From: "Sven M. Hallberg" <pesco@khjk.org>
Subject: [patch] vacation(1): parse angle-addr in Return-Path
To: tech@openbsd.org
Date: Mon, 22 Jul 2024 18:39:21 +0200

Hi,

The vacation program seems to parse the Return-Path header incorrectly.
It treats anything after "Return-Path:" and whitespace as an address. On
my system (using OpenSMTPd), this fails if what follows is enclosed in
angle brackets, i.e. of the form "<foo@bar.com>". It expects a plain
address, no brackets.

Indeed, however, RFC 5332 (section 3.6.7 Trace Fields) specifies that
angle brackets belong in Return-Path:

    return          =   "Return-Path:" path CRLF

    path            =   angle-addr / ([CFWS] "<" [CFWS] ">" [CFWS])

[3.4 Address Specification:]

    angle-addr      =   [CFWS] "<" addr-spec ">" [CFWS] /
                        obs-angle-addr

The following patch to vacation(1) removes the angle brackets if present
and makes things work for me:

Index: usr.bin/vacation/vacation.c
===================================================================
RCS file: /cvs/src/usr.bin/vacation/vacation.c,v
retrieving revision 1.38
diff -u -p -r1.38 vacation.c
--- usr.bin/vacation/vacation.c 28 Jun 2019 13:35:05 -0000      1.38
+++ usr.bin/vacation/vacation.c 22 Jul 2024 16:25:31 -0000
@@ -246,6 +246,10 @@ readheaders(void)
                                break;
                        for (p = buf + 12; isspace((unsigned char)*p); ++p)
                                ;
+                       if (*p == '<') {
+                               ++p;
+                               p[strcspn(p, ">")] = '\0';
+                       }
                        if (strlcpy(from, p, sizeof(from)) >= sizeof(from)) {
                                syslog(LOG_NOTICE,
                                    "Return-Path %s exceeds limits", p);