fln/gnarwl — pull request #1 by bernhardschmidt (2013-03-18 20:54:47+00:00)
Title: Accept '+' and '=' characters in mail addresses

When the sender address contains a '+' sign (often used with things like VERP,
PVRS, but also Facebook notifications) the parser breaks and drops everything
behind the plus sign, including the sender domain

Mar 18 03:32:22 lxmhs61 postfix-forwarder/qmgr[2877]: 66D1A20035: from=, size=12411, nrcpt=3 (queue active)
Mar 18 03:32:22 lxmhs61 gnarwl[16807]: INFO/MAIL sent mail: localuser@localdomain -> update
Mar 18 03:32:22 lxmhs61 postfix-forwarder/smtp[16241]: 716C62003F: to=, orig_to=, relay=...

As you can see, gnarwl sends to the unqualified "update" address, which on
most systems will get the local domain appended.

The problem is here in src/util.c

157	for(m=0;m<(int)strlen(s);m++) {
158	if (r>-1 && l>-1) {
159	if (m
r) s[m]='*';
160	}
161	else {
162	if (! ( ((s[m]>47)&&(s[m]<58)) || ((s[m]>63)&&(s[m]<91)) || ((s[m]>96)&&(s[m]<123)) || s[m]=='.' || s[m]=='-' || s[m]=='_' ) ) s[m]='*';
163	}
164	}
165
166	tmp=splitString(s,1,'*');
167	m=1;

And fortunately, at least for '+' quite easy to fix (patch attached). The
code is most likely still broken, since almost every character can appear
in a mail address if quoted correctly, but '+' (and maybe '=') are quite
commonly used.

I briefly considered dropping everything in the localpart after '+', but
it would be more complicated and I don't see a reason to do so. After all,
the extension delimiter can be anything in today's mailsystems, and
sometimes the extension is necessary to correctly route the answer.

I have also submitted this to Debian (http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=703369)