[Dovecot] sieve problem email silently discard

[fakessh at]

On Mon, 04 Jul 2011 15:01:55 +0200
Stephan Bosch <stephan at rename-it.nl> wrote:

> Op 4-7-2011 14:19, ml at smtp.fakessh.eu schreef:
> >  Le lundi 4 juillet 2011 00:40, ml at smtp.fakessh.eu a écrit :
> > > I just change my sieve script by removing the implicit discard a
> > > fileinto :create "Junk.spam.spam"
> [...]
> >  it just happened a mail that was issued in INBOX.spam.spam supposedly
> >  a hit with spam than 500 which does not appear in the body of the
> >  mail here
> [...]
> >  I do not see why this email was issued in this box
> 
> I've executed sieve-test with your script and message, which reproduces 
> the problem at my end:
> 
> ===
> $ sieve-test -t - -T level=matching ~/fakessh.sieve ~/fakessh.eml
>        ## Started executing script 'frop'
>     2: header test
>     2:   starting `:value-ge' match with `i;ascii-numeric' comparator:
>     2:   extracting `X-Spam-score' headers from message
>     2:   matching value `-1.9'
>     2:     with key `500' => 1
>     2:   finishing match with result: matched
>     3: jump if result is false
>     3:   not jumping
>     5: discard action; cancel implicit keep
>     6: stop command; end all script execution
>        ## Finished executing script 'frop'
> 
> Performed actions:
> 
>   * discard
> 
> Implicit keep:
> 
>    (none)
> 
> sieve-test(stephan): Info: final result: success
> ===
> 
> This turns out to be a classic mistake actually (which I didn't think of 
> either). It is related to the (admittedly counter-intuitive) nature of 
> the i;ascii-numeric comparator.
> 
>  From RFC4790, Section 9.1.1 
> (http://tools.ietf.org/html/rfc4790#section-9.1.1):
> `The "i;ascii-numeric" collation is a simple collation intended for use 
> with arbitrarily-sized, unsigned decimal integer numbers stored as octet 
> strings. US-ASCII digits (0x30 to 0x39) represent digits of the numbers. 
> Before converting from string to integer, the input string is truncated 
> at the first non-digit character. All input is valid; strings that do 
> not start with a digit represent positive infinity.'
> 
> This comparator thus works on UNSIGNED integers only. Even worse, 
> negative numbers are mapped to positive infinity, which is obviously > 
> 500! There is your problem. I remember that issue was reported some time 
> ago by someone else too.
> 
> To solve your problem, you need to check for the negative sign first. E.g.:
> 
> require ["comparator-i;ascii-numeric","relational"];
> if allof(
>          not header :matches "x-spam-score" "-*",
>          header :value "ge" :comparator "i;ascii-numeric" "x-spam-score" 
> "500")
> {
>    discard;
>    stop;
> }

a simple script are one syntax proximate to a sample exemple to stephan


how to make a complex script that deals with both spam spam hist flag suspicious address diverse

i try this
~]# cat /var/sieve-scripts/roundcube.sieve

require ["fileinto","regex","comparator-i;ascii-numeric","reject","relational","mailbox","reject","variables","envelope","subaddress"];
# rule:[spammanage]
#if anyof (header :contains "X-Spam-Flag" "YES")
#{
#       fileinto "Junk";
#}
if allof(
         not header :matches "x-spam-score" "-*",
         header :value "ge" :comparator "i;ascii-numeric" "x-spam-score"
"500")
{
   discard;
   stop;
}
if anyof (
   # puremsg scores (30% or higher)
   header :matches ["X-Spam-Flag"] ["Yes"]
) {
   fileinto "Junk";
   stop;
}

elsif anyof (
header :contains "Received"
             [ "[4.63.221.224",

             ]
)
{
        fileinto :create "Junk";
}
elsif anyof (
      header :contains ["SPAM", "X-Spam-Status"]
             ["ADDRESSES_ON_CD","ACT_NOW",
             ]
)
{
        fileinto :create "Junk";
}


or better much approch is 
the succession a if anyof elsif anyof
not work for the discard action


> 
> Or, even better: start using the spamtest(plus) extension.
> 
> Regards,
> 
> Stephan.
> 
> 
> 
> 
> 
> 
> 


-- 
 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x092164A7
 gpg --keyserver pgp.mit.edu --recv-key 092164A7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://dovecot.org/pipermail/dovecot/attachments/20110706/132e3cb9/attachment.bin>