OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: "%" character in MAIL FROM??

From: Wietse Venema (wietseporcupine.org)
Date: Wed Jan 18 2006 - 08:41:47 CST


lst_hoe01kwsoft.de:
[ Charset UTF-8 unsupported, converting... ]
> Zitat von Victor Duchovni <Victor.DuchovniMorganStanley.com>:
>
> > On Wed, Jan 18, 2006 at 02:33:51PM +0100, Ralf Hildebrandt wrote:
> >
> >> * lst_hoe01kwsoft.de <lst_hoe01kwsoft.de>:
> >>
> >> > Jan 18 13:15:43 web postfix/qmgr[26578]: 004CF51DC2:
> >> > from=<SRS0=PVEe=3O=k.st=jasonvor3%TEXT1%srs.kundenserver.de>,
> >> > size=2968, nrcpt=1 (queue active)
> >>
> >> Admittedly, the address LOOKS odd.
> >
> > However odd it may look, it is fully RFC compliant. In fact
> > user%hostdomain, is legacy Sendmail source route syntax, and is even
> > supported by Postfix. This interpretation of the local-part is a local
> > matter, neither sanctioned, nor endorsed by the RFC.
> >
> > This said, addresses of the form '%foodomain' or 'foo%domain' are
> > not recommended, because Sendmail compatible systems may experience
> > indigestion. They are never the less quite legal.
>
> Any pointers to the RFC ...
> I have glanced 821 and 2821 but not (yet) found the description of the
> allowed literals. I once found it but remember it was hours of search
> :-(

RFC2822:
atext = ALPHA / DIGIT / ; Any character except controls,
                        "!" / "#" / ; SP, and specials.
                        "$" / "%" / ; Used for atoms
                        "&" / "'" /
                        "*" / "+" /
                        "-" / "/" /
                        "=" / "?" /
                        "^" / "_" /
                        "`" / "{" /
                        "|" / "}" /
                        "~"

atom = [CFWS] 1*atext [CFWS]

The other RFCs (821, 2821, 822) don't mention "%" at all.

> As for the mail in question : It is a by user-filter forwarded (spam)
> mail from a system using SRS.
> Our only intention is to not bounce anything after accepting it and we
> want to know if its better to reject or force the AV to accept it.

It really looks like a missing DOS %parameter% substitution.

        Wietse