At 09:09 AM 10/2/03 -0600, Dan Tappin wrote:

So if I wanted multiple ISP's in the same rule can I do an OR operator or
can I just create multiple header rules with the same lable?

All rules must have different names.. if two rules have the same name, the first is over-written.


There is a regex OR operator, but I'd really advise just doing separate rules for now. The OR operation in regex's is a bit tricky.


Example:

priv-edtnes56.telusplanet.net
priv-edtnes57.telusplanet.net
misav02.sasknet.sk.ca

header LOCAL_RCVD_TRUSTED_SMTP Received =~
/priv-?\.telusplanet\.net|?\.sasknet\.sk\.ca/i
score LOCAL_RCVD_TRUSTED_SMTP -10.0

or

header LOCAL_RCVD_TRUSTED_SMTP Received =~ /?\.sasknet\.sk\.ca/i
header LOCAL_RCVD_TRUSTED_SMTP Received =~ /priv-?\.telusplanet\.net/i
score LOCAL_RCVD_TRUSTED_SMTP -10.0

So the `.` is required before all pattern matches such as {0-20} and is the
`?` the wildcard operator?

No, . is the wildcard character. ? isn't a wildcard at all.


The {0,20} is actually a repeat-count limit.

.{0,20} means "match as few as 0 or as many as 20 wildcard characters"

z{1,20} would match a string of at least 1, and as many as 20 z's

? is also a repeat count limit.. It is the same as {0,1}

so
.? means "match any character, 0 or 1 times". It's used to do things like planes? which will match "plane" or "planes".


? is also used inside OR operations to prevent backtracing, so (?: x| y) is an or operation, matching x or y with no regex backtracing.. it's kind of messy.


Is there a FAQ on the format for writing rules?  Are these just regex?  It's
about time to buy a book on this.

They are perl regex, an extension of plain regex and I've got a howto on rule writing. It also has a list of links in it to pages on regex syntax.


http://mywebpages.comcast.net/mkettler/sa/SA-rules-howto.txt





-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to