Re: Filter envelope sender not from address to prevent new spam attack

> On Thu, 30 Apr 2009 07:02:30 am Dave Steinberg wrote:
>> My understanding was that TMDA *only* uses the envelope sender, except
>> if you use a headers directive to look at the 'from' field, which I am
>> guessing you're not doing.
> 
> It seems not....
> 
> I just had a detailed look at the tmda-filter code.
> 
> I'm not a python programmer, but in the "main()" function it seems to be 
> creating an array called "sender_list" which consists of the envelope sender, 
> the list of From addresses and the list of Reply-To addresses.
> 
> It then calls infilter.firstmatch with the sender_list, which returns when it 
> finds something that matches.
> 
> And it succeeds because the From address is included in the sender_list.
> 
> I've checked the code in version tmda-1.1.12 and it's the same.

Yep, thanks for digging in, clearly my understanding wasn't correct!

>> You've confirmed your analysis in your incoming log, yes?  Its a 'from'
>> entry of some kind that's matching?
> 
> Yes, Here's a log file entry:
> 	Date: Wed, 01 Apr 2009 08:23:24 +1100
> 	Sndr: [email protected]
> 	From: "Heidi Carver" <[email protected]>
> 	To: [email protected]
> 	Subj: Vacheron Constantin cheaper than you could imagine!
> 	Actn: OK (from-file ~/.tmda/lists/whitelist ok)                        (1172)
> 
> [email protected] is in the whitelist, whereas [email protected] is 
> not.
> 
> This seems to confirm my code analysis above.

Maybe what's needed is to pull the list of desired header strings into a 
conf file?  Seems like it shouldn't be *too* hard to put together a patch.

Worst case, just modify your local install to not include the from header?

-- 
Dave Steinberg
http://www.geekisp.com/
http://www.steinbergcomputing.com/

------------------------------------------------------------------------------
Register Now & Save for Velocity, the Web Performance & Operations 
Conference from O'Reilly Media. Velocity features a full day of 
expert-led, hands-on workshops and two days of sessions from industry 
leaders in dedicated Performance & Operations tracks. Use code vel09scf 
and Save an extra 15% before 5/3. http://p.sf.net/sfu/velocityconf
_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users