Philip Prindeville wrote: > Matt Kettler wrote: > >> Philip Prindeville wrote: >> >> >>> Matt Kettler wrote: >>> >>> >>> >>>> Philip Prindeville wrote: >>>> >>>> >>>> >>>> >>>>> Matt Kettler wrote: >>>>> >>>>> >>>>> >>>>> >>>> >>>> >>>> >>>>>> Perhaps you want something more like: >>>>>> >>>>>> header L_INCOMPETENT ALL =~ /\\r\\n\s?$/ >>>>>> >>>>>> >>>>>> >>>>>> >>>> Scratch my last email. $ doesn't work with ALL. >>>> >>>> I just tested 3 variants: >>>> >>>> header L_INCOMPETENT1 ALL =~ /\\r\\n/ >>>> >>>> header L_INCOMPETENT2 ALL =~ /\\r\\n\s?$/ >>>> >>>> header L_INCOMPETENT3 ALL =~ /\\r\\n\s?\n/ >>>> >>>> >>>> 1 and 3 work. 2 does not. >>>> >>>> >>>> >>>> >>> Ok, I tried #3 and it worked, as you said... But leaving the \s? didn't. >>> >>> I'm confused. What exactly is in the pattern buffer when the match for ALL >>> is run? And why does taking the \s? fail? What is it matching against? >>> >>> >> My guess is an extra literal \r or \f. >> >> \s matches "any whitespace" ie: [ \t\n\r\f] >> >> > > Ok, so I tried \\r\\n\r\n and that worked. > > I'm confused... When the message is written by mimedefang (or sendmail's > libmilter) into a file and then spamassassin gets run over it, is it > still in the > network format (i.e. \r\n), or has it been converted to UNIX line > termination > (i.e. \n)?
Email *should* always be in network format when SA gets it. This is particularly true for any kind of MTA layer call such as a milter. SA only very recently added code to deal with properly inserting headers into messages already converted non-network format, as sometimes happens when SA is called from a MUA after it has already been converted to the MUA's choice of EOLs. But, of course, not everything on the Internet conforms, and often you'll see email on the wire in non-network format. Also consider we are already dealing with a tool that has botched the EOL generation, and it was probably "fixed" by some other tool in the mailchain that inserted a real \r\n instead of \\r\\n. This is why I used \s?\n. It will be quite tolerant of weird formats, and formats that wound up inserting a single space char between the bogus EOL and the correct one. If you really want it to be tolerant, end with \s?[\r\f\n] This would deal with any kind of weird EOL format.. \n\r, bare \r, bare \f, whatever.
