>A friend of mine also has suggested the following (the coding is my own,
>so if it doesn't work, I've poorly implemented the suggestion):
>
>  header   SYL_BAD_XOIP X-Originating-IP !~ /\[?(\d{1,3}\.){3}\d{1,3}\]?/
>
As was noted before, a negative test will false-positive when there is no
X-O-IP header.  Thus,

header __HAS_XOIP               exists:X-Originating-IP
describe __HAS_XOIP             Header contains X-Originating-IP:

header __INVALID_XOIP           X-Originating-IP !~ 
/\[?((?:1?\d\d?|2[0-4]\d|25[0-4])\.){3}(?:1?\d\d?|2[0-4]\d|25[0-4])\]?$/
describe __INVALID_XOIP         XOIP header does not have a valid IP

meta MALFORMED_XOIP             __HAS_XOIP && __INVALID_XOIP
describe MALFORMED_XOIP X-Originating-IP: header does not have a valid IP


(My code is more strict about the format of the IP address, but it's the same
thing...)


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to