We got mails (in this case, always spam) with a From: header line of
the strange form
"some name" <user@domain>{SET:debug=11}
Sendmail does not preserve the form of this header but changes it into
"\"some name\" <user@domain>{set:"user@domain
I could not see from sendmail.cf where this happens and could not
reproduce this using /usr/lib/sendmail -bt by any rule. But I could
reproduce the behaviour by sending myself mails with faked From: header
lines of this form.
Is such a From: line meaningful in any way? If yes, what does it mean?
Why is it corrupted by sendmail (version 8.11.7+Sun)?

--

Hans Werner Strube strube(@)physik3(.)gwdg(.)de
Drittes Physikalisches Institut, Univ. Goettingen
Friedrich-Hund-Platz 1, 37077 Goettingen, Germany

Hi,

same thing here. Using Sendmail 8.13.8 compiled from source under
Linux, have reproduced on a test machine with basically only a
SMART_HOST in the config file.

Tried to set up a local rule, catching the { and } characters in the
From: header but failed miserably. I lack the knowledge, as far as i
can tell, the { and } are handled like <, ", and so on (not sure how i
would go about catching these in a local rule).

My intention was to reject mails with these characters - but my rule
isn't working....

My main problem with these is that the changed header seriously breaks
the backend system :-(

Anyone have any ideas where one would look for more information about
this?

kind regards,
/Dan

Hans Werner Strube, strube&physik3*gwdg*de wrote:
> We got mails (in this case, always spam) with a From: header line of
> the strange form
> "some name" <user@domain>{SET:debug=11}
> Sendmail does not preserve the form of this header but changes it into
> "\"some name\" <user@domain>{set:"user@domain
> I could not see from sendmail.cf where this happens and could not
> reproduce this using /usr/lib/sendmail -bt by any rule. But I could
> reproduce the behaviour by sending myself mails with faked From: header
> lines of this form.
> Is such a From: line meaningful in any way? If yes, what does it mean?
> Why is it corrupted by sendmail (version 8.11.7+Sun)?
>
> --
>
> Hans Werner Strube strube(@)physik3(.)gwdg(.)de
> Drittes Physikalisches Institut, Univ. Goettingen
> Friedrich-Hund-Platz 1, 37077 Goettingen, Germany

Did some more research on this. I believe (but i am far from sure) that
the rule "HdrFromSMTP" might be somehow involved. At least i see no
other rule supposed to touch the headers in my test setup. Or rather
MasqSMTP/MasqHdr. But again, i am not sure.

Any sendmail guru out there that can shedding some light over
this? A pointer in the right direction would be of great . I
believe these { } are not really supposed to be in the From: header and
therefore some rule rewrites them improperly.

thanks ahead of time
/Dan



rabies2000@hotmail.com wrote:
> Hi,
>
> same thing here. Using Sendmail 8.13.8 compiled from source under
> Linux, have reproduced on a test machine with basically only a
> SMART_HOST in the config file.
>
> Tried to set up a local rule, catching the { and } characters in the
> From: header but failed miserably. I lack the knowledge, as far as i
> can tell, the { and } are handled like <, ", and so on (not sure how i
> would go about catching these in a local rule).
>
> My intention was to reject mails with these characters - but my rule
> isn't working....
>
> My main problem with these is that the changed header seriously breaks
> the backend system :-(
>
> Anyone have any ideas where one would look for more information about
> this?
>
> kind regards,
> /Dan
>
> Hans Werner Strube, strube&physik3*gwdg*de wrote:
> > We got mails (in this case, always spam) with a From: header line of
> > the strange form
> > "some name" <user@domain>{SET:debug=11}
> > Sendmail does not preserve the form of this header but changes it into
> > "\"some name\" <user@domain>{set:"user@domain
> > I could not see from sendmail.cf where this happens and could not
> > reproduce this using /usr/lib/sendmail -bt by any rule. But I could
> > reproduce the behaviour by sending myself mails with faked From: header
> > lines of this form.
> > Is such a From: line meaningful in any way? If yes, what does it mean?
> > Why is it corrupted by sendmail (version 8.11.7+Sun)?
> >
> > --
> >
> > Hans Werner Strube strube(@)physik3(.)gwdg(.)de
> > Drittes Physikalisches Institut, Univ. Goettingen
> > Friedrich-Hund-Platz 1, 37077 Goettingen, Germany

Dan <rabies2000@hotmail.com> wrote:
> Did some more research on this. I believe (but i am far from sure) that
> the rule "HdrFromSMTP" might be somehow involved. At least i see no
> other rule supposed to touch the headers in my test setup. Or rather
> MasqSMTP/MasqHdr. But again, i am not sure.
>
> Any sendmail guru out there that can shedding some light over
> this? A pointer in the right direction would be of great . I
> believe these { } are not really supposed to be in the From: header and
> therefore some rule rewrites them improperly.
>
> thanks ahead of time
> /Dan
>
>
>
> rabies2000@hotmail.com wrote:
>> Hi,
>>
>> same thing here. Using Sendmail 8.13.8 compiled from source under
>> Linux, have reproduced on a test machine with basically only a
>> SMART_HOST in the config file.
>>
>> Tried to set up a local rule, catching the { and } characters in the
>> From: header but failed miserably. I lack the knowledge, as far as i
>> can tell, the { and } are handled like <, ", and so on (not sure how i
>> would go about catching these in a local rule).
>>
>> My intention was to reject mails with these characters - but my rule
>> isn't working....
>>
>> My main problem with these is that the changed header seriously breaks
>> the backend system :-(
>>
>> Anyone have any ideas where one would look for more information about
>> this?
>>
>> kind regards,
>> /Dan
>>
>> Hans Werner Strube, strube&physik3*gwdg*de wrote:
>> > We got mails (in this case, always spam) with a From: header line of
>> > the strange form
>> > "some name" <user@domain>{SET:debug=11}
>> > Sendmail does not preserve the form of this header but changes it into
>> > "\"some name\" <user@domain>{set:"user@domain
>> > I could not see from sendmail.cf where this happens and could not
>> > reproduce this using /usr/lib/sendmail -bt by any rule. But I could
>> > reproduce the behaviour by sending myself mails with faked From: header
>> > lines of this form.
>> > Is such a From: line meaningful in any way? If yes, what does it mean?
>> > Why is it corrupted by sendmail (version 8.11.7+Sun)?

Sending myself mails with
/usr/lib/sendmail -d strube
From: .....

test
..

I found out that the corruption occurs _after_ spooling (no corruption
visible in the debug output). The essential point is the occurrence of
a ':' in the "From:" line, not the "{...}". E.g., try
From: <xx@domain> aa:bb
This yields "<xx@domain> aa":xx@domain

--

Hans Werner Strube strube(@)physik3(.)gwdg(.)de
Drittes Physikalisches Institut, Univ. Goettingen
Friedrich-Hund-Platz 1, 37077 Goettingen, Germany