[Dovecot] sieve problem email silently discard

[fakessh at]

On Wed, 6 Jul 2011 18:17:07 +0200
fakessh @ <ml at smtp.fakessh.eu> wrote:

> On Mon, 04 Jul 2011 15:01:55 +0200
> Stephan Bosch <stephan at rename-it.nl> wrote:
> 
> > Op 4-7-2011 14:19, ml at smtp.fakessh.eu schreef:
> > >  Le lundi 4 juillet 2011 00:40, ml at smtp.fakessh.eu a écrit :
> > > > I just change my sieve script by removing the implicit discard a
> > > > fileinto :create "Junk.spam.spam"
> > [...]
> > >  it just happened a mail that was issued in INBOX.spam.spam supposedly
> > >  a hit with spam than 500 which does not appear in the body of the
> > >  mail here
> > [...]
> > >  I do not see why this email was issued in this box
> > 
> > I've executed sieve-test with your script and message, which reproduces 
> > the problem at my end:
> > 
> > ===
> > $ sieve-test -t - -T level=matching ~/fakessh.sieve ~/fakessh.eml
> >        ## Started executing script 'frop'
> >     2: header test
> >     2:   starting `:value-ge' match with `i;ascii-numeric' comparator:
> >     2:   extracting `X-Spam-score' headers from message
> >     2:   matching value `-1.9'
> >     2:     with key `500' => 1
> >     2:   finishing match with result: matched
> >     3: jump if result is false
> >     3:   not jumping
> >     5: discard action; cancel implicit keep
> >     6: stop command; end all script execution
> >        ## Finished executing script 'frop'
> > 
> > Performed actions:
> > 
> >   * discard
> > 
> > Implicit keep:
> > 
> >    (none)
> > 
> > sieve-test(stephan): Info: final result: success
> > ===
> > 
> > This turns out to be a classic mistake actually (which I didn't think of 
> > either). It is related to the (admittedly counter-intuitive) nature of 
> > the i;ascii-numeric comparator.
> > 
> >  From RFC4790, Section 9.1.1 
> > (http://tools.ietf.org/html/rfc4790#section-9.1.1):
> > `The "i;ascii-numeric" collation is a simple collation intended for use 
> > with arbitrarily-sized, unsigned decimal integer numbers stored as octet 
> > strings. US-ASCII digits (0x30 to 0x39) represent digits of the numbers. 
> > Before converting from string to integer, the input string is truncated 
> > at the first non-digit character. All input is valid; strings that do 
> > not start with a digit represent positive infinity.'
> > 
> > This comparator thus works on UNSIGNED integers only. Even worse, 
> > negative numbers are mapped to positive infinity, which is obviously > 
> > 500! There is your problem. I remember that issue was reported some time 
> > ago by someone else too.
> > 
> > To solve your problem, you need to check for the negative sign first. E.g.:
> > 
> > require ["comparator-i;ascii-numeric","relational"];
> > if allof(
> >          not header :matches "x-spam-score" "-*",
> >          header :value "ge" :comparator "i;ascii-numeric" "x-spam-score" 
> > "500")
> > {
> >    discard;
> >    stop;
> > }
> 
> a simple script are one syntax proximate to a sample exemple to stephan
> 
> 
> how to make a complex script that deals with both spam spam hist flag suspicious address diverse
> 
> i try this
> ~]# cat /var/sieve-scripts/roundcube.sieve
> 
> require ["fileinto","regex","comparator-i;ascii-numeric","reject","relational","mailbox","reject","variables","envelope","subaddress"];
> # rule:[spammanage]
> #if anyof (header :contains "X-Spam-Flag" "YES")
> #{
> #       fileinto "Junk";
> #}
> if allof(
>          not header :matches "x-spam-score" "-*",
>          header :value "ge" :comparator "i;ascii-numeric" "x-spam-score"
> "500")
> {
>    discard;
>    stop;
> }
> if anyof (
>    # puremsg scores (30% or higher)
>    header :matches ["X-Spam-Flag"] ["Yes"]
> ) {
>    fileinto "Junk";
>    stop;
> }
> 
> elsif anyof (
> header :contains "Received"
>              [ "[4.63.221.224",
> 
>              ]
> )
> {
>         fileinto :create "Junk";
> }
> elsif anyof (
>       header :contains ["SPAM", "X-Spam-Status"]
>              ["ADDRESSES_ON_CD","ACT_NOW",
>              ]
> )
> {
>         fileinto :create "Junk";
> }
> 
> 
> or better much approch is 
> the succession a if anyof elsif anyof
> not work for the discard action
> 
> 
> > 
> > Or, even better: start using the spamtest(plus) extension.
> > 
> > Regards,
> > 
> > Stephan.
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> 
> 


work well transform allof in anyof


-- 
 http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x092164A7
 gpg --keyserver pgp.mit.edu --recv-key 092164A7
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <http://dovecot.org/pipermail/dovecot/attachments/20110706/3ea61139/attachment.bin>