On Mon, 8 Aug 2011, Jeff Mincy wrote:
Can somebody clue me in on how to match 'Disposition:
automatic-action/MDN-sent-automatically; deleted'
in a disposition-notification mime attachment?
------_=_NextPart_001_01CC55E0.440F392C
Content-Type: message/disposition-notification
Content-Transfer-Encoding: 7bit
Final-Recipient: RFC822; kathy.du...@ca.com
Disposition: automatic-action/MDN-sent-automatically; deleted
X-MSExch-Correlation-Key: 1CORJJTUYkSeBj5kXwFqLQ==
------_=_NextPart_001_01CC55E0.440F392C--
I've tried body, rawbody and mimeheader without success:
mimeheader LOCAL_AUTOMATIC_ACTION Disposition =~
/automatic-action\/MDN-sent-automatically; deleted/
mimeheader won't work as Disposition: is in a MIME body part - note the
blank line, it's syntactically significant (unless that's a cut-and-paste
error in your example). You could use mimeheader to check for the
content-type, but I suspect that since SA doesn't grok
message/disposition-notification it's not exposing that body part to
rawbody or body.
Try a "full" rule.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...to announce there must be no criticism of the President or to
stand by the President right or wrong is not only unpatriotic and
servile, but is morally treasonous to the American public.
-- Theodore Roosevelt, 1918
-----------------------------------------------------------------------
7 days until the 66th anniversary of the end of World War II
