++ 22/03/00 18:25 -0500 - Rik Kabel:
I guess i'm just overlooking a thing here, but can someone explain why
this does not work?
QUAD = "([1-9]|[1-9][0-9]|1[0-9][0-9]|2([0-4][0-9]|5[0-5]))"
IP = "${QUAD}\.${QUAD}\.${QUAD}\.${QUAD}"
:0
* ! ^Received: \(from
* ! ^Received: from.*${IP}
[action: One of the servers did not record senders IP address.]
Replace
* ! ^Received: from.*${IP}
with
* $ ! ^Received: from.*${IP}
Sorry, that was there before, must have forget to put it back after
testing... stupid. Anyway, it still doesn't work. I have these headers
in a test message. The first line should not be caught, the second
should.
Received: from dep.bdk.rug.nl (dep.bdk.rug.nl [129.125.11.6])
by smtp6.xs4all.nl (8.9.3/8.9.3) with ESMTP id TAA22416
for <rejo(_at_)sisterray(_dot_)xs4all(_dot_)nl>; Wed, 22 Mar 2000
19:21:37 +0100 (CET)
Received: from bdk2.bdk.rug.nl by dep.bdk.rug.nl (TAA10318); Wed, 22 Mar
2000 19:00:18 +0100 (MET)
Why will it not work probably?
Note that 0 is a perfectly valid value, but excluded in your definition
of QUAD.
I know. The QUAD was copied from someone else and slightly adopted. Now
you're mentioning the zero... is a quad like 041 valid? I guess not, but
i'm not sure.
Also be aware that many systems located behind corporate (and
government...) firewalls do not record initial handoffs from user
workstations. This is not by itself a reliable stigma of spam or of
misconfigured servers.
I know. I don't use any of the filters to drop or bounce mail. Just to
make me notice some stuff. See http://mediaport.org/~sister/personal/procmail.
-Rejo.
--
= Rejo Zenger
rejo(_at_)sisterray(_dot_)xs4all(_dot_)nl
= http://mediaport.org/~sister (and my_urls.html) PGP: see headers
--------------------------------------------------------------------------------