On Tue, Apr 26, 2022 at 02:35:25PM +0200, Matus UHLAR - fantomas wrote:
> is it possible to match message headers in rfc822 atttachments?
>
> from what I know, "header" rules only apply to mail headers and mimeheader
> only apply to mime headers.
>
> body and rawbody afaik only search in bodies of messages or included
> messages.
>
> I have asked some time ago but no success:
>
> https://marc.info/?l=spamassassin-users&m=132282473328809&w=2
>
> is this possible now or do we need out-of SA solution for this?
On Tue, Apr 26, 2022 at 04:04:13PM +0300, Henrik K wrote:
full FOO /\nContent-Type:
message\/rfc822.*?\nReceived:(?:[^\n]+\n\s+){0,3}[^\n]*\b1.2.3.4\b/s
On 26.04.22 16:11, Henrik K wrote:
Maybe a bit safer version that doesn't log huge strings and run wild
full FOO /^(?=.*?\nContent-Type:
message\/rfc822.{0,1024}?\nReceived:(?:[^\n]{1,100}\n\s{1,100}){0,3}[^\n]{0,100}\b1\.2\.3\.4\b)/s
Doesn't this requires mime headers in specific order that may not be
fullfilled?
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Honk if you love peace and quiet.
