Bug 165593

Summary: uses cr+lf in newly added header fields while lf is used in rest of e-mail
Product: Red Hat Enterprise Linux 4 Reporter: Robert Pelletier <drizzt>
Component: cyrus-imapdAssignee: Tomas Janousek <tjanouse>
Status: CLOSED INSUFFICIENT_DATA QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.0CC: wtogami
Target Milestone: ---   
Target Release: ---   
Hardware: i386   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-04-30 08:59:26 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Robert Pelletier 2005-08-10 17:23:32 UTC
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR; rv:1.7.10) Gecko/20050717 Firefox/1.0.6

Description of problem:
Headers added by cyrus-imapd to e-mails fools spamassassin and formail on determining what is the e-mail's header and what is the e-mail's body.

In my case, the header that was added is : 
Received: from murder ([unix socket])
         (authenticated user=drizzt bits=0)
         by Zacknafein.MenzoNet.org (Cyrus v2.2.12-Invoca-RPM-2.2.12-3.RHEL4.1)
with LMTPA;
         Tue, 09 Aug 2005 11:14:59 -0400

Removing this header manually from the e-mail makes formail and "spamassassin -d" work again.

Version-Release number of selected component (if applicable):
cyrus-imapd-2.2.12-3.RHEL4.1

How reproducible:
Always

Steps to Reproduce:
1. Receive new spam mail
2. Find the directory where it is stored
3. Run "spamassassin -d" on the mail and see if markups were removed
  

Actual Results:  SpamAssassin markups aren't removed

Expected Results:  E-mail should be cleaned from SpamAssassin's markups

Additional info:

cat email | formail -X "" :
Return-Path: cyrus  Wed Aug 10 13:23:18 2005
Received: from murder ([unix socket])
         (authenticated user=drizzt bits=0)
         by Zacknafein.MenzoNet.org (Cyrus

Comment 2 Robert Pelletier 2005-08-17 12:52:50 UTC
Finaly, it seams that the problem is the change line caracter used by Cyrus.

If I open the e-mail with pico, and replace all line changes with one done
manually, everything works as expected.

Comment 3 John Dennis 2005-08-17 14:24:54 UTC
Would you please be more specific:

What change line character? Are you referring to <CR> vs. <CR><LF>?

Which header?

What was the exact replacement?

Comment 4 Robert Pelletier 2005-08-17 14:31:55 UTC
These headers : 
Received: from murder ([unix socket])
         (authenticated user=analuisa bits=0)
         by Zacknafein.MenzoNet.org (Cyrus v2.2.12-Invoca-RPM-2.2.12-3.RHEL4.1)
with LMTPA;
         Wed, 17 Aug 2005 09:01:15 -0400
X-Sieve: CMU Sieve 2.2

Is there a way to see exactly which caracter it is? I would really like to get
more specific.. (and script the thing for the time being!)

Comment 5 John Dennis 2005-08-17 14:50:43 UTC
Right off the top of my head there are two ways.

1) od -t x1z
   you can either pipe the data into od or give it a file

2) emacs hexlify mode on a buffer

If you replaced things manually you must know what you replaced, right?

Comment 6 Robert Pelletier 2005-08-17 14:56:36 UTC
0000000 52 65 74 75 72 6e 2d 50 61 74 68 3a 20 3c 63 79  >Return-Path: <cy<
0000020 72 75 73 40 5a 61 63 6b 6e 61 66 65 69 6e 2e 4d  >rus<
0000040 65 6e 7a 6f 4e 65 74 2e 6f 72 67 3e 0a 52 65 63  >enzoNet.org>.Rec<
0000060 65 69 76 65 64 3a 20 66 72 6f 6d 20 6d 75 72 64  >eived: from murd<
0000100 65 72 20 28 5b 75 6e 69 78 20 73 6f 63 6b 65 74  >er ([unix socket<
0000120 5d 29 0a 09 20 28 61 75 74 68 65 6e 74 69 63 61  >]).. (authentica<
0000140 74 65 64 20 75 73 65 72 3d 61 6e 61 6c 75 69 73  >ted user=analuis<
0000160 61 20 62 69 74 73 3d 30 29 0a 09 20 62 79 20 5a  >a bits=0).. by Z<
0000200 61 63 6b 6e 61 66 65 69 6e 2e 4d 65 6e 7a 6f 4e  >acknafein.MenzoN<
0000220 65 74 2e 6f 72 67 20 28 43 79 72 75 73 20 76 32  >et.org (Cyrus v2<
0000240 2e 32 2e 31 32 2d 49 6e 76 6f 63 61 2d 52 50 4d  >.2.12-Invoca-RPM<
0000260 2d 32 2e 32 2e 31 32 2d 33 2e 52 48 45 4c 34 2e  >-2.2.12-3.RHEL4.<
0000300 31 29 20 77 69 74 68 20 4c 4d 54 50 41 3b 0a 09  >1) with LMTPA;..<
0000320 20 57 65 64 2c 20 31 37 20 41 75 67 20 32 30 30  > Wed, 17 Aug 200<
0000340 35 20 30 39 3a 30 31 3a 31 35 20 2d 30 34 30 30  >5 09:01:15 -0400<
0000360 0a 58 2d 53 69 65 76 65 3a 20 43 4d 55 20 53 69  >.X-Sieve: CMU Si<
0000400 65 76 65 20 32 2e 32 0a 52 65 63 65 69 76 65 64  >eve 2.2.Received<

I replaced by deleting at the start of the line, and pressing enter to make a
new break line, thus replacing the break line without knowing exactly what it was ;)

Comment 7 Robert Pelletier 2005-08-17 15:57:31 UTC
Sorry.. I gave the output of an e-mail already tempered with..

Here's one that doesn't work :)

0000000 52 65 74 75 72 6e 2d 50 61 74 68 3a 20 3c 63 79  >Return-Path: <cy<
0000020 72 75 73 40 5a 61 63 6b 6e 61 66 65 69 6e 2e 4d  >rus<
0000040 65 6e 7a 6f 4e 65 74 2e 6f 72 67 3e 0d 0a 52 65  >enzoNet.org>..Re<
0000060 63 65 69 76 65 64 3a 20 66 72 6f 6d 20 6d 75 72  >ceived: from mur<
0000100 64 65 72 20 28 5b 75 6e 69 78 20 73 6f 63 6b 65  >der ([unix socke<
0000120 74 5d 29 0d 0a 09 20 28 61 75 74 68 65 6e 74 69  >t])... (authenti<
0000140 63 61 74 65 64 20 75 73 65 72 3d 6b 61 72 69 6e  >cated user=karin<
0000160 6f 75 20 62 69 74 73 3d 30 29 0d 0a 09 20 62 79  >ou bits=0)... by<
0000200 20 5a 61 63 6b 6e 61 66 65 69 6e 2e 4d 65 6e 7a  > Zacknafein.Menz<
0000220 6f 4e 65 74 2e 6f 72 67 20 28 43 79 72 75 73 20  >oNet.org (Cyrus <
0000240 76 32 2e 32 2e 31 32 2d 49 6e 76 6f 63 61 2d 52  >v2.2.12-Invoca-R<
0000260 50 4d 2d 32 2e 32 2e 31 32 2d 33 2e 52 48 45 4c  >PM-2.2.12-3.RHEL<
0000300 34 2e 31 29 20 77 69 74 68 20 4c 4d 54 50 41 3b  >4.1) with LMTPA;<
0000320 0d 0a 09 20 54 75 65 2c 20 31 36 20 41 75 67 20  >... Tue, 16 Aug <
0000340 32 30 30 35 20 31 30 3a 33 31 3a 34 30 20 2d 30  >2005 10:31:40 -0<
0000360 34 30 30 0d 0a 58 2d 53 69 65 76 65 3a 20 43 4d  >400..X-Sieve: CM<
0000400 55 20 53 69 65 76 65 20 32 2e 32 0d 0a 52 65 63  >U Sieve 2.2..Rec<

Comparing it with the previous output, every new line as made with 0d 0a, while
the "working" one only has 0a

Hope it helps :)

Comment 8 Robert Pelletier 2005-08-17 17:06:58 UTC
Using "dos2unix -n e-mail newmail" let me run "spamassassin -d newmail" and it
works.

Comment 9 Warren Togami 2005-08-17 18:07:46 UTC
What is spamassassin "-d" option supposed to do?  I can't find it in documentation.


Comment 10 Robert Pelletier 2005-08-17 18:12:28 UTC
it removes spamassassin's markups in an e-mail marked as spam.

From "man spamassassin" :
 -d, --remove-markup               Remove spam reports from a message

If spamassassin can't remove it's markup, it means that reporting is reporting
the e-mail with the markup.

Comment 11 Warren Togami 2005-08-17 18:16:16 UTC
Hmm odd... "man spamassassin" doesn't show that for me.

Comment 12 Robert Pelletier 2005-08-17 18:27:17 UTC
Really odd, I've been using this function for ages..

With spamassassin --help, what do you get?

Comment 13 Tomas Janousek 2007-01-31 13:39:55 UTC
What's the status of this?

Does that still happen with current spamassassin?

It seems like this is not a cyrus-imapd problem. RFC 822 says headers have to be
separated by CRLF and body is separated by two CRLFs. I think it's nonsense for
cyrus-imapd to detect what the headers are separated by.

Could you possibly attach the whole message so I can look and try to found out
the root of this issue?

Comment 14 Robert Pelletier 2007-01-31 14:03:27 UTC
I've been feeding the e-mails to dos2unix and haven't had a problem since.

Since it's been a long time, I'll try to test and get you a message. Thing is, I
switched to amavis-new and don't get spam in my mailbox anymore ;)

Comment 15 Robert Pelletier 2007-03-02 15:55:32 UTC
Sorry, since my switch of systems, it's quite hard to find a good e-mail message.

I just tried stuff, but I'd need a spam message for me to test.

Comment 16 Tomas Janousek 2007-03-28 14:11:38 UTC
I have to switch this to NEEDINFO. There's no need to reply unless there's any
news. If you don't care about this bug any more, we can as well just close it.

Comment 17 Tomas Janousek 2007-04-30 08:59:26 UTC
No answer for a month, closing, feel free to reopen when appropriate.