[Mimedefang] RE: Filtering on sender, recipient, and subject at the same time

McCarthy, Douglas J dmccart at intel.com
Fri Jul 15 21:43:10 EDT 2005

Hi -

You might remember this issue from last week, but here's a summary.  I
am trying to block automated vacation messages from going out through my
company's firewall.  Exchange mail indicates vacation replies by putting
the string "Out of Office AutoReply:" in the subject line, and the Unix
"vacation" program either puts the string "Vacation" in a header line
that begins with "User-Agent:", or puts the string "vacation" (little v)
in the "X-Mailer:" header line.

So if the message has one of those three indicators, and the sender's
address ends in my company's domain, and the recipient's address does
_not_ end in my company's domain, I want to block the message.

Here's what I have.

sub filter_end ($) {
    my($entity) = @_;

# ...

    my($header) = $entity->head(); # Extract a MIME::Head object from
                                   # MIME::Entity object '$entity'
    my $UserAgent = $header->get('User-Agent');
    my $XMailer   = $header->get('X-Mailer');

#md_graphdefang_log('VacDebug', $UserAgent, $XMailer);
    if (($UserAgent =~ /Vacation/) or
        ($XMailer   =~ /vacation/) or
        ($Subject   =~ /Out of Office AutoReply\:/i))
        if (($Sender        =~ /\@([\w-]\.)*mycompany\.com>?$/i) and
            ($Recipients[0] !~ /\@([\w-]\.)*mycompany\.com>?$/i))
            if ($Subject =~ /Out of Office AutoReply\:/i)
            return action_discard();

The good news is that it catches Out of Office AutoReplies exactly
The bad new is that it's not catching the User-Agent or X-Mailer things
at all.  I know how to set them, and when they get delivered the headers
are indeed there, but if I uncomment that VacDebug logging line, I see
that $UserAgent never gets set, and $XMailer gets set to "MIME-tools
5.411 (Entity 5.404)", even though the User-Agent: line is set to
"Vacation" and/or the X-Mailer" line is set to "vacation".

I'll admit that I have no idea what I'm doing when it comes to packages
like MIME::Entity.  But having the input and the output be the same as
each other but not the same as what's going on inside this code fragment
is baffling me.  Please help!

More information about the MIMEDefang mailing list