[imp] Received: line problems

[Jeff Tucker]

Hello again.

I upgraded to Horde-CVS a couple days ago and now I'm having a couple 
problems with the Received: line which imp inserts.

1. The line appears to be inserted with \r\n sequences in it. On my system, 
this is then fed to qmail which does no line-end modification at all, 
expecting to be passed a properly formatted message. I've started having 
complaints about what happens when these messages get to remote mail 
servers. In one case, a mail server virus filter is complaining about 
improper MIME characters in the headers. In another, a mail server broke 
the headers after the first \r\n and put the rest of the headers in the 
body of the message.

The problem header is the Received: line. Since it is so long, it is always 
affected by the MIME::wrapHeaders function in horde/lib/MIME.php. In there, 
I see the following code:
        $line = wordwrap($line, 75, "\r\n\t");
Replacing "\r\n\t" with just "\n\t" seems to have fixed outgoing messages. 
Will that break something else? Should that be changed in the Horde source?

2. One of my computers is behind a NAT firewall and I used that to access 
the remote imp computer. When I emailed myself, I see that the headers look 
like:

Received: from 192.168.0.221 (192.168.0.221 [192.168.0.221]) by
	beta.cesmail.net (Horde) with HTTP for ...

Now, 192.168.0.221 is the IP address of the computer I'm sitting at, but I 
don't think Horde should be inserting that. It seems to me that if Horde 
can't reliably determine the IP address by some means, then it shouldn't be 
inserting one. While the HELO name in regular SMTP is trivially forged, we 
can usually rely on the fact that a reputable mailserver will at least be 
able to reliably insert the IP address which connected to it and that isn't 
subject to forgery. With the existing Horde headers, I can easily get Horde 
to put whatever IP address I want on that line.

Apparently the REMOTE_ADDR variable is provided by the web client to the 
server. Is there no variable available which is server-generated and gives 
the IP address which is actually connected to the server? I realize this 
would log proxy IP's instead of the client IP's, but a lot of clients which 
are behind proxies will be using unroutable IP's anyway.

Jeff

-- 
Jeff Tucker
jeff at jltnet.com