[Mimedefang] graphdefang and mailing list activity

[Rich West]

I've been trying to tweak mimedefang to properly log all mailing list 
activity in order to get a better idea, through graphdefang, as to how 
much of the overall activity is due to the mailing lists.

I've gotten the mimedefang-filter set to identify mail coming *in* to 
the mailing lists and properly log it, but, as you know, the bulk of 
email with regards to mailing lists is email going *out* from mailing lists.

I thought of  putting something in to filter_sender, but then I backed 
off thinking that I might be opening up a rather large security hole.

I've since built a small snippet to be added to the end of filter_sender:
if (&is_list($sender) && ($hostip == "127.0.0.1")){
   md_graphdefang_log("mailing_list", , ,);
}

Where is_list is as below (with the %lists being a hash of all lists on 
the system).

sub is_list
{
   my($listname) = shift;
   ##
   ## The email address, as it comes in, is surrounded by
   ## brackets.  We have to massage it a little in order to do
   ## proper matching.  eg: '<test at testdomain.com>' needs to be 'test'.
   ##
   $listname = (split("\@", $listname))[0];
   $listname = (split("\<", $listname))[1];
   return ($lists{lc($listname)});
}

However, if I remember correctly, the "from" addresses when dealing with 
mailing lists are not easily matched upon...   I think that is where my 
logic in this scenario starts to fade..

Thoughts/ideas?

-Rich