Hi, > I'm used to a buffer being a __CHUNK (using your rule example) of
> > text, or the first 4k or so, not up to the first two line breaks, so I > > was confused. > > You are confused, indeed. And confusing body for rawbody rules. So much > for the pun. ;) > > The terms I were using are directly derived from the official docs and > code. Hence the "chunks" of 1-2 kByte in rawbody context. Internal > representations of the message, suited for the various types of rules > and processing. Which is entirely separate from the buffered (sic), raw > pristine input, that will eventually be returned with added headers. > > In the context of SA rules, there is no buffer. > I'm going to be wrecked in the morning from lack of sleep at this point, but I do understand what you're saying. In between following the whole Snowden thing this evening. I understood the "buffer" is the 1-2k area where the rawbody content is stored, not the low-level "buffered" data space before it's processed. Thanks for the proper terminology. > There are body rules, regular expressions matched against strings which > comprise a "paragraph" of rendered text. Traditional style, compare with > this very (plain!) text. > > And there are rawbody rules, regular expressions matched against chunks > of the textual MIME-parts. "Chunks" of the raw textual parts, that are > at least 1024 byte in size, and commonly delimited by a newline. > Yes, and I'm sorry I left you with an indication I didn't know at least that. > I'll send you a pastebin sample off-list, in case you have a chance to > look in the morning :-) Scratch "morning", make that "some time of the day". Local time. And > individually felt timezone. > That was my effort to prod you a bit, but I accept that :-) Thanks, Alex
