Text 26340, 89 rader
Skriven 2015-07-29 12:17:46 av mark lewis (1:3634/12.73)
  Kommentar till text 26322 av Michiel van der Vlist (2:280/5555)
Ärende: Routing 200MB of echomail via an unsuspecting system
============================================================
29 Jul 15 12:48, you wrote to Matt Bedynek:

 MV>>> I patiently await what happens...

 MB>> I would hope anyone running software which the code has been touched
 MB>> after the mid 1990s no longer has this concern.   The individual
 MB>> messages inside a packet contain source and destination addresses.
 MB>> Whether any modern software is capable of being misconfigured to route
 MB>> echomail traffic via another system or a receiving system capable of
 MB>> forwarding it is another.   It can and did happen in the past.

 MV> The past is the past.

 MV> Yes, there is a field for the destination address, albeit only 2D. So if a
 MV> (echo)mail processor ignores the AREA: XXX kludge and treats the message
as
 MV> netmail, yes than it can be routed. Assuming there is a valid address in
de
 MV> destination field.

thank you for this admission that it is possible... FWIW: one doesn't have to
ignore the AREA line, either... the order of processing only needs routing to
take place before packing into PKTs... today's SOP do not apply routing to
echomail messages at all but it only takes one misconfiguration or ordering of
instructions to cause it to happen...

 MV> I would not just hope, but expect this to be an issue of the past.

it has happened in recent times (eg: within the last two years)...

 MV> Surely, 30 years ago when the echomail system as we know it now was
 MV> not yet current practise, there were such systems. But they must
 MV> quickly have been weeded out when echomail became the main driving
 MV> force in Fidonet.

the process has not changed... it is the same as it ever was...

 MV> Today's mail processors DO recognise the AREA: XXX kludge and treat it
 MV> as echomail when found. In that case the destination field is ignored

i would hope that the destination address fields are NOT ignored! that's leaves
one ripe for bogus mail injections if they just blindly process any echomail
landing in their inbound inside a valid PKT address to the system...

 MV> and where it is to be send to is determined by the configuration of
 MV> the areamanager. Such a message is never routed, it is processed by
 MV> the tosser. Only messages without an AREA: XXX line are treated as
 MV> netmail

remember, echomail is just another flavor of netmail... with or without the
AREA line, echomail can be processed in the same manner as netmail...

 MB>> You will also note that I specifically mentioned older software in my
 MB>> example (i.e. qmail and perhaps squishmail).

 MV> Yes, you did. But others claim it is still possible today.

it is no claim... it has happened in recent times (eg: within the last two
years IIRC)...

 MV> There is one among us who's name I shall not mention, who has the
 MV> habit of making claims based on outlandish scenarios. This may have
 MV> some entertainment value at first, but when repeated it becomes
 MV> boring. It becomes annoying when it degrades into a standard
 MV> discussion tactic.

your blindness leaves you open to problems... your lack of imagination leaves
you blind to other scenarios... the combination leaves you with security
risks...

 MB>> I think you folks are so bitter at one another that you forgot the
 MB>> original argument and look for any reason to pounce on each another.

 MV> I do not pounce on anyone. I just partcipate in an experiment that
 MV> provides those claiming they can route echomail, with an opportinity
 MV> to put their money where their mouth is.

knowing full well that once mail is dropped off at one system, there's no
control over what happens to it from there on... that's called a trap and one
that you and björn are quite adept at playing... espcially since you two would
be ones to set up a specific method of catching and stopping the processing so
you could crow that it all fails and no one has anything to worry about... see
the tag line, mr. fox...

)\/(ark

... A fox should not be on the jury at a goose's trial.
---
 * Origin:  (1:3634/12.73)