strange sieve problem

[ellie timoney]

> Received: from storage.mail ([unix socket])
>      by storage.mail (Cyrus v2.3.16-Fedora-RPM-2.3.16-13.el6_6) with
>      LMTPA;
>      Mon, 03 Apr 2017 21:27:35 +0200
> X-Sieve: CMU Sieve 2.3

Wild guess, is your script using sieve features that are not available
in 2.3.16?  2.3.16 was released in 2009.

On Tue, Apr 4, 2017, at 04:00 PM, Walter H. via Info-cyrus wrote:
> Hello,
> 
> I've found a Sieve Tester, where everything works as I expect
> 
> https://www.fastmail.com/cgi-bin/sievetest.pl
> 
> but Cyrus Sieve doesn't
> 
> here the Sieve-Script
> 
> <BEGIN SCRIPT>
> # Sieve filter
> 
> require ["fileinto", "relational"];
> 
> if not exists ["from"]
> {
>         discard;
> }
> elsif allof (address :all :is "from" "squid at proxy.my.local",
>         address :all :is "to" "walter at my.local")
> {
>         if header :matches "subject" "[proxy] Video-URL (*) detected"
>         {
>                 fileinto "INBOX._Info.hbbtvVideoURLs";
>         }
>         elsif header :matches "subject" "[proxy] File-URL (*) detected"
>         {
>                 fileinto "INBOX._Info.ftpFileURLs";
>         }
>         else
>         {
>                 fileinto "INBOX._Info";
>         }
> }
> elsif allof (address :all :is "from" "clamav at mail.my.local",
>         address :all :is "to" "walter at my.local")
> {
>         if header :matches "subject" "[mail] Virus detected in E-mail"
>         {
>                 fileinto "INBOX._Alert";
>         }
> }
> elsif header :matches "list-id" "*<centos.centos.org>"
> {
>         fileinto "INBOX._MailLists._CENTOS";
> }
> elsif header :is "precedence" "bulk"
> {
>         fileinto "INBOX.Trash";
> }
> else
> {
>         keep;
> }
> </END SCRIPT>
> 
> and this is the Mail
> 
> <BEGIN MAIL>
> Return-Path: <squid at proxy.my.local>
> Received: from storage.mail ([unix socket])
>      by storage.mail (Cyrus v2.3.16-Fedora-RPM-2.3.16-13.el6_6) with
>      LMTPA;
>      Mon, 03 Apr 2017 21:27:35 +0200
> X-Sieve: CMU Sieve 2.3
> Received: from proxy.host by storage.mail (Postfix) with ESMTP id
> 19B2C79235
> Received: by proxy.host (Postfix, userid 23) id EB81D2B0BE
> Date: Mon, 03 Apr 2017 21:27:34 +0200
> To: walter at my.local
> Subject: [proxy] File-URL (PC) detected
> User-Agent: Heirloom mailx 12.4 7/29/08
> MIME-Version: 1.0
> Content-Type: text/plain; charset=us-ascii
> Content-Transfer-Encoding: 7bit
> Message-Id: <20170403192734.EB81D2B0BE at proxy.my.local>
> From: squid at proxy.my.local (Squid)
> 
> The following information came from the Squid proxy virtual machine.
> 
> --[ Data submitted
> ]-------------------------------------------------------
> 
> File-URL: ftp://ftp.adobe.com/lbtest.txt
> 
> </END MAIL>
> 
> this Mail is sorted correct by the sieve script
> 
> <BEGIN MAIL>
> Return-Path: <clamav at mail.my.local>
> Received: from storage.mail ([unix socket])
> by storage.mail (Cyrus v2.3.16-Fedora-RPM-2.3.16-13.el6_6) with LMTPA;
> Sun, 05 Feb 2017 19:14:15 +0100
> X-Sieve: CMU Sieve 2.3
> Received: from filter.mail by storage.mail (Postfix) with ESMTP id
> 5634078BA8
> Received: by filter.mail (Postfix) id 48F198E9
> Delivered-To: root at filter.mail
> Received: from filter.mail [local] by filter.mail (Postfix) with ESMTP id
> 35E838E8
> Received: by filter.mail (Postfix, userid 496) id 2A20D8E9
> From: ClamAV <clamav at mail.my.local>
> To: walter at waldinet.local
> Subject: [mail] Virus detected in E-mail
> Message-Id: <20170205181415.2A20D8E9 at mail.my.local>
> Date: Sun, 5 Feb 2017 19:14:15 +0100 (CET)
> X-AV-Scanned: ClamAV using ClamSMTP (filter.mail)
> 
> The following information came from the Mail filter virtual machine.
> 
> --[ Data submitted
> ]-------------------------------------------------------
> 
> Virus name: Heuristics.Phishing.Email.SpoofedDomain
> Sender:
> RTE+NE-null-b1cb1A01203481E6ZUBGCSE8TI at sellernotifications.amazon.com
> 
> Quarantined to: /var/lib/clamd.clamsmtp/virus.XeKpYL
> 
> --[ E-Mail header
> ]--------------------------------------------------------
> 
> ...
> 
> </END MAIL>
> 
> can someone give me a hint, what is wrong,
> 
> Thanks,
> Walter
> 
> ----
> Cyrus Home Page: http://www.cyrusimap.org/
> List Archives/Info: http://lists.andrew.cmu.edu/pipermail/info-cyrus/
> To Unsubscribe:
> https://lists.andrew.cmu.edu/mailman/listinfo/info-cyrus