On 31 Mar, Patrick Shanahan wrote:
| * Mahmood Iqbal Hashmi <mahmoodi(_at_)webnet(_dot_)com(_dot_)pk> [03-31-03
04:45]:
| > I can block multiple file attatahments in the single line commads
| > like:
| >
| > :0 B
| > * (filename|name)=.*\.(bat|lnk|scr|cpl|pif|cmd|com|dll|vbs)
| > $BADMAILS1
| >
| > Let me advice how can I block multiple domains in the single line or
| > via file. The following is not working.
| >
| > :0
| > * ^From:.*\<transmitr.net\>
| > * ^From:.*\<iExpect.com\>
| > * ^From:.*\<zoanmail.com\>
| > * ^From:.*\<responsesystems.org\>
| > * ^From:.*\<liwxtry.com\>
| > * ^TOkousar
| > $BADMAILS1
|
| You need a ..line..continuation..character.. and ..only.. one rule per
| recipie, also '\>' and '|<' are special cases, ie:
|
| :0
| * ^From:.*transmitr.net|\
| ^From:.*iExpect.com|\
| ^From:.*zoanmail.com|\
| ^From:.*responsesystems.org|\
| ^From:.*liwxtry.com|\
| ^TOkousar
| $BADMAILS1
If it were me, I'd probably write that:
:0:
* ^From:.*\<(transmitr\.net|\
iExpect\.com|\
zoanmail\.com|\
responsesystems\.org|\
liwxtry\.com)\>
* ^TOkousar
$BADMAILS1
Caveat: I'm not sure if Mahmood wants every message to match ^TOkousar
AND any one of the others, or if he wants them to match ^TOkousar OR any
one of the others. If the first, then this example is fine. If the
second, then this is no good and the fix is too contorted anyway (IMO).
See scoring example below.
I'm pretty sure that's a more efficient reqular expression, rather than
repeating "^From.*" multiple times. I've replaced the word boundary
characters (\> and \<) Mahmood was using, because they're correct.
They prevent something like DoiExpect.com from matching iExpect.com.
There are further optimizations possible by combining the .com domains
in another alternation, but that's left as an exercise.
I'm guessing you meant only one rule for this particular application.
Multiple rules (conditions) are legal. What must be remembered is, when
there are multiple conditions, they ALL must match for the entire recipe
to match. In other words, multiple conditions are a logical AND
operation.
Scoring can be used to do logical OR operations:
:0:
* ^TOkousar
* 1^0 ^From:.*\<transmitr\.net\>
* 1^0 ^From:.*\<iExpect\.com\>
* 1^0 ^From:.*\<zoanmail\.com\>
* 1^0 ^From:.*\<responsesystems\.org\>
* 1^0 ^From:.*\<liwxtry\.com\>
$BADMAILS1
Referring back to the caveat above, if the ^TOkousar condition is
intended to match all messages (logical AND), then this is fine. If
it's meant to be a logical OR with each of the From: conditions, then
insert 1^0 in the space preceding that condition.
Finally, one possible optimization would be to assign the contents of
the From: header to a variable and check that variable in each condition
instead of scanning the headers each time. If it's just this recipe, the
effort might not be worthwhile. If the From: header is checked in any
other recipes, it may well be worth it. Another would be using the
supremum value in the score to short-circuit checking additional
conditions as soon as one matches:
Something like:
max=2147483647
:0
* ^From:[ ]\/[^ ].*
{ FROM = "$MATCH" }
:0:
* ^TOkousar
* $ $max^0 FROM ?? ()\<transmitr\.net\>
* $ $max^0 FROM ?? ()\<iExpect\.com\>
* $ $max^0 FROM ?? ()\<zoanmail\.com\>
* $ $max^0 FROM ?? ()\<responsesystems\.org\>
* $ $max^0 FROM ?? ()\<liwxtry\.com\>
$BADMAILS1
Same caveat as above with ^TOkousar
N.B. I've also escaped all the dots (.) in the regular expressions and
added a local lockfile (trailing : in :0:) since delivery is to a file.
--
Email address in From: header is valid * but only for a couple of days *
This is my reluctant response to spammers' unrelenting address harvesting
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail