On Sun, 2011-10-23 at 11:15 -0700, Jakub Serych wrote:
> Could anybody help newbie to build rule for "From:" line? My server is
> flooded with spams like this:
> header FROM_ENLARG From: =~
^
Drop the colon, the header name is a plain "From".
> /(\bsex\b|\bfree\b|\btrial\b|\benlarge.*|\bpils|sample.*)/i
^^ ^^
These are unnecessary at the end of the match.
You should carefully watch the anchors for your RE, in your case the \b
word boundaries. The above matches a "sample" string anywhere, even
embedded inside a name -- or the email address for that matter.
If you want to match the "real name" part only, the :name modifier comes
in handy. Note that the modifier is delimited by a leading colon. The
colon (as per above) is not part of the "From" header name.
header FOO From:name =~ /\b(sex|free|trial|enlarge)\b/i
Here I also moved the \b word boundaries outside the alternation, so you
cannot forget it when adding more words. ;)
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
