Header Checks, examples?

[Michael Nguyen]

Hey guys,

I was wondering if I could see some examples of various header check
implementations in Postfix. I've gone through the READMEs and from what
I've read, I'm not certain if I can do what I need to do in Postfix. Here's
what I need:

- Emails come all come into a server (hopefully a Postfix server)
- If a header is present (x-sa-scanned), do nothing (basically deliver the
email)
- If a header is *not* present (x-sa-scanned, of course) do the following
- Set the header
- Use transport to send it off to another server

So this is what I was thinking:

header_checks = regexp:/etc/postfix/header_checks

!/^x-sa-scanned/ FILTER smtp:[10.1.2.110]:25
!/^x-sa-scanned/ PREPEND X-SA-Scanned: 1\n\r

Unfortunately, it sounds like I can only trigger one of these at a time.
I'd actually like to scan another header (to) so that I could do this for
particular users as I work on this.

What would be the right way to do this?


Michael

[Mike Morris]

Post by Michael Nguyen
Hey guys,
I was wondering if I could see some examples of various header check
implementations in Postfix. I've gone through the READMEs and from what
I've read, I'm not certain if I can do what I need to do in Postfix. Here's
- Emails come all come into a server (hopefully a Postfix server)
- If a header is present (x-sa-scanned), do nothing (basically deliver the
email)
- If a header is *not* present (x-sa-scanned, of course) do the following
- Set the header
- Use transport to send it off to another server

As far as I understand it header_checks can not look for the inexistence
of a header. And because header_checks scans one line at a time, your
"!/^x-sa-scanned/ PREPEND X-SA-Scanned: 1\n\r" example will add that
line before each header Postfix comes across.

If I'm wrong I'm sure someone will come along and point it out. I've
gotten used that that. :)

[Michael Nguyen]

[snip]

Post by Mike Morris

Post by Michael Nguyen
- Emails come all come into a server (hopefully a Postfix server)
- If a header is present (x-sa-scanned), do nothing (basically deliver

the

Post by Mike Morris

Post by Michael Nguyen
email)
- If a header is *not* present (x-sa-scanned, of course) do the

following

Post by Mike Morris

Post by Michael Nguyen
- Set the header
- Use transport to send it off to another server

As far as I understand it header_checks can not look for the inexistence
of a header. And because header_checks scans one line at a time, your
"!/^x-sa-scanned/ PREPEND X-SA-Scanned: 1\n\r" example will add that
line before each header Postfix comes across.

[snip]

Well, the !/pattern/ construct is all over the header_checks file so I think
it'd work. The thing is, from reading the READMEs, I kind of agree with
you...it sounds like !/pattern/ PREPEND will put that line above everything.

I'm about to just take the leap and try it, so we'll see. ;-)


Michael

[Michael Nguyen]

From: "Michael Nguyen" <***@twentyten.org>

[snip]

Post by Michael Nguyen
Well, the !/pattern/ construct is all over the header_checks file so I

think

Post by Michael Nguyen
it'd work. The thing is, from reading the READMEs, I kind of agree with
you...it sounds like !/pattern/ PREPEND will put that line above

everything.

Post by Michael Nguyen
I'm about to just take the leap and try it, so we'll see. ;-)

Well, the following didn't seem to do anything:

if /^X-Original-To: ***@test.spam$/
!/^X-SA-Scanned/ PREPEND X-SA-Scanned:1
!/^X-SA-Scanned/ FILTER smtp:[mail.sandycat.com]:25
endif

The original email is here:

From ***@twentyten.org Thu Feb 17 21:17:06 2005
Return-Path: <***@twentyten.org>
X-Original-To: ***@test.spam
Delivered-To: ***@m12b
Received: from m12b (m12b [10.1.1.12])
by m12b (Postfix) with SMTP id 95413138F27
for <***@test.spam>; Thu, 17 Feb 2005 21:17:00 -0800 (PST)
Message-Id: <***@m12b>
Date: Thu, 17 Feb 2005 21:17:00 -0800 (PST)
From: ***@twentyten.org
To: ***@test.spam

HEY!
-------------------

Hmm.... Further research is clearly needed...


Michael

[Victor Duchovni]

Post by Michael Nguyen
[snip]

Post by Michael Nguyen
Well, the !/pattern/ construct is all over the header_checks file so I

think

Post by Michael Nguyen
it'd work. The thing is, from reading the READMEs, I kind of agree with
you...it sounds like !/pattern/ PREPEND will put that line above

everything.

Post by Michael Nguyen
I'm about to just take the leap and try it, so we'll see. ;-)

You are wasting your time. No such features exist.

[Michael Nguyen]

[snip]

Post by Victor Duchovni
You are wasting your time. No such features exist.

Umm.... you know, I'm inclined to believe you Victor, but if that's true,
what in the world do these sections of the header_check file mean??

# PREPEND text...
# Prepend one line with the specified text and
# inspect the next input line.
#
# Note: the prepended text is output immediately
# before the input that triggered the PREPEND action.
# A body action cannot prepend a message header.

# if !/pattern/flags
#
# endif Match the input string against the patterns between
# if and endif, if and only if the input string does
# not match pattern. The if..endif can nest.

Are you saying that I can't do what I'm trying to do using an unmodified
Postfix?


Michael

[Victor Duchovni]

Post by Michael Nguyen

Post by Victor Duchovni
You are wasting your time. No such features exist.

Umm.... you know, I'm inclined to believe you Victor, but if that's true,
what in the world do these sections of the header_check file mean??
# if !/pattern/flags
#
# endif Match the input string against the patterns between
# if and endif, if and only if the input string does
# not match pattern. The if..endif can nest.
Are you saying that I can't do what I'm trying to do using an unmodified
Postfix?

The documentation means exactly what it says. Read the words carefully:

endif Match the ***input string*** against the patterns between
if and endif, if and only if the ***input string*** does
not match pattern. The if..endif can nest.

this logic applies one header at a time as documented.

Postfix header checks have no global state and no final invocation at
the end of the header. They simply cannot match missing headers.

[Magnus Bäck]

On Friday, February 18, 2005 at 07:53 CET,

=20

Post by Victor Duchovni
You are wasting your time. No such features exist.

=20
Umm.... you know, I'm inclined to believe you Victor, but if that's tru=

e,

what in the world do these sections of the header_check file mean??
=20
# PREPEND text...
# Prepend one line with the specified text and
# inspect the next input line.
#
# Note: the prepended text is output immediately
# before the input that triggered the PREPEND action.
# A body action cannot prepend a message header.
=20
# if !/pattern/flags
#
# endif Match the input string against the patterns between
# if and endif, if and only if the input string does
# not match pattern. The if..endif can nest.
=20
Are you saying that I can't do what I'm trying to do using an unmodifie=

d

Postfix?

Yes. Repeating what has already been said in this thread, header_checks
and friends cannot act of the inexistence of an input line. Each input
line is checked against each of the expressions with no state kept
between each line.

foreach $line in input
foreach $regexp in lookup table
match $line against $regexp

So, the expression

!/^Subject: / WHATEVER

will not match messages that have no Subject line, it will match all
messages that contain a header that does not match the expression
(i.e. all messages will be matched).

This has been explained many, many times before. Do search the archives.

--=20
Magnus B=E4ck
***@dsek.lth.se

[Michael Nguyen]

From: "Magnus B=E4ck" <***@dsek.lth.se>

[snip]

Post by Magnus Bäck

Are you saying that I can't do what I'm trying to do using an unmodif=

ied

Post by Magnus Bäck

Postfix?

Yes. Repeating what has already been said in this thread, header_checks
and friends cannot act of the inexistence of an input line. Each input
line is checked against each of the expressions with no state kept
between each line.

Hmm....maybe I can't do things in the way that I initially planned, but i=
s
there anything else I could do using the header_check functionality that =
I
have available to me? The situation is like this:

- Email comes into a server
- If the email hasn't already been forwarded to the filtering server onc=
e,
forward it
- If the email has touched the filtering server, deliver it

We do this with our current MTA by either slapping a header (x-sa-scanned=
)
into the message if the header doesn't exist and forwarding to the scanne=
r
or merely delivering the message if the x-sa-scanned header exists.

That part of procedure is unimportant. The general idea of sending the
email to the scanner if it hasn't been there yet and delivering the email=
if
it has been there is what I want to accomplish. I feel like Postfix can =
do
this. Does anyone here have any ideas on how I could implement this?

[snip]

Post by Magnus Bäck
So, the expression
!/^Subject: / WHATEVER
will not match messages that have no Subject line, it will match all
messages that contain a header that does not match the expression
(i.e. all messages will be matched).

Well....maybe I lack creativity here, but in that case I can't think of a
single example where !/<pattern>/ would be useful.


Michael

[Marshal Newrock]

Post by Michael Nguyen
Hmm....maybe I can't do things in the way that I initially planned,
but is there anything else I could do using the header_check
functionality that I have available to me? The situation is like
- Email comes into a server
- If the email hasn't already been forwarded to the filtering server
once, forward it
- If the email has touched the filtering server, deliver it
We do this with our current MTA by either slapping a header
(x-sa-scanned) into the message if the header doesn't exist and
forwarding to the scanner or merely delivering the message if the
x-sa-scanned header exists.
That part of procedure is unimportant. The general idea of sending
the email to the scanner if it hasn't been there yet and delivering
the email if it has been there is what I want to accomplish. I feel
like Postfix can do this. Does anyone here have any ideas on how I
could implement this?

That sounds like a job for a content filter (see
http://www.postfix.org/FILTER_README.html) or possibly a delivery agent
such as procmail. Note that using procmail means that outgoing or
forwarded (using aliases) mail will never be scanned. The only time to
do what you want is after the entire email has been received. Any
decent content filter can check for various message characteristics,
including the presence of a header line.

Post by Michael Nguyen

Post by Magnus Bäck
So, the expression
!/^Subject: / WHATEVER
will not match messages that have no Subject line, it will match
all messages that contain a header that does not match the
expression (i.e. all messages will be matched).

Well....maybe I lack creativity here, but in that case I can't think
of a single example where !/<pattern>/ would be useful.

I don't use these patterns, but this (crude example) occurs to me:

# subject line checks. ignore forwarded messages.
if /^Subject: /
if !/^Subject: FW /
/evil pattern/ REJECT
endif
endif

# don't ever check received lines
!/^Received: / OK

And keep in mind that OK in header and body checks means skip to the
next line, not accept this message.

[Victor Duchovni]

Hmm....maybe I can't do things in the way that I initially planned, but is
there anything else I could do using the header_check functionality that I
- Email comes into a server
- If the email hasn't already been forwarded to the filtering server once,
forward it
- If the email has touched the filtering server, deliver it

Set content_filter to by default filter all mail into the filter server,
if the header is present (how do you know it is not forged???) use
FILTER smtp:[127.0.0.1]:20025 to inject the mail via SMTP right back
into an smtpd/cleanup pair with content_filter and this header check
disabled (directly to whatever destination the filter usually delivers,
thereby bypassing the filter). Beats me as to why this is a good idea
(it would not be for A/V, but it could be for anti-spam, if the header
is only added to identified spam).

[Michael Nguyen]

[snip]

Post by Marshal Newrock
# subject line checks. ignore forwarded messages.
if /^Subject: /
if !/^Subject: FW /
/evil pattern/ REJECT
endif
endif

This is resonable.

Post by Marshal Newrock
# don't ever check received lines
!/^Received: / OK
And keep in mind that OK in header and body checks means skip to the
next line, not accept this message.

This isn't. This basically says that anything that's not a Received line
should be skipped.


Michael

[Michael Nguyen]

[snip]

Post by Victor Duchovni
Set content_filter to by default filter all mail into the filter server,
if the header is present (how do you know it is not forged???) use
FILTER smtp:[127.0.0.1]:20025 to inject the mail via SMTP right back
into an smtpd/cleanup pair with content_filter and this header check
disabled (directly to whatever destination the filter usually delivers,
thereby bypassing the filter). Beats me as to why this is a good idea
(it would not be for A/V, but it could be for anti-spam, if the header
is only added to identified spam).

Well, it works except for one thing. The service is requiring that I
re-write the recipient address. I would like to do this, but have it be
triggered via the header_check.

I see REDIRECT, but it doesn't look quite right. Basically, I need the
following:

- Email comes in as ***@m12 with the scarlet header.
- header_check sees this header and re-writes the address to
***@test.spam
- header_check then forwards the email to smtp:[third-party.filter.com]:25

It looks like REDIRECT can take in a static email address, but can I somehow
construct a $1%***@third-party.filter.com type address (and have it
work)? What options do I have here?


Mihael

[Victor Duchovni]

Post by Michael Nguyen
[snip]

Post by Victor Duchovni
Set content_filter to by default filter all mail into the filter server,
if the header is present (how do you know it is not forged???) use
FILTER smtp:[127.0.0.1]:20025 to inject the mail via SMTP right back
into an smtpd/cleanup pair with content_filter and this header check
disabled (directly to whatever destination the filter usually delivers,
thereby bypassing the filter). Beats me as to why this is a good idea
(it would not be for A/V, but it could be for anti-spam, if the header
is only added to identified spam).

Well, it works except for one thing. The service is requiring that I
re-write the recipient address. I would like to do this, but have it be
triggered via the header_check.

Architecture from hell. Dump it.