svn commit: r1822483 - /spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm

[da...@apache.org]

Author: davej
Date: Sun Jan 28 22:40:16 2018
New Revision: 1822483

URL: http://svn.apache.org/viewvc?rev=1822483&view=rev
Log:
Bug 7534

Modified:
    spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm

Modified: spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm
URL: http://svn.apache.org/viewvc/spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm?rev=1822483&r1=1822482&r2=1822483&view=diff
==============================================================================
--- spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm (original)
+++ spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/HeaderEval.pm Sun Jan 28 22:40:16 2018
@@ -345,17 +345,24 @@ sub _check_for_forged_hotmail_received_h
 
   my $ip = $pms->get('X-Originating-Ip',undef);
   my $IP_ADDRESS = IP_ADDRESS;
+  my $orig = $pms->get('X-OriginatorOrg',undef);
+  my $ORIGINATOR = 'hotmail.com';
 
   if (defined $ip && $ip =~ /$IP_ADDRESS/) { $ip = 1; } else { $ip = 0; }
+  if (defined $orig && $orig =~ /$ORIGINATOR/) { $orig = 1; } else { $orig = 0; }
 
   # Hotmail formats its received headers like this:
   # Received: from hotmail.com (f135.law8.hotmail.com [216.33.241.135])
+  # or like
+  # Received: from EUR01-VE1-obe.outbound.protection.outlook.com (mail-oln040092066056.outbound.protection.outlook.com [40.92.66.56])
   # spammers do not ;)
 
   if ($self->gated_through_received_hdr_remover($pms)) { return; }
 
   if ($rcvd =~ /from (?:\S*\.)?hotmail.com \(\S+\.hotmail(?:\.msn)?\.com[ \)]/ && $ip)
                 { return; }
+  if ($rcvd =~ /from \S*\.outbound\.protection\.outlook\.com \(\S+\.outbound\.protection\.outlook\.com[ \)]/ && $orig)
+                { return; }
   if ($rcvd =~ /from \S*\.hotmail.com \(\[$IP_ADDRESS\][ \):]/ && $ip)
                 { return; }
   if ($rcvd =~ /from \S+ by \S+\.hotmail(?:\.msn)?\.com with HTTP\;/ && $ip)