use the Wiki with this list -
http://wiki.exim.org/
