(Non-) Capturing REs (was: Re: How to write rule for From: line)

2011-10-23 Thread Karsten Bräckelmann
[ Plain regex rules sloppily using capturing rather than non-capturing grouping snipped. ] On Mon, 2011-10-24 at 02:27 +0200, wolfgang wrote: > As far as I know, with alternations you should use "?:" at their > beginning to avoid (superfluous) memory usage: > > header FOO From:name =~ /\b(?:s

Re: How to write rule for From: line

2011-10-23 Thread wolfgang
On 2011-10-24 01:12, Dave Funk wrote: > Karsten's example is a clear win (efficiency) wise over Jakub's but > it's also more restrictive. Because of the \b bounding on the > outside, Karsten's rule will match "From: enlarge now " > but not "From: enlargement now ". > > That can be achieved by addi

Re: How to write rule for From: line

2011-10-23 Thread Karsten Bräckelmann
On Sun, 2011-10-23 at 18:12 -0500, Dave Funk wrote: > On Sun, 23 Oct 2011, Karsten Bräckelmann wrote: > > > header FROM_ENLARG From: =~ > > ^ > > Drop the colon, the header name is a plain "From". > > > > > /(\bsex\b|\bfree\b|\btrial\b|\benlarge.*|

Re: How to write rule for From: line

2011-10-23 Thread Dave Funk
On Sun, 23 Oct 2011, Karsten Br?ckelmann wrote: On Sun, 2011-10-23 at 11:15 -0700, Jakub Serych wrote: Could anybody help newbie to build rule for "From:" line? My server is flooded with spams like this: header FROM_ENLARG From: =~ ^ Drop th

Re: How to write rule for From: line

2011-10-23 Thread Karsten Bräckelmann
On Sun, 2011-10-23 at 11:15 -0700, Jakub Serych wrote: > Could anybody help newbie to build rule for "From:" line? My server is > flooded with spams like this: > header FROM_ENLARG From: =~ ^ Drop the colon, the header name is a plain "From". >

How to write rule for From: line

2011-10-23 Thread Jakub Serych
Could anybody help newbie to build rule for "From:" line? My server is flooded with spams like this: From: Enlargement pils Free Sample To: Subject: The scientific breakthrough is here Date: Sun, 23 Oct 2011 18:02:36 -0100 Message-ID: <002801cc91b3$5acd01a0$106704e0$@com> MIME-Version: 1.0 Con