On 01/10/2020 10:04, @lbutlr wrote:

I thought this was working as intended, but I have recently been getting some random messages put into this mailbox that definitely have list-ip headers (including some messages from this list) and that do not have multiple addresses. I believe this started happening on 20200922, which would hav been when I applied the most recent update to dovecot, as that is when the listCC box seemed to explode, but I do not have traces over 7 days old.

if allof (address :count "ge" :comparator "i;ascii-numeric" ["to", "cc"] ["2"], not exists ["list-id","mailing-list", "x-loop"] ) { fileinto :create "listCC"; stop;}

Headers of a message that triggered this (minus Received and signature headers, just removed for length)

This is the trace:

23: address test 23: starting :count-ge' match with i;ascii-numeric' comparator: 23: extracting to' headers from message 23: parsing address header value Kurt Jaeger dovecot@opsec.eu, dovecot@dovecot.org' 23: address value dovecot@opsec.eu' 23: address value dovecot@dovecot.org' 23: extracting cc' headers from message 23: matching count value 2' 23: with key `2' => 1 23: finishing match with result: matched

So, it looks like it is matching Reply-To and/or X-Original-To as well as To? Or is something else happening here?

Are you sure the message below is what Sieve gets to process? The "To:" header value it is working with does not match the headers below. I don't see how Sieve could get that wrong.

23: jump if result is false 23: not jumping 24: exists test 24: header list-id' exists 24: header mailing-list' is missing 24: headers are missing 24: jump if result is true 24: not jumping

Or the logic of "not exists" has changed from AND (meaning none of those headers exist)?

Nothing has changed:

https://tools.ietf.org/html/rfc5228#section-5.5

exists ["list-id","mailing-list", "x-loop"]

This only yields true when all of these headers exists. The "not" prefix causes this to always yield false unless all headers exists, which is probably not what you intended. You need to split this into separate exists tests.

26: fileinto action 26: store message in mailbox `listCC' 27: stop command; end all script execution ## Finished executing script '.active_sieve'

Headers of that message (minute received and signature headers, elided just for length)

Reply-To: dovecot@dovecot.org Return-Path: dovecot-bounces@dovecot.org X-Original-To: dovecot@dovecot.org Delivered-To: dovecot@dovecot.org Date: Wed, 30 Sep 2020 17:06:54 +0200 From: Kurt Jaeger dovecot@opsec.eu To: dovecot@dovecot.org Subject: debugging TLS with wireshark and a custom application ? Message-ID: 20200930150654.GT53210@home.opsec.eu Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-BeenThere: dovecot@dovecot.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Dovecot Mailing List List-Unsubscribe: https://dovecot.org/mailman/options/dovecot, mailto:dovecot-request@dovecot.org?subject=unsubscribe List-Archive: https://dovecot.org/pipermail/dovecot/ List-Post: mailto:dovecot@dovecot.org List-Help: mailto:dovecot-request@dovecot.org?subject=help List-Subscribe: https://dovecot.org/mailman/listinfo/dovecot, mailto:dovecot-request@dovecot.org?subject=subscribe Errors-To: dovecot-bounces@dovecot.org Sender: "dovecot" dovecot-bounces@dovecot.org

There is one address in the To and no CC header at all, so why was this filed into listCC?

(This is the only incidence of listCC in the sieve file for the list user)