[Mimedefang] filter based on From/To headers?

[Kelsey Cummings]

On Wed, May 05, 2004 at 05:45:18PM -0400, David F. Skoll wrote:
> On Wed, 5 May 2004, Michael Sims wrote:
> 
> > One caveat: I believe it is possible for the To header to contain
> > multiple lines.
> 
> When MIMEDefang writes the HEADERS file, it explicitly "unwraps" the
> lines to ensure that exactly one complete header appears on each line.

David, are there any circumstances when MD will not write out a HEADERS
file?  I've got mail passing through the system that my code in
filter_begin doesn't seem to see.

...
   if ( open(HEADER, "<HEADERS") )
   {
        while(<HEADER>)
        {
                next unless /^(To|From|Cc):/;
                if ( /mx\.sonic\.net/i )
                {
                        md_syslog('err',"found hostname in header:: $_");
                }
        }
        close(HEADER);
   }
   else
   {
        mdsyslog('err',"couldn't open HEADERS for hostname information :: $!\n");
   }
...

I don't see how this code could fail - and yet it is.  Is it possible that
I'm encountering a char set issue -- most of the 'user at mxhost spam' I see
is coming in from .tw in a multi-byte charset.  

-- 
Kelsey Cummings - kgc at sonic.net           sonic.net, inc.
System Administrator                      2260 Apollo Way
707.522.1000 (Voice)                      Santa Rosa, CA 95407
707.547.2199 (Fax)                        http://www.sonic.net/
Fingerprint = D5F9 667F 5D32 7347 0B79  8DB7 2B42 86B6 4E2C 3896