[Mimedefang] Help with header checking

[Dianne Skoll]

On Wed, 25 Nov 2020 11:45:11 +0100
Andrea Venturoli <ml at netfence.it> wrote:

> >         if (open(HF, "<./HEADERS")) {
> >             my $head = Mail::Header->new([<HF>]);
> >             close HF;
> >             md_syslog('warning',"head = %$head");

You shouldn't really print "head = %$head" because you don't know the
implementation details of Mail::Header.  Treat it as an opaque object.

> The purpose is to extract Received fields, so to reconstruct the path
> a message underwent from server to server.
> It has worked 99.99% of the times for years; lately, however it fails
> on some very frequent spam messages and I have a hard time
> understanding why.

I suggest calling action_quarantine_entire_message() if you get no
received headers so you can preserve a copy of the original message for
analysis.

> I tried adding:
> >             foreach $key (keys %$head)
> >             {
> >                 md_syslog('warning',"$key is $head{$key}");
> >             }  

It should be $head->{$key} and is unlikely to be useful; you're
printing instance variables on the Mail::Header object, which most
likely do not correspond to actual headers.

If you want to log @recheads, I would do it like this:

md_syslog('warning', 'recheads = ' . join(', ', @recheads));

Anyway... you need to capture the message (or at least the headers)
so we can analyze what's going on.

Regards,

Dianne.