On Wed, 2008-01-30 at 15:20 +0000, Arthur Dent wrote:
> Please forgive me for consuming off-topic bandwith with this question but I
> don't really want to subscribe to the Procmail list for what is, I hope, a
> very simple question.
>
> I get a lot of spam that has a series of numbers in the "To" address, either
> in the form To: [EMAIL PROTECTED] or [EMAIL PROTECTED]
>
> I have written an SA rule in my local.cf which quite effectively deals with
> this (header MY_ANTI_NUMERICAL_TO To =~ /\d{4,[EMAIL PROTECTED]/) I score it
> at
> 3.5 and it works very well.
>
> I am so pleased with this rule that I decided to give my poor old SA a
> well-deserved rest from this rubbish and take these spams out at Procmail
> time.
>
> Trying to get a Procmail match using the same regex however has completely
> eluded me and will quite possibly drive me mad...
>
> I have tried:
> :0:
> * ^TO_/\d{4,[EMAIL PROTECTED]/
> In-SpaM
The // are matched literally, they are not used as an RE delimiter. The
entire string after the asterisk is a regex anyway. Lose the slashes.
Procmail does not know this kind of bounded repetition. {4,} again will
be matched literally. Also, procmail does not know classes like \d. You
will have to write it, just as you mean it.
[0-9][0-9][0-9][0-9]
Oh, and the @ must be escaped in SA, because it denotes a LIST in Perl.
This is Perl specific, not RE related. Don't escape it in procmail. :)
Also, this matches the entire header line -- as opposed to SA header
rules, where the RE matches on the headers value only. Thus, since this
is bound at the beginning of the line, you will need to add wildcards
for optional stuff between the To: and the numbers.
Something like this should work. NOTE: Untested.
:0 :
* [EMAIL PROTECTED]
spam/to-numerical
> Or variants such as:
> Or about a thousand different combinations of the above.
>
> None of them seem to match.
>
> Regex is not my thing (as you can clearly see!) but I know this list is awash
> with regex gurus (some of your stuff makes my eyes water) not to mention
> Procmail experts so I hope someone can give me a give fix...
When writing procmail receipts, it often helps a lot to remind oneself
of procmails supported REs by checking 'man procmailrc' or some docs on
the net. This one is a nice reference:
http://partmaps.org/era/procmail/quickref.html
Hope the above helps. :)
guenther
--
char *t="[EMAIL PROTECTED]";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
