Rule match by Subject: ?

[Pete Russell]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

is there a way you can make a specific rule TAB only if that has a
certain prefix or filename?



Julian Field wrote:
> How about
> space ==> \space
> tab ==> \tab
> \n ==> \n
> \ ==> \\
>
> So you basically have to escape spaces and tabs.
>
> Julian Field wrote:
>
>> Have just thought of a nasty snag.
>>
>> What happens when you want to match a header value with a string with
>> spaces in it? This breaks the config compiler rather badly. I can't go
>> to "tabs only" as that would break everyone's rulesets out there, and I
>> don't want to go to "tabs only for header contents matches" as that is a
>> nasty exception.
>>
>> Thoughts?
>>
>> Roger Jochem wrote:
>>
>>> It would be intersting...  I could use this...
>>>
>>> ----- Original Message -----
>>> From: "Julian Field" <MailScanner at ECS.SOTON.AC.UK>
>>> To: <MAILSCANNER at JISCMAIL.AC.UK>
>>> Sent: Thursday, February 17, 2005 5:50 AM
>>> Subject: Rule match by Subject: ?
>>>
>>>
>>>
>>>
>>>> Is it useful to anyone to be able to use Subject: matches in a ruleset?
>>>> It should be pretty simple to add, it's just a copy of the virus-name
>>>> matching I already do.
>>>>
>>>> --
>>>> Julian Field
>>>> www.MailScanner.info
>>>> Buy the MailScanner book at www.MailScanner.info/store
>>>>
>>>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>>>
>>>> ------------------------ MailScanner list ------------------------
>>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>>> 'leave mailscanner' in the body of the email.
>>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>>
>>>> Support MailScanner development - buy the book off the website!
>>>>
>>>>
>>>
>>> ------------------------ MailScanner list ------------------------
>>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>>> 'leave mailscanner' in the body of the email.
>>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>>
>>> Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>
>> --
>> Julian Field
>> www.MailScanner.info
>> Buy the MailScanner book at www.MailScanner.info/store
>>
>> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>>
>> ------------------------ MailScanner list ------------------------
>> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
>> 'leave mailscanner' in the body of the email.
>> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
>> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>>
>> Support MailScanner development - buy the book off the website!
>>
>
> --
> Julian Field
> www.MailScanner.info
> Buy the MailScanner book at www.MailScanner.info/store
>
> PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>
>

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!