Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (nike.apache.org: domain of bret.miller@wcg.org designates
 208.57.205.100 as permitted sender)
Subject: RE: Parsing Received Headers
Date: Tue, 04 Sep 2007 11:38:51 -0700
Message-Id: <64634e108f85404d981793aa387a62d8@wcg.org>
In-Reply-To: <200709031423.12046.Mark.Martinec+sa@ijs.si>
Thread-Topic: Parsing Received Headers
Priority: Normal
Importance: normal
Sensitivity: Normal
Thread-Index: AcfvItab6cplaFgrR1CJjGiDje2iIA==
From: "Bret Miller" <bret.miller@wcg.org>
To: "Mark Martinec" <Mark.Martinec+sa@ijs.si>,
	"users@spamassassin.apache.org" <users@spamassassin.apache.org>
MIME-Version: 1.0
Content-Type: multipart/signed;
	boundary="----=_NextPart_000_0073_01C7EEE8.2A9BDEB0";
	protocol="application/x-pkcs7-signature";
	micalg=SHA1

This is a multi-part message in MIME format.

------=_NextPart_000_0073_01C7EEE8.2A9BDEB0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

> > I'm trying to get received headers to parse correctly 
> because the ones from
> > CommuniGate Pro don't always. And, since I'm already 
> modifying the headers
> > in my connector due to the MTA not being able to do RDNS 
> without rejecting
> > based on it, I'm not aware that certain types of headers don't parse
> > correctly. My current problem is this one:
> > ...
> > My RDNS lookup was modifying the header to read:
> 
> Since you are already fixing broken Received header fields,
> I suggest you do it by the book. The syntax is prescribed
> by RFC 2821 (4.4 Trace Information):
> 
> ...
>    This line MUST be structured as follows:
> 
>    -  The FROM field, which MUST be supplied in an SMTP environment,
>       SHOULD contain both (1) the name of the source host as presented
>       in the EHLO command and (2) an address literal containing the IP
>       address of the source, determined from the TCP connection.
> ...
> 
> From-domain = "FROM" FWS Extended-Domain CFWS
> 
> Extended-Domain = Domain /
>            ( Domain FWS "(" TCP-info ")" ) /
>            ( Address-literal FWS "(" TCP-info ")" )
> 
> TCP-info = Address-literal / ( Domain FWS Address-literal )
>       ; Information derived by server from TCP connection
>       ; not client EHLO.
> 
> Domain = (sub-domain 1*("." sub-domain)) / address-literal

As for reporting this to the CommuniGate people, I doubt they have any
interest in fixing it. After all, they still use the domain name instead of
the machine name for their own EHLO/HELO command and provide no way of
overriding it for RFC compliance. We got around it by (against their
recommendation) licensing our copy to the machine instead of the domain.

Anyway, the above doesn't make any more sense to me than reading examples in
the mail I receive. So far, I haven't come up with a format that works for
SA. So, please correct:

HELO bretspc, IP 192.168.1.125, RDNS bretspc.example.com
Received: from bretspc (bretspc.example.com 192.168.1.125)...

HELO [192.168.1.125], IP 192.168.1.125, RDNS none
Received: from [192.168.1.125] (unknown 192.168.1.125)...

HELO 192.168.1.125, IP 192.168.1.125, RDNS 192.168.1.125 (yeah, I've seen
ones like this)
Received: from 192.168.1.125 (192.168.1.125 192.168.1.125)...

And then there's the matter of adding whether the sender was authenticated,
and what was supplied as "mail from". 

Perhaps the better way to do this would be to fix SA to read the CGPro
headers, do it's own RDNS lookup if necessary. The problem is that not all
the information is available to SA at that point, so I have to supply some
of it, and I suppose there would be concerns as to whether SA should be
doing the RDNS lookup itself too.

Maybe a plugin? But can a plugin get control early enough to re-write the
received header info so that it's correct for all the other places in SA it
gets used? 

So I guess my choices are there-- rewrite the received header to make it
readable, patch SA to read the information correct (this doesn't solve my
missing RDNS info problem unless I add the lookup to SA too), or add a
plugin if it's possible to do what needs to be done with it.

Honestly, rewriting the header is probably the easiest, which is why I chose
to do that. Now it's just a matter of rewriting it so that SA can actually
read it properly. I guess another problem is that I might have to say I'm
NOT running CommuniGate Pro so that SA doesn't try it's custom code on it...

Bret

------=_NextPart_000_0073_01C7EEE8.2A9BDEB0
Content-Type: application/x-pkcs7-signature;
	name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
	filename="smime.p7s"

MIAGCSqGSIb3DQEHAqCAMIACAQExCzAJBgUrDgMCGgUAMIAGCSqGSIb3DQEHAQAAoIIPVjCCBDIw
ggMaoAMCAQICAQEwDQYJKoZIhvcNAQEFBQAwezELMAkGA1UEBhMCR0IxGzAZBgNVBAgMEkdyZWF0
ZXIgTWFuY2hlc3RlcjEQMA4GA1UEBwwHU2FsZm9yZDEaMBgGA1UECgwRQ29tb2RvIENBIExpbWl0
ZWQxITAfBgNVBAMMGEFBQSBDZXJ0aWZpY2F0ZSBTZXJ2aWNlczAeFw0wNDAxMDEwMDAwMDBaFw0y
ODEyMzEyMzU5NTlaMHsxCzAJBgNVBAYTAkdCMRswGQYDVQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIx
EDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9kbyBDQSBMaW1pdGVkMSEwHwYDVQQDDBhB
QUEgQ2VydGlmaWNhdGUgU2VydmljZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC+
QJ30buHqdoccTUVEjr5GyIMGncEq/hgfjuQC+vOrXVCKFjELmgbQxXAizUktVGPMtm5oRgtT6stM
JMC8ck7q8RWu9FSaEgrDerIzYOLaiVXzIljz3tzP74OGooyUT59o8piQRoQnx3a/48w1LIteB2Rl
gsBIsKiR+WGfdiBQqJHHZrXreGIDVvCKGhPqMaMeoJn9OPb2JzJYbwf1a7j7FCuvt6rM1mNfc4za
BZmoOKjLF3g2UazpnvR4Oo3PD9lC4pgMqy+fDgHe75+ZSfEt36x0TRuYtUfF5SnR+ZAYx2KcvoPH
Jns+iiXHwN2d5jVoECCdj9je0sOEnA1e6C/JAgMBAAGjgcAwgb0wHQYDVR0OBBYEFKARCiM+lvEH
7OKvKe+CpX/QMKS0MA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MHsGA1UdHwR0MHIw
OKA2oDSGMmh0dHA6Ly9jcmwuY29tb2RvY2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3Js
MDagNKAyhjBodHRwOi8vY3JsLmNvbW9kby5uZXQvQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmww
DQYJKoZIhvcNAQEFBQADggEBAAhW/ALwm+j/pPrWe8ZEgM5PxMX2AFjMpra8FEloBHbo5u5d7AIP
YNaNUBhPJk4B4+awpe6/vHRUQb/9/BK4x09a9IlgBX9gtwVK8/bxwr/EuXSGti19a8zS80bdL8bg
asPDNAMsfZbdWsIOpwqZwQWLqwwv81w6z2w3VQmH3lNAbFjv/LarZW4E9hvcPOBaFcae2fFZSDAh
ZQNs7Okhc+ybA6HgN62gFRiP+roCzqcsqRATLNTlCCarIpdg+JBedNSimlO98qlo4KJuwtdssaMP
nr/raOdW8q7y4ys4OgmBtWuF174t7T8at7Jj4vViLILUagBBUPE5g5+V6TaWmG4wggTdMIIDxaAD
AgECAhBxkvvmGV+sTRKFdHE0ohinMA0GCSqGSIb3DQEBBQUAMHsxCzAJBgNVBAYTAkdCMRswGQYD
VQQIDBJHcmVhdGVyIE1hbmNoZXN0ZXIxEDAOBgNVBAcMB1NhbGZvcmQxGjAYBgNVBAoMEUNvbW9k
byBDQSBMaW1pdGVkMSEwHwYDVQQDDBhBQUEgQ2VydGlmaWNhdGUgU2VydmljZXMwHhcNMDQwMTAx
MDAwMDAwWhcNMjgxMjMxMjM1OTU5WjCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAlVUMRcwFQYD
VQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3b3JrMSEwHwYD
VQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VSRmlyc3QtQ2xp
ZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBALI5haTyfatBO2JGN67NwWB1vDll+UoaR6K5zEjMapjVTTUZuaRC5c5J4oovHnzSMQfHTrSD
ZJ0uKdWiZMSFvYVRNXmkTmiQexx6pJKoF/KYFfKTzMmkMpW7DE8wvZigC4vlbhuiRvp4vKJvq1le
pS/Pytptqi/rrKGzaqq3Lmc1i3nhHmmI4uZGzaCl6r4LznY6eg6b6vzaJ1s9cx8i5khhxkzzabGo
Lhu21DEgLLyCio6kDqXXiUP8FlqvHXHXEVnauocNr/rz4cLwpMVnjNbWVDreCqS6A3ezZcj9HtN0
YqoYymiTHqGFfvVHZcv4TVcodNI0/zC27vZiMBSMLOsCAwEAAaOCAScwggEjMB8GA1UdIwQYMBaA
FKARCiM+lvEH7OKvKe+CpX/QMKS0MB0GA1UdDgQWBBSJgmd9xJ0mcABLtFBIfN49rgRufTAOBgNV
HQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
AwQwEQYDVR0gBAowCDAGBgRVHSAAMHsGA1UdHwR0MHIwOKA2oDSGMmh0dHA6Ly9jcmwuY29tb2Rv
Y2EuY29tL0FBQUNlcnRpZmljYXRlU2VydmljZXMuY3JsMDagNKAyhjBodHRwOi8vY3JsLmNvbW9k
by5uZXQvQUFBQ2VydGlmaWNhdGVTZXJ2aWNlcy5jcmwwEQYJYIZIAYb4QgEBBAQDAgEGMA0GCSqG
SIb3DQEBBQUAA4IBAQCdlcs8uH6lCcQevwvCx3aOOTyUxhCqTwzJ4KuEXYlU4GU7820cfDcsJVRf
liH8N4SRnRXcFE+Bz1Qda2xFYMct+ZdRTPlmyjyggoymyPDi6dRK+ew/VsnddozDggFPbADzHhph
dARHA6nGQFeRvGUixSdnT1fbZFrZjR+6hi/0Bq6cae3p9M8pF9jgSp8aIC+XTFG7RgfEijdOIOMJ
MWjHnsSLneh+EbwyaBCWEZhE2CpRYE2I63Q630MGMsg5Vow6EVLTQaRDA/Tt7zMn2zngFE4mydj1
OeKJuJNdtykmQeqzm66D/Hd1yujKtf7iZUpjPkTE0MNeh3OpmByvfxV/MIIGOzCCBSOgAwIBAgIQ
BS/Z4kfFfaUP4SJK9jFxdTANBgkqhkiG9w0BAQUFADCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3
b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VS
Rmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbDAeFw0wNzA3MjYwMDAwMDBaFw0w
ODA3MjUyMzU5NTlaMIHaMTUwMwYDVQQLEyxDb21vZG8gVHJ1c3QgTmV0d29yayAtIFBFUlNPTkEg
Tk9UIFZBTElEQVRFRDFGMEQGA1UECxM9VGVybXMgYW5kIENvbmRpdGlvbnMgb2YgdXNlOiBodHRw
Oi8vd3d3LmNvbW9kby5uZXQvcmVwb3NpdG9yeTEfMB0GA1UECxMWKGMpMjAwMyBDb21vZG8gTGlt
aXRlZDEUMBIGA1UEAxMLQnJldCBNaWxsZXIxIjAgBgkqhkiG9w0BCQEWE2JyZXQubWlsbGVyQHdj
Zy5vcmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCp7mX3rWL7JENWVnWtxPNs/6n+
HoK0pEpOkHB2/VJjsxYdzK4dnOD8G4RveJHWWNmMsyTGBYu/Esp0kJMsRZhqrWYVFtG7zA1FF/XD
WY92DObzlwsm0LkrsiLftM8HTXoOGg9lGI52znBU4cLpA03Z2o8o6DUcwMT4/PJ9pdH0eXsOteq1
BnW/dxW7qbU+E/Br6ESpP0r2p7CBk+IFeeoX7cEn2FgW5o3OsMrKZPGwTJanxFzmcnN2CSAt9wuW
LNG21IQjt9G3p4Tdd30tX0KaY5hKx4xz8N7AO5WI8IotvMhSLB3xIBVhS56ZIR1UOp8fxwqSEk78
2Jw+livQh6VDAgMBAAGjggIlMIICITAfBgNVHSMEGDAWgBSJgmd9xJ0mcABLtFBIfN49rgRufTAd
BgNVHQ4EFgQUjYJGO3udEVbcRD8LY/Yow99gEL8wDgYDVR0PAQH/BAQDAgWgMAwGA1UdEwEB/wQC
MAAwIAYDVR0lBBkwFwYIKwYBBQUHAwQGCysGAQQBsjEBAwUCMBEGCWCGSAGG+EIBAQQEAwIFIDBG
BgNVHSAEPzA9MDsGDCsGAQQBsjEBAgEBATArMCkGCCsGAQUFBwIBFh1odHRwczovL3NlY3VyZS5j
b21vZG8ubmV0L0NQUzCBpQYDVR0fBIGdMIGaMEygSqBIhkZodHRwOi8vY3JsLmNvbW9kb2NhLmNv
bS9VVE4tVVNFUkZpcnN0LUNsaWVudEF1dGhlbnRpY2F0aW9uYW5kRW1haWwuY3JsMEqgSKBGhkRo
dHRwOi8vY3JsLmNvbW9kby5uZXQvVVROLVVTRVJGaXJzdC1DbGllbnRBdXRoZW50aWNhdGlvbmFu
ZEVtYWlsLmNybDB8BggrBgEFBQcBAQRwMG4wNgYIKwYBBQUHMAKGKmh0dHA6Ly9jcnQuY29tb2Rv
Y2EuY29tL1VUTkFBQUNsaWVudENBLmNydDA0BggrBgEFBQcwAoYoaHR0cDovL2NydC5jb21vZG8u
bmV0L1VUTkFBQUNsaWVudENBLmNydDAeBgNVHREEFzAVgRNicmV0Lm1pbGxlckB3Y2cub3JnMA0G
CSqGSIb3DQEBBQUAA4IBAQCeOlOPevxpIR9Hgxewpzd2B+gyHxlgoon1K8/GinG6bcNjo9qXCNMo
o8jjaZd4KZ+xwwzy0/ifvH9fGxgxcFcrhNQzbWMnsoORO9D/DuNcL0ZbWlJigRdNxdLwCsUt0T3E
ktFyDRBZOFHlTpNEy/oTKOOsIjY3pWKZhHPxnWiBI+waf7S5TyYUsSjFinMtY5v2WlyBdQ6EKwCw
iE7FSY8q+057l3g+lgacL8lxiDdOhEs89GTEeZz5P1af5y5PkxnT6FUhKqnj+nvdY04HSxq3b9p9
taV+gIcs9o9SDcI9w9DbcTh3mjkYsQ3B7oTWehy6jtOmKC/ahykShH1S9ru0MYIEZTCCBGECAQEw
gcMwga4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UEBxMOU2FsdCBMYWtlIENpdHkx
HjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UECxMYaHR0cDovL3d3dy51c2Vy
dHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVudCBBdXRoZW50aWNhdGlvbiBh
bmQgRW1haWwCEAUv2eJHxX2lD+EiSvYxcXUwCQYFKw4DAhoFAKCCAnYwGAYJKoZIhvcNAQkDMQsG
CSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMDcwOTA0MTgzODUxWjAjBgkqhkiG9w0BCQQxFgQU
H/TlkypwO5OlMHrFzIlEBUUnmJIwZwYJKoZIhvcNAQkPMVowWDAKBggqhkiG9w0DBzAOBggqhkiG
9w0DAgICAIAwDQYIKoZIhvcNAwICAUAwBwYFKw4DAgcwDQYIKoZIhvcNAwICASgwBwYFKw4DAhow
CgYIKoZIhvcNAgUwgdQGCSsGAQQBgjcQBDGBxjCBwzCBrjELMAkGA1UEBhMCVVMxCzAJBgNVBAgT
AlVUMRcwFQYDVQQHEw5TYWx0IExha2UgQ2l0eTEeMBwGA1UEChMVVGhlIFVTRVJUUlVTVCBOZXR3
b3JrMSEwHwYDVQQLExhodHRwOi8vd3d3LnVzZXJ0cnVzdC5jb20xNjA0BgNVBAMTLVVUTi1VU0VS
Rmlyc3QtQ2xpZW50IEF1dGhlbnRpY2F0aW9uIGFuZCBFbWFpbAIQBS/Z4kfFfaUP4SJK9jFxdTCB
1gYLKoZIhvcNAQkQAgsxgcaggcMwga4xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJVVDEXMBUGA1UE
BxMOU2FsdCBMYWtlIENpdHkxHjAcBgNVBAoTFVRoZSBVU0VSVFJVU1QgTmV0d29yazEhMB8GA1UE
CxMYaHR0cDovL3d3dy51c2VydHJ1c3QuY29tMTYwNAYDVQQDEy1VVE4tVVNFUkZpcnN0LUNsaWVu
dCBBdXRoZW50aWNhdGlvbiBhbmQgRW1haWwCEAUv2eJHxX2lD+EiSvYxcXUwDQYJKoZIhvcNAQEB
BQAEggEAKoOU+S/KizfYtK7VK09XYHsf3Q4+LVJ40khdrwFXSRaKdNFhFfIvgvzCCb3FtKzKXIwQ
ftTsHECDcxZ0Y5yeLDqu6n08xqFkCtzCmlEQrtx/3nFV/WijJM5gyhOFlsIKY54V3Dlzr7HFJ2EW
BZVxNF+LKtDnuQFW1WSaNFVzhffa9Q2TBjz+mh1yTmxfcZZT3lUnoKaQTpVrXoO1dwRyPjXE9zad
OtphI8VHYqd2mdmhZglQkh2ORogn0JD7bHs6xe6wy58YMoeDKev5arVVX1aE+uxZK4orygdeMDRv
QCJkw21XdWUk8NgQnYjH68HLhZg0AR5uQ8AxVRwxX6EH4gAAAAAAAA==

------=_NextPart_000_0073_01C7EEE8.2A9BDEB0--