Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 28 Jun 2021 13:20:27 -0300
From:   Jason Gunthorpe <jgg@ziepe.ca>
To:     Benjamin LaHaise <ben@communityfibre.ca>
Cc:     James Bottomley <James.Bottomley@HansenPartnership.com>,
        linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: linux-mm@kvack.org - limping on a backup
Message-ID: <20210628162027.GC4604@ziepe.ca>
References: <20210622145954.GA4058@kvack.org>
 <214c41fae1f1b148e5b04a58c1b018fb091d7e83.camel@HansenPartnership.com>
 <20210625171259.GG4058@kvack.org>
 <6f309c63f5b7be968ae679e81ab959db05681e8a.camel@HansenPartnership.com>
 <20210625192607.GH4058@kvack.org>
 <20210628134607.GA4604@ziepe.ca>
 <20210628135352.GL4058@kvack.org>
 <20210628142659.GB4604@ziepe.ca>
 <20210628144051.GM4058@kvack.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20210628144051.GM4058@kvack.org>
Precedence: bulk

On Mon, Jun 28, 2021 at 10:40:51AM -0400, Benjamin LaHaise wrote:
> On Mon, Jun 28, 2021 at 11:26:59AM -0300, Jason Gunthorpe wrote:
> > Isn't a 7-bit conversion what I pointed at last time we talked about
> > this?
> 
> I changed several options in postfix last time this was raised, but as
> nobody ever provided a test case, I had no way of knowing if it worked or
> not.

I've been using a script like this against the lore public inbox git
repos to monitor my own domain's dkim cleanness and interaction with
list serves:

#!/usr/bin/python3
import subprocess
import collections

# Starting points
start = XXXXX # git commit id string

emails = collections.defaultdict(list)
commits = subprocess.check_output(["git","log","master","^" + start,'--pretty=format:%H %aN <%aE>']).decode()
for ln in commits.splitlines():
    commit,_,email = ln.partition(' ')
    if "nvidia.com" in email.lower():
        emails[email].append(commit)

fails = set()
not_empty = True;
while not_empty:
    not_empty = False;
    for email,commits in sorted(emails.items()):
        if email in fails or not commits:
            continue
        commit = commits[-1];
        del commits[-1]
        if commits:
            not_empty = True;
        msg = subprocess.check_output(["git","show",commit + ":m"]);
        try:
            subprocess.check_output(["dkimverify"], input=msg);
            #print(email)
        except:
            fails.add(email)
            print("Failed!", email, commit)

It has taken a lot of doing, but nvidia.com is now effectively DKIM
clean through vger.

You could run with with some known-good domains like nvidia.com,
facebook.com, google.com, to measure kvack's activity. Failures can
often be cross-correlated against a vger list and then you can do A/B
comparison to guess what is wrong.

> spec that ignores decades of that philosophy at the IETF.  And even if a
> DKIM signature passes, that's still not enough to trust the resulting
> email.  All it does is ensure that a small subset of valid emails get
> dropped on the floor.  This doesn't seem like an overall win.

I have no idea. It is here, people beyond us have made this decision,
we have to work within it. DMARC is ratcheting this up and is moving
to say if DKIM fails then emails should be discared.

Jason