Re: Writing a rule to match a header name and value

2017-04-24 Thread John Hardin
On Mon, 24 Apr 2017, Geoff Soper wrote: I'm trying to write a rule that matches both the name of a header and its value. I've had no luck so far, can somebody point out my mistake? My current attempt is: header __GS_PHP_ORIG ALL =~ /^X-PHP-Originating-Script: [0 -9]+:(Mailer|Sendmai

Writing a rule to match a header name and value

2017-04-24 Thread Geoff Soper
I'm trying to write a rule that matches both the name of a header and its value. I've had no luck so far, can somebody point out my mistake? My current attempt is: header __GS_PHP_ORIG ALL =~ /^X-PHP-Originating-Script: [0 -9]+:(Mailer|Sendmail|Api).php/i An example line is: X-PHP-Or