Working within a corporate firewall with defined bastion hosts,
I found that a modification of the whitelist_from_rcvd function
allows me to whitelist all of our internal addresses as long as
the mail "from" those addresses does *NOT* pass through the
bastion hosts.  

The enhancement is two-fold:
- enable regexp parsing of the domain argument
- enable negation of the domain argument which effectively 
   implements a "whitelist <address> if not received via <domain>"

Here's a diff for EvalTests.pm:
*** EvalTests.pm.orig   Thu Oct 24 10:21:56 2002
--- EvalTests.pm        Thu Oct 24 11:09:58 2002
***************
*** 680,692 ****
    foreach my $white_addr (keys %{$list}) {
      my $regexp = $list->{$white_addr}{re};
      my $domain = $list->{$white_addr}{domain};
!     # warn("checking $addr against $regexp + $domain\n");
      if ($addr =~ /$regexp/i) {
        # warn("Looking for $domain\n");
        my $rcvd = $self->get('Received');
!       if ($rcvd =~
/from.*\b\Q$domain\E.*[\[\(][0-9]+\.[0-9]+\.[0-9]+\.[0-9]+[\]\)].*\bby\b/) {
          # warn("Found it.\n");
!         return 1;
        }
      }
    }
--- 680,696 ----
    foreach my $white_addr (keys %{$list}) {
      my $regexp = $list->{$white_addr}{re};
      my $domain = $list->{$white_addr}{domain};
!     my $mode = $domain =~ /^!/ ? 0 : 1;
!     $domain =~ s/^!//;
!     # warn("checking $addr against $regexp + $domain ($mode)\n");
      if ($addr =~ /$regexp/i) {
        # warn("Looking for $domain\n");
        my $rcvd = $self->get('Received');
!       if ($rcvd =~
/from.*\b$domain.*[\[\(][0-9]+\.[0-9]+\.[0-9]+\.[0-9]+[\]\)].*\bby\b/) {
          # warn("Found it.\n");
!         return $mode;
!       } else {
!       return ! $mode;
        }
      }
    }