Handle invalid SPF records with Unicode without crashing

[Scott Kitterman]

I've run across a domain that has what look like encoded Unicode characters in its spf record (names and ips obfuscated):

"\194\147v=spf1" "ip4:192.168.77.0/24" "ip4:192.168.78.0/24" "include:example.com" "\194\150all\194\148"

Pypolicyd-spf 1.0 chokes on this record with the following logging:

 Traceback (most recent call last):
   File "/usr/bin/policyd-spf", line 684, in <module>
     instance_dict, configData, peruser)
   File "/usr/bin/policyd-spf", line 426, in _spfcheck
     res = spf.check2(ip, helo_fake_sender, helo)
   File "/usr/lib/python2.6/site-packages/spf.py", line 310, in check2
     receiver=receiver,timeout=timeout,verbose=verbose,querytime=querytime).check()
   File "/usr/lib/python2.6/site-packages/spf.py", line 538, in check
     spf = self.dns_spf(self.d)
   File "/usr/lib/python2.6/site-packages/spf.py", line 1094, in dns_spf
     a = [t for t in self.dns_txt(domain) if RE_SPF.match(t)]
   File "/usr/lib/python2.6/site-packages/spf.py", line 1131, in dns_txt
     for a in self.dns(domainname, 'TXT')]
   File "/usr/lib/python2.6/site-packages/spf.py", line 1130, in <genexpr>
     return [''.join(s.decode("ascii") for s in a)
 UnicodeDecodeError: 'ascii' codec can't decode byte 0xc2 in position 0: ordinal not in range(128)

Postfix (2.9.3) sees this as a policy service failure and tempfails the message.

I installed pypolicyd-spf several days ago and ran in testing mode while monitoring logging to look for problems. Nothing seemed to be wrong so I made the switch from the perl based policy server I had been using to pypolicyd-spf. Then this delivery attempt started happening, which makes me wonder whether this record should be seen as invalid and discarded or decoded before interpretation.

I'm tempted to email their postmaster and tell them the record is at best invalid, but was hoping for some clarification on this first.

[Scott Kitterman (kitterman)]

I'd like to know what domain this is for testing purposes. You can email me directly if you'd rather not make it public.

[Tony Grobe (tony-grobe+launchpad)]

I've sent you a message with the actual domain and what its spf record resolves to on our server. I have no real problem with naming and shaming, but wasn't sure what the etiquette was.

I started drafting a message trying to let them know about their misconfiguration but didn't want to send until it was confirmed that this is really wrong.