svn commit: r1902865 - /spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm

[gb...@apache.org]

Author: gbechis
Date: Tue Jul 19 21:11:55 2022
New Revision: 1902865

URL: http://svn.apache.org/viewvc?rev=1902865&view=rev
Log:
improve check for forged Hotmail headers due to Microsoft changes

Modified:
    spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm

Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm
URL: http://svn.apache.org/viewvc/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm?rev=1902865&r1=1902864&r2=1902865&view=diff
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm (original)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm Tue Jul 19 21:11:55 2022
@@ -347,7 +347,7 @@ sub _check_for_forged_hotmail_received_h
 
   my $ip = $pms->get('X-Originating-Ip',undef);
   my $orig = $pms->get('X-OriginatorOrg',undef);
-  my $ORIGINATOR = 'hotmail.com';
+  my $ORIGINATOR = qr/hotmail\.com|msonline\-outlook/;
 
   if (defined $ip && $ip =~ /$IP_ADDRESS/) { $ip = 1; } else { $ip = 0; }
   if (defined $orig && $orig =~ /$ORIGINATOR/) { $orig = 1; } else { $orig = 0; }
@@ -356,6 +356,8 @@ sub _check_for_forged_hotmail_received_h
   # Received: from hotmail.com (f135.law8.hotmail.com [216.33.241.135])
   # or like
   # Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-oln040092066056.outbound.protection.outlook.com [40.92.66.56])
+  # or
+  # Received: from VI1PR04MB3039.eurprd04.prod.outlook.com (2603:10a6:802:b::13)
   # spammers do not ;)
 
   if ($self->gated_through_received_hdr_remover($pms)) { return; }
@@ -364,6 +366,8 @@ sub _check_for_forged_hotmail_received_h
                 { return; }
   if ($rcvd =~ /from \S*\.outbound\.protection\.outlook\.com \(\S+\.outbound\.protection\.outlook\.com[ \)]/ && $orig)
                 { return; }
+  if ($rcvd =~ /from \S*\.eurprd\d+\.prod\.outlook\.com \($IP_ADDRESS\)/ && $orig)
+                { return; }
   if ($rcvd =~ /from \S*\.hotmail.com \(\[$IP_ADDRESS\][ \):]/ && $ip)
                 { return; }
   if ($rcvd =~ /from \S+ by \S+\.hotmail(?:\.msn)?\.com with HTTP\;/ && $ip)