Re: [Exim] Blocking sobig.f

Top Page
Delete this message
Reply to this message
Author: Kyle Dippery
Date:  
To: exim-users
Subject: Re: [Exim] Blocking sobig.f
On Wed, Aug 20, 2003 at 08:59:33PM +0100, Marc Beyer wrote:
>
> if ($message_body contains
> "A4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4ga") and
>        ( $header_subject: matches "^[Rr]e: [Yy]our [Aa]pplication\\$"

[...]
>        or $header_subject: matches "^([Rr]e: )?[Tt]hank [Yy]ou!\\$"
>        logfile /var/log/exim4/mainlog
>        logwrite "$tod_log $message_id Sobig F worm detected in mail from
>        host $sender_host_name[$sender_host_address]"
>        seen finish
> endif

>
> This could be vastly beautified if it was possible to use the
> /i regex modifier for caseless matching, but I don't think you can do that
> in
> the exim filters (please correct me if I'm wrong).


According to the filter spec, conditions in all lowercase
("matches", etc) are case-insensitive. If you want to match case
the condition should be typed in all uppercase.

Is that not actually the case?

Cheers,
Kyle
--
Kyle Dippery
Engineering Computing Services        Phone: (859) 257-1346
280 Anderson Hall                   Fax:   (859) 323-3848
University of Kentucky
Lexington, KY  40506-0046