Re: Ruleset From: address

--===============7508920986390912629==
Content-Type: multipart/alternative; boundary="000000000000fbf2b406321cdab9"

--000000000000fbf2b406321cdab9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

For my purposes I came up with a quick fix, a patch to Sendmail.pm that
uses the header information to overwrite the "from" data from the envelope.

# diff -u Sendmail.pm.0 Sendmail.pm
--- Sendmail.pm.0       2019-01-27 14:49:14.000000000 -0500
+++ Sendmail.pm 2025-04-06 10:17:35.280422217 -0400
@@ -313,6 +313,17 @@
         $from =3D~ s/\s*>$//; # trailing <>
         $message->{from} =3D lc($from);
         $SFound =3D 1; # We have found the sender
+MailScanner::Log::NoticeLog("Envelope From: %s", $message->{from});
+      }
+      if ($Line =3D~ /^H\?\?[fF][rR][oO][mM]:\s/) {
+        $from =3D $Line;
+        #chomp $from;
+        $from =3D~ s/^H\?\?[fF][rR][oO][mM]:\s//;
+        $from =3D~ s/[^<]*<\s*//; # leading and
+        $from =3D~ s/\s*>$//; # trailing <>
+        $message->{from} =3D lc($from);
+MailScanner::Log::NoticeLog("Header From: %s", $message->{from});
+        $SFound =3D 1; # We have found the sender
       }
       if ($Line =3D~ /^\$_/) {
         $ip =3D $Line;


Ideally this would save the header from to a different structure element,
perhaps "$message->{hfrom}", with another patch so that rules could
reference "HFrom:" vs "From:", but I couldn't figure out that part of the
code in Message.pm

On Sat, Apr 5, 2025 at 12:59=E2=80=AFAM Ricky Boone <[email protected]>=
 wrote:

> I don't believe so.  Alternatively, depending on what you're
> ultimately trying to solve for, using SpamAssassin rules or other
> configuration statements may work instead.
>
> On Fri, Apr 4, 2025 at 5:05=E2=80=AFPM Richard Bollinger (Richard A
> Bollinger)(ETCI) via MailScanner <mailscanner-qhrM8SXbD5JTOyd/[email protected]>
> wrote:
> >
> > Is there a way in a ruleset to match on a visible from address vs the
> envelope from address?
> >
> >
> > CONFIDENTIALITY NOTICE: This E-mail, along with any attachments, is
> considered confidential and may well be legally privileged. If you have
> received it in error, you are on notice of its status. Please notify us
> immediately by reply e-mail and then delete this message from your system.
> Please do not copy it or use it for any purposes, or disclose its contents
> to any other person. Thank you for your cooperation.
> >
> > --
> > MailScanner mailing list
> > mailscanner-qhrM8SXbD5JTOyd/[email protected]
> >
> https://urldefense.com/v3/__http://lists.mailscanner.info/mailman/listinf=
o/mailscanner__;!!JT12okTYBSM!ReEFHwXVe_Kikd8twNrjtKHSBqy_K9UmXrMPj5p6jvYY7=
mV7yf81os8W8yRyAh2gV1D3uCvvYx2n09J17EZqPybVtA$
> [lists[.]mailscanner[.]info]
> >
>

--
CONFIDENTIALITY NOTICE: This E-mail, along with any attachments, is conside=
red confidential and may well be legally privileged.  If you have received =
it in error, you are on notice of its status.  Please notify us immediately=
 by reply e-mail and then delete this message from your system.  Please do =
not copy it or use it for any purposes, or disclose its contents to any oth=
er person.  Thank you for your cooperation.


--000000000000fbf2b406321cdab9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">For my =
purposes I came up with a quick fix, a patch to Sendmail.pm that uses the h=
eader information to overwrite the &quot;from&quot; data from the envelope.=
<div><br></div><div><div># diff -u Sendmail.pm.0 Sendmail.pm</div><div>--- =
Sendmail.pm.0=C2=A0 =C2=A0 =C2=A0 =C2=A02019-01-27 14:49:14.000000000 -0500=
</div><div>+++ Sendmail.pm 2025-04-06 10:17:35.280422217 -0400</div><div>@@=
 -313,6 +313,17 @@</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0$from =3D~ s=
/\s*&gt;$//; # trailing &lt;&gt;</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=
=A0$message-&gt;{from} =3D lc($from);</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0=
 =C2=A0$SFound =3D 1; # We have found the sender</div><div>+MailScanner::Lo=
g::NoticeLog(&quot;Envelope From: %s&quot;, $message-&gt;{from});</div><div=
>+=C2=A0 =C2=A0 =C2=A0 }</div><div>+=C2=A0 =C2=A0 =C2=A0 if ($Line =3D~ /^H=
\?\?[fF][rR][oO][mM]:\s/) {</div><div>+=C2=A0 =C2=A0 =C2=A0 =C2=A0 $from =
=3D $Line;</div><div>+=C2=A0 =C2=A0 =C2=A0 =C2=A0 #chomp $from;</div><div>+=
=C2=A0 =C2=A0 =C2=A0 =C2=A0 $from =3D~ s/^H\?\?[fF][rR][oO][mM]:\s//;</div>=
<div>+=C2=A0 =C2=A0 =C2=A0 =C2=A0 $from =3D~ s/[^&lt;]*&lt;\s*//; # leading=
 and</div><div>+=C2=A0 =C2=A0 =C2=A0 =C2=A0 $from =3D~ s/\s*&gt;$//; # trai=
ling &lt;&gt;</div><div>+=C2=A0 =C2=A0 =C2=A0 =C2=A0 $message-&gt;{from} =
=3D lc($from);</div><div>+MailScanner::Log::NoticeLog(&quot;Header From: %s=
&quot;, $message-&gt;{from});</div><div>+=C2=A0 =C2=A0 =C2=A0 =C2=A0 $SFoun=
d =3D 1; # We have found the sender</div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0}<=
/div><div>=C2=A0 =C2=A0 =C2=A0 =C2=A0if ($Line =3D~ /^\$_/) {</div><div>=C2=
=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0$ip =3D $Line;</div></div><div><br></div><di=
v><br></div><div>Ideally this would save the header from to a different str=
ucture element, perhaps &quot;$message-&gt;{hfrom}&quot;, with another patc=
h so that rules could reference &quot;HFrom:&quot; vs &quot;From:&quot;, bu=
t I couldn&#39;t figure out that part of the code in Message.pm</div></div>=
</div></div><br><div class=3D"gmail_quote gmail_quote_container"><div dir=
=3D"ltr" class=3D"gmail_attr">On Sat, Apr 5, 2025 at 12:59=E2=80=AFAM Ricky=
 Boone &lt;<a href=3D"mailto:[email protected]">[email protected]</=
a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0p=
x 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I =
don&#39;t believe so.=C2=A0 Alternatively, depending on what you&#39;re<br>
ultimately trying to solve for, using SpamAssassin rules or other<br>
configuration statements may work instead.<br>
<br>
On Fri, Apr 4, 2025 at 5:05=E2=80=AFPM Richard Bollinger (Richard A<br>
Bollinger)(ETCI) via MailScanner &lt;<a href=3D"mailto:[email protected]=
ilscanner.info" target=3D"_blank">mailscanner-qhrM8SXbD5JTOyd/[email protected]</a>&gt=
;<br>
wrote:<br>
&gt;<br>
&gt; Is there a way in a ruleset to match on a visible from address vs the =
envelope from address?<br>
&gt;<br>
&gt;<br>
&gt; CONFIDENTIALITY NOTICE: This E-mail, along with any attachments, is co=
nsidered confidential and may well be legally privileged. If you have recei=
ved it in error, you are on notice of its status. Please notify us immediat=
ely by reply e-mail and then delete this message from your system. Please d=
o not copy it or use it for any purposes, or disclose its contents to any o=
ther person. Thank you for your cooperation.<br>
&gt;<br>
&gt; --<br>
&gt; MailScanner mailing list<br>
&gt; <a href=3D"mailto:mailscanner-qhrM8SXbD5JTOyd/[email protected]" target=3D"_blank=
">mailscanner-qhrM8SXbD5JTOyd/[email protected]</a><br>
&gt; <a href=3D"https://urldefense.com/v3/__http://lists.mailscanner.info/m=
ailman/listinfo/mailscanner__;!!JT12okTYBSM!ReEFHwXVe_Kikd8twNrjtKHSBqy_K9U=
mXrMPj5p6jvYY7mV7yf81os8W8yRyAh2gV1D3uCvvYx2n09J17EZqPybVtA$" rel=3D"norefe=
rrer" target=3D"_blank">https://urldefense.com/v3/__http://lists.mailscanne=
r.info/mailman/listinfo/mailscanner__;!!JT12okTYBSM!ReEFHwXVe_Kikd8twNrjtKH=
SBqy_K9UmXrMPj5p6jvYY7mV7yf81os8W8yRyAh2gV1D3uCvvYx2n09J17EZqPybVtA$</a> [l=
ists[.]mailscanner[.]info]<br>
&gt;<br>
</blockquote></div></div>
<br />
<br />CONFIDENTIALITY NOTICE: This E-mail, along with any attachments, is c=
onsidered confidential and may well be legally privileged.  If you have rec=
eived it in error, you are on notice of its status.  Please notify us immed=
iately by reply e-mail and then delete this message from your system.  Plea=
se do not copy it or use it for any purposes, or disclose its contents to a=
ny other person. Thank you for your cooperation.


--000000000000fbf2b406321cdab9--

--===============7508920986390912629==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline



-- 
MailScanner mailing list
mailscanner-qhrM8SXbD5JTOyd/[email protected]
http://lists.mailscanner.info/mailman/listinfo/mailscanner


--===============7508920986390912629==--