me @ coworkers: stop trying to parse headers to get info that comes from the envelope

[atax1a@infosec.exchange]

me @ coworkers: stop trying to parse headers to get info that comes from the envelope

coworker: i am parsing the Received header to find original source ip, is this ok?

[munin@infosec.exchange]

@atax1a

why isn't there an organizational library to provide those functions replicably and safely that they can just make a call to?

[atax1a@infosec.exchange]

@munin because they do not store the envelope data, thus it evaporates once it leaves our system. we have been trying to get them to do "not that" since day 1

[atax1a@infosec.exchange]

@munin "there is, but they don't use it"

[munin@infosec.exchange]

@atax1a

wtyp.

[atax1a@infosec.exchange]

@munin yes, which is something we've been trying to correct, by wrapping the message itself with another layer of MIME, such that the sibling attachment contains the envelope data

[grumpybozo@toad.social]

@munin @atax1a Speaking from atop the large pile of Perl that is SpamAssassin:

It's harder than it looks.

[atax1a@infosec.exchange]

@grumpybozo in our environment it's easy, the frontend passes the IP along out-of-band, but the target service fails to preserve the data