>A friend of mine also has suggested the following (the coding is my own, >so if it doesn't work, I've poorly implemented the suggestion): > > header SYL_BAD_XOIP X-Originating-IP !~ /\[?(\d{1,3}\.){3}\d{1,3}\]?/ > As was noted before, a negative test will false-positive when there is no X-O-IP header. Thus,
header __HAS_XOIP exists:X-Originating-IP describe __HAS_XOIP Header contains X-Originating-IP: header __INVALID_XOIP X-Originating-IP !~ /\[?((?:1?\d\d?|2[0-4]\d|25[0-4])\.){3}(?:1?\d\d?|2[0-4]\d|25[0-4])\]?$/ describe __INVALID_XOIP XOIP header does not have a valid IP meta MALFORMED_XOIP __HAS_XOIP && __INVALID_XOIP describe MALFORMED_XOIP X-Originating-IP: header does not have a valid IP (My code is more strict about the format of the IP address, but it's the same thing...) ------------------------------------------------------- The SF.Net email is sponsored by EclipseCon 2004 Premiere Conference on Open Tools Development and Integration See the breadth of Eclipse activity. February 3-5 in Anaheim, CA. http://www.eclipsecon.org/osdn _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk