On Mon, 12 Jan 2015, Moritz Both wrote:
> Package: spamass-milter
> Version: 0.3.2-1
> Severity: important
>
> Dear Don,
>
> when a message is detected as spam, it is prepended with a waring message.
> The original message appears as a mime attachment.
>
> This attachment has a bad Received: header like this:
>
> Received: from vwp12xxx.webpack.hosteurope.de (vwp12xxx.webpack.hosteurope.de
> [5.35.232.xxx])
> by eroski.aldebaran.de(8.14.4/8.14.4/Debian-4) with ESMTP id
> t06Df1fZ019601
> Wed, 10 Dec 2014 14:38:06 +0100
> (envelope-from <[email protected]>
>
> Note the following problems:
>
> 1. The semicolon at the end of the id is missing (RFC 2822
> requires it like "id t06Df1fZ019601;").
>
> 2. The "(envelope-from"... comment does not have a closing parenthesis.
>
> 3. Most importantly, the date is wrong. This email was received on 06 Jan
> 2015.
> It is very strange that we have a wrong date here because the clock of the
> mail
> server running spamass-milter and sendmail has probably been correct; it is
> adjusted using ntp with several servers in the net. Also, all the other
> date headers in the mail are correct and if the clock would have been
> wrong, more header lines should be wrong, too.
This is kind of odd... the actual code that generates this is the
following:
assassin->output((string)
"Received: from "+macro_s+" ("+macro__+")\r\n\t"+
"by "+macro_j+"("+macro_v+"/"+macro_Z+") with
"+macro_r+" id "+macro_i+";\r\n\t"+
macro_b+"\r\n\t"+
"(envelope-from "+assassin->from()+")\r\n");
which contains the semicolon and properly encloses the from.
The date which is reported is by calling macro_b, or if that's not
available, by calling
strftime(date, sizeof(date), "%a, %d %b %Y %H:%M:%S %z", localtime(&tval));
Could it be something in SA which is screwing up this header (or maybe
macro _b is totally screwed up?)
> Jan 6 14:41:03 eroski sm-mta[19601]: t06Df1fZ019601:
> from=<[email protected]>, size=4298, class=0, nrcpts=1,
> msgid=<[email protected]>, proto=ESMTP,
> daemon=MTA-v4, relay=vwp12xxx.webpack.hosteurope.de [5.35.232.xxx]
> Jan 6 14:41:03 eroski spamd[11954]: spamd: connection from localhost
> [127.0.0.1] at port 51249
> Jan 6 14:41:03 eroski spamd[11954]: spamd: creating default_prefs:
> /dev/null/.spamassassin/user_prefs
> Jan 6 14:41:03 eroski spamd[11954]: spamd: failed to create readable
> default_prefs: /dev/null/.spamassassin/user_prefs
> Jan 6 14:41:03 eroski spamd[11954]: spamd: processing message
> <[email protected]> for xnfo:xxx
> Jan 6 14:41:08 eroski spamd[11954]: spamd: identified spam (6.7/5.0) for
> xnfo:xxx in 5.6 seconds, 4802 bytes.
> Jan 6 14:41:08 eroski spamd[11954]: spamd: result: Y 6 -
> BAYES_50,DATE_IN_FUTURE_96_Q,HTML_MESSAGE,T_FILL_THIS_FORM_SHORT,UNPARSEABLE_RELAY,URI_OBFU_WWW,XPRIO
>
> scantime=5.6,size=4802,user=xnfo,uid=xxx,required_score=5.0,rhost=localhost,raddr=127.0.0.1,rport=51249,mid=<[email protected]>,bayes=0.500000,autolearn=spam
> Jan 6 14:41:08 eroski sm-mta[19601]: t06Df1fZ019601: Milter add: header:
> X-Spam-Flag: YES
> Jan 6 14:41:08 eroski sm-mta[19601]: t06Df1fZ019601: Milter add: header:
> X-Spam-Status: Yes, score=6.7 required=5.0
> tests=BAYES_50,DATE_IN_FUTURE_96_Q,\n\tHTML_MESSAGE,T_FILL_THIS_FORM_SHORT,UNPARSEABLE_RELAY,URI_OBFU_WWW,XPRIO\n\tautolearn=spam
> version=3.3.2
> Jan 6 14:41:08 eroski sm-mta[19601]: t06Df1fZ019601: Milter add: header:
> X-Spam-Level: ******
> Jan 6 14:41:08 eroski sm-mta[19601]: t06Df1fZ019601: Milter add: header:
> X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eroski.aldebaran.de
> Jan 6 14:41:08 eroski sm-mta[19601]: t06Df1fZ019601: Milter change: header
> Content-Type: from multipart/alternative;\n
> boundary="_=_swift_v4_142055166154axxxxxx0ede_=_" to multipart/mixed;
> boundary="----------=_54ABE5F4.1Dxxxxxx"
> Jan 6 14:41:08 eroski sm-mta[19601]: t06Df1fZ019601: Milter message: body
> replaced
> Jan 6 14:41:09 eroski sm-mta[19604]: t06Df1fZ019601:
> [email protected], delay=00:00:07, xdelay=00:00:01, mailer=esmtp,
> pri=37875, relay=xxxxxx.aldebaran.de. [x.x.0.x], dsn=2.0.0, stat=Sent
> (t06Df84L01xxxx Message accepted for delivery)
It might be informative to set -d ALL to spamass-milter too, just to see
what is going on.
--
Don Armstrong http://www.donarmstrong.com
Filing a bug is probably not going to get it fixed any faster.
-- Anthony Towns
--
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]
