Re: [marf] Including Mail fields in IODEF

"John Levine" <johnl@taugh.com> Sun, 03 March 2013 16:26 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: marf@ietfa.amsl.com
Delivered-To: marf@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 18DC621F8793 for <marf@ietfa.amsl.com>; Sun, 3 Mar 2013 08:26:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -111.106
X-Spam-Level:
X-Spam-Status: No, score=-111.106 tagged_above=-999 required=5 tests=[AWL=0.093, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9IXq+zIqAVnu for <marf@ietfa.amsl.com>; Sun, 3 Mar 2013 08:26:28 -0800 (PST)
Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 5A5C121F8767 for <marf@ietf.org>; Sun, 3 Mar 2013 08:26:22 -0800 (PST)
Received: (qmail 6605 invoked from network); 3 Mar 2013 16:26:22 -0000
Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 3 Mar 2013 16:26:22 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=513379ad.xn--yuvv84g.k1303; i=johnl@user.iecc.com; bh=jG6PWMXlhrKSWx+SFJ3BvM37b+xhz3AKxy/bgfgSZM0=; b=EeGyVhAqRGokLTrNQ/eKx843aRu6Hf1pMZAUvSnIjTOwV2216KjW3VGKmClNu68uU9xbqiDru+0unjf+XxEthKeFsfxlddGnoC+vYPsUkX/+Zz/M8qfEtfOzlfYb8t9omCyWNaXlkoWxtyO6NgoMBY7oVKLu5q0o7zz9fNgbjnA=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:cc:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=513379ad.xn--yuvv84g.k1303; olt=johnl@user.iecc.com; bh=jG6PWMXlhrKSWx+SFJ3BvM37b+xhz3AKxy/bgfgSZM0=; b=DDv0/AhvjUuPVQbUb4jyMLUxP7Mn9S4h7QLqpGNdQZF/im/F2qbeaHjFtNoZjjSWt2RrtFut3nZhSSeUSaVcyCrCoXKQw///EVikK4jUyGadD3CF0O7YvqSdDQeDKL9QcQPyD7/PfNUGs6BxVdwHjb3ugtEpCJLzW05uoLs4shA=
VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org
Date: 3 Mar 2013 16:25:58 -0000
Message-ID: <20130303162558.87728.qmail@joyce.lan>
From: "John Levine" <johnl@taugh.com>
To: marf@ietf.org
In-Reply-To: <CAL0qLwZxwkcJi7Ej0fU5s8k-xZ=n_4fa0cvVVF05YtQPc3Ndag@mail.gmail.com>
Organization:
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 7bit
Subject: Re: [marf] Including Mail fields in IODEF
X-BeenThere: marf@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Message Abuse Report Format working group discussion list <marf.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/marf>, <mailto:marf-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/marf>
List-Post: <mailto:marf@ietf.org>
List-Help: <mailto:marf-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/marf>, <mailto:marf-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 03 Mar 2013 16:26:29 -0000

In article <CAL0qLwZxwkcJi7Ej0fU5s8k-xZ=n_4fa0cvVVF05YtQPc3Ndag@mail.gmail.com>;,
Murray S. Kucherawy <superuser@gmail.com>; wrote:
>The issue with MARF inside IODEF is that the receiver needs to know that
>the payload being provided inside an EmailMessage element is itself an ARF
>report, and not the message that caused the report in the first place.  You
>certainly could crack open the EmailMessage content and see if conforms to
>the ARF specification to tell which kind of report you've gotten, but that
>seems inelegant.

You also couldn't recognize a complaint about a misdirected ARF report.  That
sort of overloading of fields usually leads to sadness and regret.

>I suppose then another option is an extension element that indicates you've
>received an ARF payload rather than the actual offending message.

That could do it.  Or if you're going to do that, crack apart the ARF report,
put the feedback-report part in the new element, and the message in the
message element.

R's,
John