From: Sven M. Hallberg <pesco@khjk.org>
Subject: Re: [patch] vacation(1): parse angle-addr in Return-Path
To: tech@openbsd.org
Date: Thu, 22 Aug 2024 09:30:37 +0200

Sven M. Hallberg on Mon, Jul 22 2024:
> The vacation program seems to parse the Return-Path header
> incorrectly.

One-month ping.

There is another easy to fix issue in that vacation will exit(1) if it
can't find a Return-Path header or mbox From line. This can (and does)
happen, however, since Return-Path is in fact an optional header. In
such a case, we should just exit with success and do nothing. Otherwise
our MTA will think we couldn't "deliver" its message.

Updated diff below.
-p


Index: vacation.c
===================================================================
RCS file: /cvs/src/usr.bin/vacation/vacation.c,v
retrieving revision 1.38
diff -u -p -r1.38 vacation.c
--- vacation.c	28 Jun 2019 13:35:05 -0000	1.38
+++ vacation.c	21 Aug 2024 08:13:45 -0000
@@ -246,6 +246,10 @@ readheaders(void)
 				break;
 			for (p = buf + 12; isspace((unsigned char)*p); ++p)
 				;
+			if (*p == '<') {
+				++p;
+				p[strcspn(p, ">")] = '\0';
+			}
 			if (strlcpy(from, p, sizeof(from)) >= sizeof(from)) {
 				syslog(LOG_NOTICE,
 				    "Return-Path %s exceeds limits", p);
@@ -306,9 +310,13 @@ findme:			for (cur = names; !tome && cur
 	if (!tome)
 		exit(0);
 	if (!*from) {
-		syslog(LOG_NOTICE,
-		    "no initial \"From\" or \"Return-Path\"line.");
-		exit(1);
+		/*
+		 * No initial "From " line or "Return-Path:" header.
+		 *
+		 * NB: Return-Path is optional. If it is not present, we
+		 * shall not respond, cf. RFC 3834.
+		 */
+		exit(0);
 	}
 }