matching multiple lines

[Fred Yankowski]

On Tue, Jul 20, 2004 at 02:28:50PM -0700, .rp wrote:
> Well I know you can find tabs in headers but think it would be quite
> a leap to get procmail to join lines together.

I don't quite follow what you are saying, but it turns out to be
fairly easy to construct procmail patterns that match over multiple
consecutive lines.  Attached is an example script that I use (that
script having nothing to do with bogofilter).

-- 
Fred Yankowski      fred at ontosys.com           tel: +1.630.879.1312
OntoSys, Inc	    PGP keyID: 7B449345        fax: +1.630.879.1370
www.ontosys.com     38W242 Deerpath Rd, Batavia, IL 60510-9461, USA
-------------- next part --------------
BADNAME="\.(bat|cmd|exe|pif|scr|zip)$"

:0
* 1^0 ^Content-Type: multipart/
* 1^0 ^From:.*\<mailer-daemon@
* B ?? ^Content-Type:.*application/octet-stream.*($[	 ])?.*name="?\/[^"]+
* $ MATCH ?? $BADNAME
{
    # Message has attachment of type octet-stream with a bad name
    LOG="notice: bad attachment name: $MATCH
"
    :0
    * ^X-Whitelist: Yes
    IN/bad-attach/

    :0
    IN/~bogo/bad-attach/
}


# NOTES:  Content-Type headers inside the document body typically have
# their 'name' attribute on the following line, so the pattern above
# allows for such continuation (per Bill Wohler <wohler at newt.com>).
#
# Only multipart messages have real attachments, but we also match
# messages from 'mailer-daemons' that include such attachment data in
# their body (when they echo the content of the rejected message).