Skip to content

v0.1.4

Choose a tag to compare

View all tags
@babyhuey babyhuey released this 22 Jul 06:14
v0.1.4
f8df4fa

Highlights

This release closes out two extended review efforts since v0.1.3:

  • Passthrough SPF entry validation is now grammar-complete and permanently fuzz-tested. Config-supplied passthrough mechanisms (ip4/ip6/a/mx/ptr/exists/include) are validated against RFC 7208's full grammar: shape, CIDR-length range and leading-zero rules, character alphabet, and macro-expand syntax. A permanent property-based test suite (hypothesis + pyspf, an independent SPF parser) now fuzzes this validator continuously as a dev-only test dependency, so future grammar gaps get caught automatically instead of requiring manual review. redirect= is no longer accepted in passthrough (it was silently inert whenever the flattened record fit in a single chunk); use include: instead.
  • Deploy reliability fixes. The Lambda deployment package no longer inherits restrictive file permissions from the deploy machine's umask (previously could crash every scheduled invocation with Runtime.ImportModuleError when built on a hardened workstation). The execution role's CloudWatch Logs permissions and the Lambda create/update waiters now match AWS's documented contracts. A --function-name-derived default SSM parameter path prevents two independently-named deployments from silently clobbering each other's config.
  • Config hardening: duplicate domains, malformed domain names, and a range of malformed SPF mechanism shapes are now rejected at config-load time instead of publishing invalid or semantically-broken SPF records.

Fixes

  • Flattening now refuses to publish fail/softfail/neutral-qualified mechanisms as unconditional passes.
  • RFC 7208 lookup-cost accounting fixed for passthrough include:/redirect: chains and diamond/cyclic include graphs.
  • NXDOMAIN on an a:/mx: target no longer hard-fails the whole domain.
  • Route53 multi-ResourceRecord TXT rrsets are now detected and refused instead of silently mishandled.
  • Several hostile/malformed-DNS hardening additions: RFC 7208's MX-exchange cap, a total chain-size cap, and bounds on absurdly long or non-ASCII CIDR-length strings from both user config and remote SPF records.
  • Deploy: platform-pinned dependency builds, pip-less-environment error handling, wheel-install smoke test in CI, and several AWS provisioning correctness fixes (see above).

Full history is in the commit log between v0.1.3 and this release.

Assets 2
Loading