In opendmarc-reports.in expect "1" for arc=pass, but in docs written what should be 0 for arc=pass

[Albram]

Hello

$ uname -v
FreeBSD 14.2-RELEASE-p1 GENERIC

$ opendmarc -V
opendmarc: OpenDMARC Filter v1.4.2
SMFI_VERSION 0x1000001
libmilter version 1.0.1
Active code options:
WITH_SPF
WITH_SPF2

When I was looking for the reason why the arc=fail in my outgoing reports, I noticed that in the opendmarс-reports.in expects 1 for arc=pass

OpenDMARC/reports/opendmarc-reports.in

Line 715 in 9cebf72

case 1 { $arcstr = "pass"; }

In README file written what arc must be 0 for pass.

OpenDMARC/opendmarc/README

Line 183 in 9cebf72

arc ARC evaluation (0 = pass, 2 = fail)

Value "arc" in opendmarc. database may be 0 or 7, but result in outgoing reports will be arc=fail.
Both reports from this data have arc=fail.

1. .dat file:
   arc 0
   arc_policy 2 json:[{ "i": 3, "d":"google.com", "s":"arc-20240605", "ip":"" }, { "i": 2, "d":"google.com", "s":"arc-20240605", "ip":"" }, { "i": 1, "d":"mydomen.com", "s":"sel15", "ip":"" }]
   action 2

report:
<type>local_policy</type> <comment>arc=fail as[3].d=google.com as[3].s=arc-20240605 as[2].d=google.com as[2].s=arc-20240605 as[1].d=mydomen.com as[1].s=sel15</comment>
2. .dat file:
arc 7
arc_policy 2 json:[]
action 0

report:
<type>local_policy</type> <comment>arc=fail</comment>

In my case, changing case 1 to case 0 in opendmarc.in does not affect the overall result in the sent report, in it the value of arc is taken from $arcpolicy, which is always 2 for me (I have not yet found why).

[Albram]

May be I wrong wrote about source of issue in previous message.
Trying more with example: I have installed opendkim, opendmarc (versions OS and OpenDMARC in previous message above) and our work fine long a time. After install openarc I notise what all dmarc reports from my server has 'arc=fail' in tag 'comment'.
In opendmarc.dat file I see 'arc 0', 'arc_policy 2 json:[{"i": 3, "d":"google.com", "s":"arc-20240605", "ip":"" }, { "i": 2, "d":"google.com", "s":"arc-20240605", "ip":"" }, { "i": 1, "d":"mydomain.com", "s":"myselector", "ip":"" }]' if received message have arc signatures. And 'arc 7', 'arc_policy 2' if not or not valid arc signatures.
In opendmarc database this values carryied correct and have same values (arc = 0 or 7, arc_policy always 2).
I trying find why arc=fail in all dmarc reports from my server.
I have two instance of openarc milter, first checking input mesages and add header Authentication-Results:
Milter (openarc_v) insert (0): header: Authentication-Results: smtp.mydomain.com; arc=pass header.oldest-pass=0 smtp.remote-ip=209.85.128.51

Second instance of openarc add arc signatures in outgoing messages after all changing from other milters.
Spf, dkim, arc signed massage from my server have 'pass' status in dmarc reports from other domains (not all checking arc).

Sample log fragment of arc signed message received from Google mailbox with redirect settings to my mailbox (I sended message to this Google mailbox from other mailbox on my server for test reason):

...
Milter (openarc_v) insert (0): header: Authentication-Results:  smtp.mydomain.com; arc=pass header.oldest-pass=0 smtp.remote-ip=209.85.128.51
...
Milter (opendkim) insert (1): header: Authentication-Results:  smtp.mydomain.com;\n\tdkim=pass (2048-bit key; unprotected) header.d=mydomain.com header.i=@mydomain.com header.b=zL4KtxNx
...
opendmarc[2610]: 558CW3Bn051249: SPF(mailfrom): gmail.com pass
Milter (opendmarc) insert (1): header: Authentication-Results: smtp.mydomain.com; spf=pass smtp.mailfrom=gmail.com
...
Milter (opendmarc) insert (1): header: Authentication-Results: smtp.mydomain.com; dmarc=pass (p=reject dis=none) header.from=mydomain.com

File opendmarc.dat from this message:

job 558CW3Bn051249
reporter smtp.mydomain.com
received 1749385930
ipaddr 209.85.128.51
from mydomain.com
mfrom gmail.com
dkim mydomain.com - 0
spf 0
pdomain mydomain.com
policy 15
rua mailto:report@mydomain.com
pct 100
adkim 114
aspf 114
p 114
sp 0
align_dkim 4
align_spf 5
arc 0
arc_policy 2 json:[{ "i": 3, "d":"google.com", "s":"arc-20240605", "ip":"" }, { "i": 2, "d":"google.com", "s":"arc-20240605", "ip":"" }, { "i": 1, "d":"mydomain.com", "s":"selector", "ip":"" }]
action 2

Headers from this letter in local inbox with last added auth results (i4):

ARC-Seal: i=4; d=mydomain.com; s=myselector; a=rsa-sha256; cv=pass; t=1749385935;
...
ARC-Authentication-Results: i=4; smtp.mydomain.com; dmarc=pass (p=reject dis=none) header.from=mydomain.com;
        spf=pass smtp.mailfrom=gmail.com;
        dkim=pass (2048-bit key; unprotected) header.d=mydomain.com header.i=@mydomain.com header.b=zL4KtxNx;
        arc=pass header.oldest-pass=0 smtp.remote-ip=209.85.128.51
Authentication-Results: smtp.mydomain.com; arc=pass header.oldest-pass=0 smtp.remote-ip=209.85.128.51
Authentication-Results: smtp.mydomain.com; dmarc=pass (p=reject dis=none) header.from=mydomain.com
Authentication-Results: smtp.mydomain.com; spf=pass smtp.mailfrom=gmail.com
Authentication-Results: smtp.mydomain.com;
        dkim=pass (2048-bit key; unprotected) header.d=mydomain.com header.i=@mydomain.com header.b=zL4KtxNx

Datas from messages table of database:

+-----+---------------+------+--------------+--------------+-----+-----------+------------+-----+------------+
| id  | addr          | disp | name         | name         | spf | align_spf | align_dkim | arc | arc_policy |
+-----+---------------+------+--------------+--------------+-----+-----------+------------+-----+------------+
| 899 | 209.85.128.51 |    2 | mydomain.com | gmail.com    |   0 |         5 |          4 |   0 |          2 |
+-----+---------------+------+--------------+--------------+-----+-----------+------------+-----+------------+

And outgoing dmarc report from this datas with same arc=fail in comment tag:

    <policy_published>
        <domain>mydomain.com</domain>
        <adkim>r</adkim>
        <aspf>r</aspf>
        <p>reject</p>
        <sp>reject</sp>
        <pct>100</pct>
    </policy_published>
    <record>
        <row>
            <source_ip>209.85.128.51</source_ip>
            <count>1</count>
            <policy_evaluated>
                <disposition>none</disposition>
                <dkim>pass</dkim>
                <spf>fail</spf>
                <reason>
                    <type>local_policy</type>
                    <comment>arc=fail as[3].d=google.com as[3].s=arc-20240605 as[2].d=google.com as[2].s=arc-20240605 as[1].d=mydomain.com as[1].s=myselector</comment>
                </reason>
            </policy_evaluated>
        </row>
        <identifiers>
            <header_from>mydomain.com</header_from>
        </identifiers>
        <auth_results>
            <spf>
                <domain>gmail.com</domain>
                <result>pass</result>
            </spf>
        </auth_results>
    </record>
</feedback>

After this I seeked source of 'arc=fail' in report and notice what in line 715 of opendmarс-reports.in expect 'case 1' for 'pass' value, but real values 0 or 7, and 'case 0' for arc_policy 'pass', but real value 2.

[booth-f]

I'm also seeing the same results on my server. After configuring OpenARC I am seeing in my dmarc reports that local_policy arc=fail but upon manual review of both sides I'm seeing arc=pass on emails sent to me and emails sent out.

I'd like to find some solution to this as I'm seeing from DMARC reports from other domains it's showing my email server as not aligning emails to their DMARC policy but I am. I want the DMARC reports to accurately tell others that I am aligning their emails to their DMARC policy and not because local_policy is allowing them through.

ARC-Authentication-Results: i=2; mx.google.com;
dkim=pass header.i=@redacted.net header.s=mail header.b=FHLvIkIx;
arc=pass (i=1);
spf=pass (google.com: domain of redacted@redacted.net designates 2001:xxx:xxx:xxx::xx as permitted sender) smtp.mailfrom=redacted@redacted.net;
dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=redacted.net

[thegushi]

This looked like a doc issue going in, but turned out to be a real bug.

ARES_RESULT_PASS is defined as 0 in opendmarc-ar.h, but the arc switch in opendmarc-reports used case 1 (ARES_RESULT_UNUSED) for pass. So ARC pass was never matched and everything came out arc=fail in aggregate reports regardless of what actually happened.

The arc_policy switch was half-fixed to case 0 in an earlier commit but the arc switch was missed at the same time. One-character change -- fix is in PR #313.

[thegushi]

Also, the number of valid statuses this knob can have are weird, we need to write them up better.

[thegushi]

Because this is a simple perl script, you can grab it from my github repo and just build it, and run it from a separate dir without stomping on the FreeBSD pkg (you can almost use the perl scripts whole, or just apply the fix locally, it's not large). Let me know if you're still having the issue.

[Albram]

Thanks!
I will checking soon and back with result.