dovecot - Sep 2009 - odd dovecot / spampal interaction

[Apologies if you've seen this message twice.  I originally sent it from
another e-mail account but it never seemed to appear on the list for me.]

Apologies if this has been mentioned before.  I've searched quite a few of
the archives, but haven't found an answer.

I've just installed dovecot 1.1.6 on my qnap server, and have found an odd
interaction with spampal that I've not seen before using other imap servers.

Let me attempt to explain.

On the mail server machine, I use XMail to pull in new messages from my
external pop3 mail account.  These messages are then visable to dovecot's
imap server.

On my mail client machine, I have a spampal proxy between outlook express
and the imap server.

So, when I wish to read mail, outlook express connects to the spampal proxy
and spampal then connects to the dovecot imap server.

That all works fine until a message that spampal thinks is spam arrives.

spampal instructs the dovecot imap server to move the message from Inbox to
the Spam folder and then expunge Inbox.

However, erroneously, a random message in my Inbox now seems to lose its
seen flag.

So if I have 5 new spam messages arrive, all 5 get moved from Inbox to Spam,
but correspondingly 5 messages in the middle of my Inbox are now apparently
not seen, so outlook express says there are 5 unseen messages, and lets me
move down to them.

It's almost as if the flags for the Spam folder are being applied to the
Inbox folder instead.

I've used wireshark to capture an example session of this happening when 2
spam messages arrive, in the hope that somebody wiser than I can work out
what is going wrong, and where.

Any help gratefully received.

Thanks.

-- gyre -- 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: stream.zip
Type: application/x-zip-compressed
Size: 12197 bytes
Desc: not available
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20090903/cbdb5b87/attachment-0002.bin>

On Thu, 2009-09-03 at 18:36 +0100, gyre wrote:
> I've used wireshark to capture an example session of this happening
when 2
> spam messages arrive, in the hope that somebody wiser than I can work out
> what is going wrong, and where.
Was this captured between client <-> spampal or spampal <-> dovecot?
I'd
guess the first? It looks like spampal breaks the traffic:

* 1158 FETCH (UID 1160 FLAGS (\Seen))
* 1159 FETCH (U
ID 1161 FLAGS (\Seen))
* 1160 FETCH (UID 1162 FLAGS (\Seen))

It inserts an extra linefeed in the middle of FETCH responses. Another
bug in it is that it ends all lines with CR+CR+LF instead of CR+LF.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
URL:
<http://dovecot.org/pipermail/dovecot/attachments/20090906/e27b3419/attachment-0002.bin>