Content Filter to check for Reply-To mismatch is always triggered

[MiguelAngelChana23263]

Hi:

I have a strange issue that honestly I don't know how to solve.

Before opening a case I'm asking here to check if anybody can shed some light on it, I guess the problem is me.

In default policy I have a content filter with the following rules (both of the conditions must be true)

Other Header Reply-To exists

Header Reply-To does not equal $envelopesender

And actions:

Log

Quarantine-duplicate

Add Disclaimer text

Whenever I enable this filter in the default policy ALL of the messages with a reply-to header match the filter and get duplicated to quarantine and disclaimer text added, no matter if the reply-to is the same or different to the envelopesender

I tried several things like use "does not contain" instead of "does not equal" and using $envelopefrom instead of $envelopesender, but without luck. Is there something obvious I'm missing? I've seen examples of doing this everywhere, and it sounds to me that it's correct

Another test I did is to put the content filter in another policy, and apparently it works fine, it's happening when the filter is in the default. Any idea?

[marc.luescherFRE]

Hi Miguel,

our working sample is like this :

GUI_Check_From_ReplyTo: if (rcpt-to == "marc.luescher@fmc-na.com") AND (header("reply-to")) AND (header("reply-to") != "^$envelopefrom$") { add-heading("External_Warning_ReplyTo"); add-heading("External_Warning_ReplyTo_Fields"); insert-header("X-Ironport-Spoof", "yes"); }

Please check and let me know if that helps.

-Marc

[MiguelAngelChana23263]

Marc:
Thank you, but this is more or less what I’m doing, and I can’t make any sense of it. Simplifying to the maximum:
GUI_REPLY-TO-FLT2: if (header(“reply-to”)) AND (header(“reply-to”) != “^$envelopefrom$”) {
add-heading(“REPLY-TO_MISMATCH”);
}
Message filter and content filter look like they are doing the same, it always matches and add the disclaimer as long as it has a “reply-to” header, second condition is always matched, no matter if it’s true or not.. ☹
It looks like the comparison is not made with the machine readable part (the one between <>) but with the literal string that comes from the reply-to header.
I’m going to try with a regex that matches exactly what is coming in the reply-to header, and see what happens

[marc.luescherFRE]

What are your settings in mail policies / mail policy settings.

Do you have P1 and P2 visible ?

[MiguelAngelChana23263]

I have P1 = Envelope Sender and P2 = Headers (From, Reply-To, Sender)

[marc.luescherFRE]

what ESA Release are you running ?

[MiguelAngelChana23263]

13.5.1-071
I found this in production when the customer spotted a lot of false positives. Now I'm using a lab in dcloud, but the behavior is the same.

[MiguelAngelChana23263]

It does not matter priorities, the only thing I can come to is the following:

Have sender "someguy@domain.com" 

Sends from Outlook and inserts header Reply-To: Some Guy <someguy@domain.com>

When message arrives, filter compares "someguy@domain.com" (the $envelopefrom variable) with "Some Guy <someguy@domain.com>" and fails, so the rule is true and all the conditions match.

I just tested the following: configure second rule to compare estrictly to "Some Guy <someguy@domain.com>" instead of $envelopefrom and now it matches, so second rule it's false and won't insert the heading ... It's very strange for me. 

[marc.luescherFRE]

let me think about this as we use the same sw version in production and it is working as expected

[MiguelAngelChana23263]

Thank you very much, that will be very helpful. In the meanwhile, this is the last test I've made. I inserted a couple of variables in the disclaimer text to try and see what's going on:
Plain Text Version:
REPLY-TO MISMATCH
SENDER: $EnvelopeFrom
FILTER:$Filtername
HEADER: $header['reply-to']
Then I send a message with the following reply-to header:
Reply-To: Peter Griffin peterg@dcloud-out.cisco.com
And I get the following message:
REPLY-TO MISMATCH
SENDER: peterg@dcloud-out.cisco.com
FILTER: GUI_REPLY-TO_FLT2
HEADER: Peter Griffin
As you see, out of the address in the header, the filter it's only taking the display address, not the machine readable part between <> so it's impossible that they match

[MiguelAngelChana23263 · Accepted solution]

I just received the answer from TAC: apparently it is not supported, because in message/content filters the system cannot compare two variables. 

Would you do me a favour and check if this effectively working in your environment? I honestly don't know what to think, because this is something I've considered possible for some time and not it surprised me a lot. 

[REJR77]

Hi Miguel,

Were you able to find a solution for that?

I am trying to compare mail-from (sender address) with from header, to advertise end user if both are different.

Impossible to compare (as if ESA does not understand the $envelopefrom variable in may filter)

thanks