Thanks Bill and John...
Your words make sense to me. It seems that ALL means that SA puts all headers
into a Perl string (including \n chars) and tries the regex...
As John Hardin correctly states, a dot does not match the \n but this is
changed with the "s" regex flag.
In fact it works like a charm if i try a rule like this:
header TESTRULE2 ALL =~ /From=.*pedro.* To=.*pedro.*/ism
This is a mistery... :-?
Thanks to all...
---PedroD
On Thursday, December 6, 2018, 8:32:46 PM GMT+1, Bill Cole
<sausers-20150...@billmail.scconsult.com> wrote:
On 6 Dec 2018, at 13:36, Pedro David Marco wrote:
> Thanks a lot Bill..
> i already considered the "multiple" flag and it did not work
> either... i mean... the rule works but i only see the first line
> in Debug mode...
> ----Pedrod
Having pondered this for a bit and looked at unhelpful docs, I *think* I
understand what's going on.
You cannot get multiple hits from an ALL rule because the regex is
matched against the whole block of headers. Once it matches, the test is
done.
It might make sense to add an "ANY" pseudo-header that tests against
each header, rather than "ALL" which tests against the whole text of all
the headers.
--
Bill Cole
b...@scconsult.com or billc...@apache.org
(AKA @grumpybozo and many *@billmail.scconsult.com addresses)
Available For Hire: https://linkedin.com/in/billcole
