dovecot - Feb 2016 - Bug Report: %% variables not expanded properly with shared namespace using . as separator

I think this is a bug.
I'd expect that location %% variables are translated the same way %
variables are interpreted, but apparently this isn't the case.
virtual folders work fine, but my shared folders fail because of the .
in the domain name.
What I get is the following:

# doveadm acl debug -u user1 at domain1.com.au shared.user2 at domain2.com.au
doveadm(user1 at domain1.com.au): Error: Mailbox 'com.au' in namespace
'shared.user2 at domain2.' doesn't exist in
/var/mail/vhosts/domain2/user2/mail/.com.au

I know there is a similar report for usernames, but these should be
interpreted at the top level and not inside the maildir.

I hope this is enough info. Let me know if I can supply any further
information.

Hugh

Here is my config:
# dovecot -n
# 2.2.21 (5345f22): /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.11 (6ddf62b87f60+)
# OS: Linux 4.3.5-300.fc23.x86_64 x86_64 Fedora release 23 (Twenty Three)
auth_mechanisms = plain login
auth_socket_path = /var/run/dovecot/auth-userdb
imap_client_workarounds = tb-extra-mailbox-sep
listen = *
log_path = /var/log/dovecot.log
mail_access_groups = mail, vmail
mail_home = /var/mail/vmail/%d/%n
mail_location = maildir:~/mail
mail_plugins = virtual, acl
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy include variables body enotify
environment mailbox date index ihave duplicate mime foreverypart
mbox_write_locks = fcntl
namespace inbox {
  inbox = yes
  location   mailbox Drafts {
    special_use = \Drafts
  }
  mailbox Junk {
    special_use = \Junk
  }
  mailbox Sent {
    special_use = \Sent
  }
  mailbox "Sent Messages" {
    special_use = \Sent
  }
  mailbox Trash {
    special_use = \Trash
  }
  prefix }
namespace others {
  list = children
  location
maildir:/var/mail/vhosts/%%d/%%n/mail:INDEX=/var/mail/vhosts/%d/%n/shared/%%u
  prefix = shared.%%u.
  separator = .
  subscriptions = yes
  type = shared
}
namespace virtual {
  location = virtual:/var/mail/vhosts/%d/%n/virtual
  prefix = virtual.
  separator = .
}
passdb {
  args = scheme=PLAIN username_format=%u /etc/dovecot/dovecot-users
  driver = passwd-file
}
plugin {
  acl = vfile
  acl_shared_dict = file:/var/mail/vhosts/shared-mailboxes.db
  sieve = ~/.dovecot.sieve
  sieve_dir = ~/sieve
  sieve_global_dir = /var/mail/vhosts/sieve-global
}
protocols = imap lmtp sieve
service auth-worker {
  user = vmail
}
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0660
    user = postfix
  }
  unix_listener auth-userdb {
    group = vmail
    mode = 0660
    user = vmail
  }
}
service imap-login {
  inet_listener imap {
    port = 143
  }
  inet_listener imaps {
    port = 0
    ssl = yes
  }
}
service lmtp {
  unix_listener /var/spool/postfix/private/dovecot-lmtp {
    group = postfix
    mode = 0600
    user = postfix
  }
}
service managesieve-login {
  inet_listener sieve {
    port = 4190
  }
}
service pop3-login {
  inet_listener pop3 {
    port = 0
  }
  inet_listener pop3s {
    port = 0
  }
}
ssl = required
ssl_cert = </etc/pki/dovecot/certs/hjbmx.ddns.net.cert.pem
ssl_cipher_list = PROFILE=SYSTEM
ssl_key = </etc/pki/dovecot/private/hjbmx.ddns.net.key.pem
userdb {
  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
  driver = static
}
protocol lmtp {
  mail_plugins = virtual, acl , sieve
}
protocol lda {
  mail_plugins = virtual, acl , sieve
}
protocol imap {
  mail_plugins = virtual, acl , imap_acl
}

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 19 Feb 2016, Hugh Bragg wrote:
> Subject: Bug Report: %% variables not expanded properly with shared
namespace
>     using . as separator
> 
> I think this is a bug.
> I'd expect that location %% variables are translated the same way %
> variables are interpreted, but apparently this isn't the case.
> virtual folders work fine, but my shared folders fail because of the .
> in the domain name.
> What I get is the following:
>
> # doveadm acl debug -u user1 at domain1.com.au shared.user2 at
domain2.com.au
> doveadm(user1 at domain1.com.au): Error: Mailbox 'com.au' in
namespace
> 'shared.user2 at domain2.' doesn't exist in
> /var/mail/vhosts/domain2/user2/mail/.com.au
> namespace others {
>  list = children
>  location >
maildir:/var/mail/vhosts/%%d/%%n/mail:INDEX=/var/mail/vhosts/%d/%n/shared/%%u
>  prefix = shared.%%u.
The mailbox Trash of user user1 at domain1.com.au would spell as IMAP token:

shared.user1 at domain1.com.au.Trash

Because . is the hierarchie separator, Dovecot must break the string at 
the 2nd ., because it cannot determine which dot comes from a domain name 
and which is a separator.

You need another hierarchie separator for all your namespaces.
http://wiki2.dovecot.org/Namespaces?highlight=%28separator%29

"IMAP clients, Sieve scripts and many parts of Dovecot configuration use 
the configured separator when referring to mailboxes. This means that if 
you change the separator, you may break things."
Meaning e.g. the fileinto in Sieve scripts need to use the other 
separator, too.
>  separator = .
>  subscriptions = yes
>  type = shared
> }
> namespace virtual {
>  location = virtual:/var/mail/vhosts/%d/%n/virtual
>  prefix = virtual.
>  separator = .
> }
> passdb {
>  args = scheme=PLAIN username_format=%u /etc/dovecot/dovecot-users
>  driver = passwd-file
> }
> plugin {
>  acl = vfile
>  acl_shared_dict = file:/var/mail/vhosts/shared-mailboxes.db
>  sieve = ~/.dovecot.sieve
>  sieve_dir = ~/sieve
>  sieve_global_dir = /var/mail/vhosts/sieve-global
> }
> protocols = imap lmtp sieve
> service auth-worker {
>  user = vmail
> }
> service auth {
>  unix_listener /var/spool/postfix/private/auth {
>    group = postfix
>    mode = 0660
>    user = postfix
>  }
>  unix_listener auth-userdb {
>    group = vmail
>    mode = 0660
>    user = vmail
>  }
> }
> service imap-login {
>  inet_listener imap {
>    port = 143
>  }
>  inet_listener imaps {
>    port = 0
>    ssl = yes
>  }
> }
> service lmtp {
>  unix_listener /var/spool/postfix/private/dovecot-lmtp {
>    group = postfix
>    mode = 0600
>    user = postfix
>  }
> }
> service managesieve-login {
>  inet_listener sieve {
>    port = 4190
>  }
> }
> service pop3-login {
>  inet_listener pop3 {
>    port = 0
>  }
>  inet_listener pop3s {
>    port = 0
>  }
> }
> ssl = required
> ssl_cert = </etc/pki/dovecot/certs/hjbmx.ddns.net.cert.pem
> ssl_cipher_list = PROFILE=SYSTEM
> ssl_key = </etc/pki/dovecot/private/hjbmx.ddns.net.key.pem
> userdb {
>  args = uid=vmail gid=vmail home=/var/mail/vhosts/%d/%n
>  driver = static
> }
> protocol lmtp {
>  mail_plugins = virtual, acl , sieve
> }
> protocol lda {
>  mail_plugins = virtual, acl , sieve
> }
> protocol imap {
>  mail_plugins = virtual, acl , imap_acl
> }
>
- -- 
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEVAwUBVsbp6Xz1H7kL/d9rAQJumAf/YtIXGM1t4WalzhrjP5azXEDXa1twsRdY
hHTycmmUpsmXlMS4Ol3kT3u/YpEBk/VMMqPay8gMuKD9rQ69wAqH9xIt47mWfwFG
NsBGbDeoCePFmdtZ+nix2RkWApNL3JDONIF0UtpUHvFj7QJrW+jqVExdBeXdijGv
rkbUr8fZl+4AM8m6CG07opTgxcgF6mFlakNe022uYSJdvH7UUY/fjJE/n+pj6lQ4
FUJ2RKSJWflJif8Klfs91iHJ9X4RVloY/WNJj52HWkthSgz3Xc9O1GTM8D1U24ZG
rZHkdDtkryC709NKqWJqnQt3ejQ1KP7mGy7zY2we+wkv8SdajbagQA==dNkH
-----END PGP SIGNATURE-----

On 19/02/2016 8:09 PM, Steffen Kaiser wrote:
> On Fri, 19 Feb 2016, Hugh Bragg wrote:
>
> > Subject: Bug Report: %% variables not expanded properly with shared
> namespace
> >     using . as separator
>
> > I think this is a bug.
> > I'd expect that location %% variables are translated the same way
%
> > variables are interpreted, but apparently this isn't the case.
> > virtual folders work fine, but my shared folders fail because of the .
> > in the domain name.
> > What I get is the following:
>
> > # doveadm acl debug -u user1 at domain1.com.au shared.user2 at
domain2.com.au
> > doveadm(user1 at domain1.com.au): Error: Mailbox 'com.au' in
namespace
> > 'shared.user2 at domain2.' doesn't exist in
> > /var/mail/vhosts/domain2/user2/mail/.com.au
>
> > namespace others {
> >  list = children
> >  location > >
>
maildir:/var/mail/vhosts/%%d/%%n/mail:INDEX=/var/mail/vhosts/%d/%n/shared/%%u
> >  prefix = shared.%%u.
>
> The mailbox Trash of user user1 at domain1.com.au would spell as IMAP
token:
>
> shared.user1 at domain1.com.au.Trash
>
> Because . is the hierarchie separator, Dovecot must break the string
> at the 2nd ., because it cannot determine which dot comes from a
> domain name and which is a separator.
>
That's much is clear and that's the issue. The Virtual can achieve this,
so why don't these plugins use the mail_home, mail_location, %% variable
which are used to create the string?
It looks like when the string representing the mailbox if constructed,
all the information is available, but that the plugin doesn't use this
and parses the string again.
I suppose the virtual plugin handles this differently. I can't tell if
it's a sequencing issue or and configuration access problem.
> -- Steffen Kaiser
- Hugh