TID: FMail-lnx64 2.1.0.18-B20170815   
   RFC-X-No-Archive: Yes   
   TZUTC: 0200   
   CHRS: UTF-8 2   
   PID: GED+LNX 1.1.5-b20161221   
   MSGID: 2:280/464 5d8b9a0d   
   REPLY: 2:335/364.1 5d8b7e30   
   Hi Fabio,   
      
   On 2019-09-25 16:41:18, you wrote to me:   
      
    WV>> That depends where you intercept the messages to get the information.   
    WV>> Is it from the .pkt file or is it already in a message base?   
      
    FB> In the between. :)   
    FB> In HPT you can intercept the single message unpacked from the bundle   
   before   
    FB> the delivery to the message base, there you are in GOD MODE [(c) DOOM]   
      
   Then you have to figure out how the header is represented in that intercepted   
   message from HPT.   
      
    FB> and you can do all that you want with perl scripts.   
      
   'perl'!? You're a masochist! ;)   
      
    WV>> If everything can be forged, your software can't know if some part or   
    WV>> all of the message is forged, so it doesn't have to consider that.   
    WV>> And it's not a consideration to not use the header, instead of other   
    WV>> parts of the message. ;)   
      
    FB> You're right, but there should be someting that is injected by the main   
    FB> node to know where the message is originated and not forgeable by a user   
    FB> editor (BBS/Point/JAMNNTPD and so on), do you know about something like   
    FB> this?   
      
   Well in an echomail message you have 4 possible sources:   
      
     Header   
     MSGID kludge   
     Origin line   
     PATH line   
      
   If you don't trust any, you could compare the ones that are present. And if   
   there are inconsistencies report/log/move-to-bad or do whatever you seem   
   appropriate with it. I don't think it's worth it...   
      
    FB> Are you sure that the first node of the path can be rewritten?   
      
   It's generated on the originating system, so someone that really wants to   
   fiddle with it, could.   
      
   The problem with the PATH line is the lack of zone and point fields. And they   
   could have been stripped somewhere along the path. So the first system in the   
   first PATH line doesn't have to be the originating system.   
      
   Btw: The header (in a packed message) has the same limitation as the PATH, it   
   doesn't contain the Zone and Point number of the originating system.   
      
   Bye, Wilfred.   
      
   --- FMail-lnx64 2.1.0.18-B20170815   
    * Origin: FMail development HQ (2:280/464)   
   SEEN-BY: 1/123 15/2 18/200 103/705 154/10 203/0 221/0 227/114 229/354   
   SEEN-BY: 229/426 1014 240/5832 249/206 317 280/464 5003 292/854 310/31   
   SEEN-BY: 317/3 322/757 342/200 396/45 423/120 633/280 712/848 770/1   
   PATH: 280/464 229/426