Bug 6199

Summary: VBounce (and others) should use EnvelopeFrom, not Return-Path
Product: Spamassassin Reporter: Henrik Krohns <apache>
Component: RulesAssignee: SpamAssassin Developer Mailing List <dev>
Status: NEW ---    
Severity: enhancement CC: apache
Priority: P5    
Version: SVN Trunk (Latest Devel Version)   
Target Milestone: Undefined   
Hardware: Other   
OS: All   
Whiteboard:

Description Henrik Krohns 2009-09-13 10:23:11 UTC
Is there really any legimate case where Return-Path should be used in rules
instead of EnvelopeFrom? Isn't the point to respect possible
envelope_sender_header or just use heuristics? Possibly it should be changed
to just be forced alias to EnvelopeFrom.

20_vbounce.cf uses Return-Path, breaking my mass-check corpus badly. Amavis
quarantine mails have empty Return-Path and sender in X-Envelope-From.
Comment 1 Mark Martinec 2009-09-13 15:28:39 UTC
(In reply to comment #0)
> Is there really any legimate case where Return-Path should be used in rules
> instead of EnvelopeFrom? Isn't the point to respect possible
> envelope_sender_header or just use heuristics? Possibly it should be changed
> to just be forced alias to EnvelopeFrom.
> 
> 20_vbounce.cf uses Return-Path, breaking my mass-check corpus badly. Amavis
> quarantine mails have empty Return-Path and sender in X-Envelope-From.

I'll just comment on your last statement. The message that amavisd passes to
SpamAssassin has envelope sender presented as Return-Path, which is the only standard way for storing this information in a header section. So this is just what these rule want, and it shouldn't be a problem in this case.

While it is true that a quarantined message stored to a file may have a null Return-Path (to prevent bounces in case somebody forwards it to a mailbox), and the envelope sender is indeed in X-Envelope-From, this applies only to such quarantined messages, and should not affect SpamAssassin processing.

Moreover, what goes into Return-Path of a quarantined message is configurable: keeping $mailfrom_to_quarantine at undef, which is its default value, will keep the original envelope sender address in Return-Path of quarantined messages.
Comment 2 Mark Martinec 2009-09-13 15:35:10 UTC
> breaking my mass-check corpus badly. Amavis quarantine mails
> have empty Return-Path and sender in X-Envelope-From.

I have a small perl command sowewhere around to rewrite quarantine messages,
moving X-Envelope-From information to Return-Path. Will post it here shortly.
Comment 3 Mark Martinec 2009-09-13 16:30:41 UTC
> I have a small perl command somewhere around to rewrite quarantine messages,
> moving X-Envelope-From information to Return-Path. Will post it here shortly.

Depending on how you have quarantine files organized (adjust the 'find' as
necessary), the following one-liner should make Return-Path be replaced by
the contents of X-Envelope-From. Original files will be renamed to *.bak
and can be later deleted.

find . -type f | while read j; do perl -i.bak -ne '
 if ($t) {print} elsif (!/^(Return-Path|Delivered-To):/i) {
 $t=1 if s/^X-Envelope-From:/Return-Path:/; print}' $j; done
Comment 4 Henrik Krohns 2009-09-13 21:46:38 UTC
I just realized Return-Path is also hardwired as Bayes token, so I'll fix my corpus..

Anyways, use of it seems strange since there is lots of heuristics code around detect the real envelope sender.
Comment 5 Mark Martinec 2009-09-14 04:17:09 UTC
> Anyways, use of it seems strange since there is lots of heuristics code
> around detect the real envelope sender.

Probably the EnvelopeFrom is what should be used in these rules,
although I have mixed feelings about EnvelopeFrom, and I fear very much
its heuristics. When SpamAssassin is called from a MTA or close to it
(vs. calling it at a mail delivery stage or from a MUA), one should
always configure envelope_sender_header explicitly. In case of
amavisd-new I recommend:
  envelope_sender_header Return-Path
  always_trust_envelope_sender 1