Re: [Bug 8359] New: check_rbl @ips does not contain ip if received has ipaddress:port

On 2025-12-04 16:24, [email protected] wrote:
> https://bz.apache.org/SpamAssassin/show_bug.cgi?id=8359
> 
>              Bug ID: 8359
>             Summary: check_rbl @ips does not contain ip if received has
>                      ipaddress:port
>             Product: Spamassassin
>             Version: 4.0.2
>            Hardware: PC
>                  OS: Linux
>              Status: NEW
>            Severity: normal
>            Priority: P2
>           Component: Plugins
>            Assignee: [email protected]
>            Reporter: [email protected]
>    Target Milestone: Undefined
> 
> check_rbl() and check_rbl_rcvd() does not catch ip addresses from socket based
> received headers.
> 
> header example:
> 
> Received: from spica25.mgt.mul.t-online.de ([172.20.102.137]) by
> fwd81.aul.t-online.de
>          with esmtp id 1vOz2C-4WbrJw0; Fri, 28 Nov 2025 15:01:17 +0100
> Received: from 91.90.123.117:58047 by cmpweb10.aul.t-online.de with HTTP/1.1
> (Lisa V8-4-3-2.0 on API V5-57-2-0); Fri, 28 Nov 25 15:01:16 +0100
> Received: from 172.20.102.133:29040 by spica25.mgt.mul.t-online.de:8080; Fri,
> 28 Nov 2025 15:01:16 +0100 (CET)
> 
> this mail hits ALL_TRUSTED.
> 
> 91.90.123.117 is not checked against any rbl but should.
> 
> 
> is there any solution for this kind of non standard received: header?
> 

Can you show the actual parsed TRUSTED array?

X-Spam-Relays-* from your debug logs..

Most of this comes from Received.pm, and yes it can use some additional 
love, but what is your expectation here?

Given that is apparently an API connection, you would be checking 
different RBL's based on whether it is authenticated or not.

In this case of course, the IP is probably an open proxy, but it does 
look like the trace headers are out of order... This might be better 
escalated to t-online.de to improve how they are recording those entries.



-- 
"Catch the Magic of Linux..."
------------------------------------------------------------------------
Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic
A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Reg. TradeMark of Wizard Tower TechnoServices Ltd.
------------------------------------------------------------------------
604-682-0300 Beautiful British Columbia, Canada