dovecot - Mar 2019 - Unexpected behavior with sieve_vacation_to_header_ignore_envelope = yes

Hello,

we face an issue with the vacation extension of pigeonhole. Our upstream 
mail server (from which we pull our E-Mails with POP3) uses SPF and 
performs a SRS re-write of the Return Path. Once the mail is processed 
via our local postfix, it is delivered via dovecot deliver (using the 
lda). When the recipient has a vacation rule enabled in sieve, the 
out-of-office note cannot be sent, as pigeonhole tries to use the 
Return-Path (which is not accepted as sender by the mail server).

We are using the following dovecot / pigeonhole versions:

dovecot-2.3.2.1
dovecot-pigeonhole-0.5.2

As of my understanding, the problem was addressed in pigeonhole version 
v0.4.21 by introducing the sieve_vacation_to_header_ignore_envelope 
setting. Anyway - even when this is set to "yes" pigeonhole still uses
the Return-Path instead of the "From:" header which I had expected:

Feb 27 13:22:26 mail dovecot: 
lda(customer)<48383><3o+yOQGBdlz/vAAAZU03Dg>: Error: sieve: 
msgid=<e081d2ba-21d5-c32b-3750-69fe0c8a76d2 at petermann-it.de>: failed to
send vacation response to 
SRS0=gwGXg6ad=RC=petermann-it.de=matthias at example.com: <Sendmail program 
returned error> (temporary error)

Are my expectations wrong or did I miss some precondition?

Best regards,
Matthias

1) This is the email which I use to test (I replaced the actual domain 
with example.com):

------>8------------------------------------------------------------------------------
Return-Path: <SRS0=gwGXg6ad=RC=petermann-it.de=matthias at example.com>
Delivered-To: customer[[@example.com]]
To: Customer <customer at example.com>
From: Matthias Petermann <matthias at petermann-it.de>
Subject: Test
Message-ID: <e081d2ba-21d5-c32b-3750-69fe0c8a76d2 at petermann-it.de>
Date: Wed, 27 Feb 2019 05:21:45 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
  Thunderbird/60.5.1

Test message
------8<------------------------------------------------------------------------------

2) The related excerpt of the configuration:

------>8------------------------------------------------------------------------------
mail /usr/local/etc/dovecot/conf.d >doveconf | grep -A 10 -B 10 
to_header_ignore_envelope
   result_failure = continue
   result_internalfail = continue
   result_success = return-ok
   skip = never
   username_filter }
plugin {
   acl = vfile
   acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes
   sieve = file:/srv/vmail/%u/sieve;active=/srv/vmail/%u/active.sieve
   sieve_vacation_to_header_ignore_envelope = yes
}
pop3_client_workarounds pop3_delete_type = default
pop3_deleted_flag pop3_enable_last = no
pop3_fast_size_lookups = no
pop3_lock_session = no
pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
pop3_no_flag_updates = no
pop3_reuse_xuidl = no
------8<------------------------------------------------------------------------------

-- 
Matthias Petermann <matthias at petermann-it.de>

Op 27/02/2019 om 13:30 schreef Matthias Petermann via
dovecot:
> Hello,
>
> we face an issue with the vacation extension of pigeonhole. Our 
> upstream mail server (from which we pull our E-Mails with POP3) uses 
> SPF and performs a SRS re-write of the Return Path. Once the mail is 
> processed via our local postfix, it is delivered via dovecot deliver 
> (using the lda). When the recipient has a vacation rule enabled in 
> sieve, the out-of-office note cannot be sent, as pigeonhole tries to 
> use the Return-Path (which is not accepted as sender by the mail server).
>
> We are using the following dovecot / pigeonhole versions:
>
> dovecot-2.3.2.1
> dovecot-pigeonhole-0.5.2
>
> As of my understanding, the problem was addressed in pigeonhole 
> version v0.4.21 by introducing the 
> sieve_vacation_to_header_ignore_envelope setting. Anyway - even when 
> this is set to "yes" pigeonhole still uses the Return-Path
instead of
> the "From:" header which I had expected:
>
> Feb 27 13:22:26 mail dovecot: 
> lda(customer)<48383><3o+yOQGBdlz/vAAAZU03Dg>: Error: sieve: 
> msgid=<e081d2ba-21d5-c32b-3750-69fe0c8a76d2 at petermann-it.de>:
failed
> to send vacation response to 
> SRS0=gwGXg6ad=RC=petermann-it.de=matthias at example.com: <Sendmail 
> program returned error> (temporary error)
>
> Are my expectations wrong or did I miss some precondition?
That setting is only about the composition of the "To:" header for the
outgoing vacation message (it's in the name). It has nothing to do with 
the RCPT TO envelope address used for that message. Why exactly do the 
mail servers reject the vacation message (I am not too familiar with SRS).

Regards,

Stephan.

>
> Best regards,
> Matthias
>
> 1) This is the email which I use to test (I replaced the actual domain 
> with example.com):
>
>
------>8------------------------------------------------------------------------------
>
> Return-Path: <SRS0=gwGXg6ad=RC=petermann-it.de=matthias at
example.com>
> Delivered-To: customer[[@example.com]]
> To: Customer <customer at example.com>
> From: Matthias Petermann <matthias at petermann-it.de>
> Subject: Test
> Message-ID: <e081d2ba-21d5-c32b-3750-69fe0c8a76d2 at petermann-it.de>
> Date: Wed, 27 Feb 2019 05:21:45 +0100
> User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
> ?Thunderbird/60.5.1
>
> Test message
>
------8<------------------------------------------------------------------------------
>
>
> 2) The related excerpt of the configuration:
>
>
------>8------------------------------------------------------------------------------
>
> mail /usr/local/etc/dovecot/conf.d >doveconf | grep -A 10 -B 10 
> to_header_ignore_envelope
> ? result_failure = continue
> ? result_internalfail = continue
> ? result_success = return-ok
> ? skip = never
> ? username_filter > }
> plugin {
> ? acl = vfile
> ? acl_shared_dict = file:/var/lib/dovecot/shared-mailboxes
> ? sieve = file:/srv/vmail/%u/sieve;active=/srv/vmail/%u/active.sieve
> ? sieve_vacation_to_header_ignore_envelope = yes
> }
> pop3_client_workarounds > pop3_delete_type = default
> pop3_deleted_flag > pop3_enable_last = no
> pop3_fast_size_lookups = no
> pop3_lock_session = no
> pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
> pop3_no_flag_updates = no
> pop3_reuse_xuidl = no
>
------8<------------------------------------------------------------------------------
>
>

Hello Stephan,

Am 03.03.2019 um 00:50 schrieb Stephan Bosch via dovecot:>
 >
 > Op 27/02/2019 om 13:30 schreef Matthias Petermann via dovecot:
 >> Hello,
 >>
 >> we face an issue with the vacation extension of pigeonhole. Our
 >> upstream mail server (from which we pull our E-Mails with POP3) uses
 >> SPF and performs a SRS re-write of the Return Path. Once the mail is
 >> processed via our local postfix, it is delivered via dovecot deliver
 >> (using the lda). When the recipient has a vacation rule enabled in
 >> sieve, the out-of-office note cannot be sent, as pigeonhole tries to
 >> use the Return-Path (which is not accepted as sender by the mail 
server).
 >>
 >> We are using the following dovecot / pigeonhole versions:
 >>
 >> dovecot-2.3.2.1
 >> dovecot-pigeonhole-0.5.2
 >>
 >> As of my understanding, the problem was addressed in pigeonhole
 >> version v0.4.21 by introducing the
 >> sieve_vacation_to_header_ignore_envelope setting. Anyway - even when
 >> this is set to "yes" pigeonhole still uses the Return-Path
instead of
 >> the "From:" header which I had expected:
 >>
 >> Feb 27 13:22:26 mail dovecot:
 >> lda(customer)<48383><3o+yOQGBdlz/vAAAZU03Dg>: Error:
sieve:
 >> msgid=<e081d2ba-21d5-c32b-3750-69fe0c8a76d2 at petermann-it.de>:
failed
 >> to send vacation response to
 >> SRS0=gwGXg6ad=RC=petermann-it.de=matthias at example.com: <Sendmail
 >> program returned error> (temporary error)
 >>
 >> Are my expectations wrong or did I miss some precondition?
 >
 > That setting is only about the composition of the "To:" header
for the
 > outgoing vacation message (it's in the name). It has nothing to do
with
 > the RCPT TO envelope address used for that message. Why exactly do 
the > mail servers reject the vacation message (I am not too familiar 
with SRS).
Thanks for the clarification. In the postfix log, it states the 
following reason for rejection:

Mar  3 08:34:34 mail postfix/smtpd[28049]: NOQUEUE: reject: RCPT from 
unknown[10.0.0.2]: 550 5.1.1 
<SRS0=gwGXg6ad=RC=petermann-it.de=matthias at example.com>: Recipient 
address rejected: User unknown; from=<> 
to=<SRS0=gwGXg6ad=RC=petermann-it.de=matthias at example.com> proto=ESMTP 
helo=<mail>

So it seems that the RCPT TO is rejected because the server (relay) 
doesn't accept the SRS adress as recipient.

Is there any way to manipulate the RCPT TO from pigeonhole to match the 
To header? Seems like I have to look into postfix if there is a way to 
decode the RCTP TO. Unfortunately, I am still not too knowledgeable 
about SRS, but will try to find out more.

Best regards,
Matthias


-- 
Matthias Petermann <matthias at petermann-it.de>