[Mimedefang] filter for header line

[MAYER Hans]

Dear mailing list members,

I am looking for a possibility to filter for an existing header line.
I found a lot of examples where $Subject, $Sender and others can be used.
But I need the possibility to find a certain header line, for example X-Someinfo:
Can someone point me to some examples.
I was searching at Google but obviously with the wrong keywords.

Kind regards
Hans

[Kevin A. McGrail]

Post by MAYER Hans
Dear mailing list members,
I am looking for a possibility to filter for an existing header line.
I found a lot of examples where $Subject, $Sender and others can be used.
Can someone point me to some examples.
I was searching at Google but obviously with the wrong keywords.
Kind regards
Hans

Hi Hans,

Here's how I do it:

if (uc &check_header(header=>"X-HANS-Check-Header") eq
'X-HANS-CHECK-HEADER: TRUE') {
blah...
}

# check the HEADERS file and return any instances of a specific
parameter header (case insensitive on header name)
sub check_header {
  my (%params) = @_;
  my ($filehandle, $output);

  $params{'header'} || return undef;

  $filehandle = new IO::File('< ./HEADERS') or return undef;

  while (<$filehandle>) {
    if ($_ =~ /^$params{'header'}:/i) {
      $output .= $_;
    }
  }

  close ($filehandle);

  return $output;

}

Regards,
KAM
_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list ***@lists.roaringpenguin.com
http://lists.roaringpenguin.com/m

[Benoit Panizzon]

Dear Hans

Post by MAYER Hans
I am looking for a possibility to filter for an existing header line.
I found a lot of examples where $Subject, $Sender and others can be
used. But I need the possibility to find a certain header line, for
example X-Someinfo: Can someone point me to some examples.
I was searching at Google but obviously with the wrong keywords.

I fear you have to do this the hard way by reading the HEADERS file
from the spool directory:

in filter_end, because this is the place where you get the content...

if (open(HDRCHECK, "<./HEADERS")) {
while(<HDRCHECK>) {
if ($_ =~ /^X-Someinfo:[\t ]+(.*?)/ {
$SomeinfoValue = $1;
}
}
}

-Benoît Panizzon-
--
I m p r o W a r e A G - Leiter Commerce Kunden
______________________________________________________

Zurlindenstrasse 29 Tel [phone]
CH-4133 Pratteln Fax [phone]
Schweiz Web http://www.imp.ch
______________________________________________________

_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list ***@lists.roaringpenguin.com
http://li

[MAYER Hans]

Dear All,

Many thanks for the replies to all of you.
Now I have something to try.

... Are you not using SpamAssassin?

Yes, I am doing.
But how can I generate an action in MD for example "action_discard()" ?


Kind regards
Hans



-----Original Message-----
From: David Both [mailto:***@both.org]
Sent: Tuesday, September 5, 2017 2:12 PM
To: ***@lists.roaringpenguin.com; Benoit Panizzon <***@imp.ch>; MAYER Hans <***@iiasa.ac.at>
Subject: Re: [Mimedefang] filter for header line

I am curious. Why not just add a rule to /etc/mail/spamassassin/local.cf to match the desired header. Are you not using SpamAssassin?

Dear Hans

Post by MAYER Hans
I am looking for a possibility to filter for an existing header line.
I found a lot of examples where $Subject, $Sender and others can be
used. But I need the possibility to find a certain header line, for
example X-Someinfo: Can someone point me to some examples.
I was searching at Google but obviously with the wrong keywords.

I fear you have to do this the hard way by reading the HEADERS file
in filter_end, because this is the place where you get the content...
if (open(HDRCHECK, "<./HEADERS")) {
while(<HDRCHECK>) {
if ($_ =~ /^X-Someinfo:[\t ]+(.*?)/ {
$SomeinfoValue = $1;
}
}
}
-Benoît Panizzon-

--
*********************************************************
David P. Both, RHCE
Millennium Technology Consulting LLC
Raleigh, NC, USA
919-389-8678

***@millennium-technology.com

www.millennium-technology.com
www.Linux-Databook.info - Home of the DataBook for Linux
DataBook is a Registered Trademark of David Both
*********************************************************


_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list ***@lists.roaringpenguin.com
http://lists.roaringpengui

[Benoit Panizzon]

Hi

Post by MAYER Hans
I am curious. Why not just add a rule
to /etc/mail/spamassassin/local.cf to match the desired header. Are
you not using SpamAssassin?

There is a lot of other helpful things stuff you can do with mimedefang.
Just a few ideas:

* Rewrite sender in an SRS compatible way.
* Handle forwarding in an SPF compatible way and detect loops.
* Throttle emails to prevent sending too much spam in case a user got
himself phished
* Detect phished accounts (many different IP's pro hour logging in).
* Compute MD5 or SHA1 Hashes of attachments and compare to Malware
database (not so useful anymore with polymorphic malware which
generated a different checksum on every specimen)

and so on.

And maybe you want to recognize if an email already passed a mailserver
under your control. So you check for the value of a specific header and
if not present, you add that header, which contains for example a MD5
sum of the MSGID signed with a password you know to prevent others
injecting such emails to your system.
--
-Benoît Panizzon-
--
I m p r o W a r e A G - Leiter Commerce Kunden
______________________________________________________

Zurlindenstrasse 29 Tel [phone]
CH-4133 Pratteln Fax [phone]
Schweiz Web http://www.imp.ch
______________________________________________________

_______________________________________________
NOTE: If there is a disclaimer or other legal boilerplate in the above
message, it is NULL AND VOID. You may ignore it.

Visit http://www.mimedefang.org and http://www.roaringpenguin.com
MIMEDefang mailing list ***@lists.roaringpenguin.com
http://lists.roaringpenguin.com/mailman/