Disposition deleted

[Jeff Mincy <je...@delphioutpost.com>]

Can somebody clue me in on how to match 'Disposition: automatic-action/MDN-sent-automatically; deleted'
in a disposition-notification mime attachment?

   ------_=_NextPart_001_01CC55E0.440F392C
   Content-Type: message/disposition-notification
   Content-Transfer-Encoding: 7bit

   Final-Recipient: RFC822; Kathy.Dupre@ca.com
   Disposition: automatic-action/MDN-sent-automatically; deleted
   X-MSExch-Correlation-Key: 1CORJJTUYkSeBj5kXwFqLQ==

   ------_=_NextPart_001_01CC55E0.440F392C--

I've tried body, rawbody and mimeheader without success:
   mimeheader LOCAL_AUTOMATIC_ACTION Disposition =~ /automatic-action\/MDN-sent-automatically; deleted/

This appears to be some new MS Exchange bounce message.

I'm running 3.2.5 if it matters.

thanks.  
-jeff

Re: Disposition deleted

[John Hardin <jh...@impsec.org>]

On Mon, 8 Aug 2011, Jeff Mincy wrote:

> Can somebody clue me in on how to match 'Disposition: automatic-action/MDN-sent-automatically; deleted'
> in a disposition-notification mime attachment?
>
>   ------_=_NextPart_001_01CC55E0.440F392C
>   Content-Type: message/disposition-notification
>   Content-Transfer-Encoding: 7bit
>
>   Final-Recipient: RFC822; Kathy.Dupre@ca.com
>   Disposition: automatic-action/MDN-sent-automatically; deleted
>   X-MSExch-Correlation-Key: 1CORJJTUYkSeBj5kXwFqLQ==
>
>   ------_=_NextPart_001_01CC55E0.440F392C--
>
> I've tried body, rawbody and mimeheader without success:
>   mimeheader LOCAL_AUTOMATIC_ACTION Disposition =~ /automatic-action\/MDN-sent-automatically; deleted/

mimeheader won't work as Disposition: is in a MIME body part - note the 
blank line, it's syntactically significant (unless that's a cut-and-paste 
error in your example). You could use mimeheader to check for the 
content-type, but I suspect that since SA doesn't grok 
message/disposition-notification it's not exposing that body part to 
rawbody or body.

Try a "full" rule.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   ...to announce there must be no criticism of the President or to
   stand by the President right or wrong is not only unpatriotic and
   servile, but is morally treasonous to the American public.
                                           -- Theodore Roosevelt, 1918
-----------------------------------------------------------------------
  7 days until the 66th anniversary of the end of World War II