REGEXP Question

Hi. I'm trying to do some simple header filtering in Postfix 2.0.19.
We're using SA to tag messges as spam and now I'd like Postfix to throw
away the messages with the tagged subject lines. So, I setup this
header check but it produces an error when I look in the mail logs:

"repetition - operator operand invalid"

Here's my header check:

/^Subject: Tagged as SPAM/ DISCARD

Obviously I'm not the Regexp guru. Any help in writing this *simple*
header check would be greatly appreciated!

Thx!

swu30@hotmail.com wrote:
> Hi. I'm trying to do some simple header filtering in Postfix 2.0.19.
> We're using SA to tag messges as spam and now I'd like Postfix to throw
> away the messages with the tagged subject lines. So, I setup this
> header check but it produces an error when I look in the mail logs:
>
> "repetition - operator operand invalid"
>
> Here's my header check:
>
> /^Subject: Tagged as SPAM/ DISCARD
>
> Obviously I'm not the Regexp guru. Any help in writing this *simple*
> header check would be greatly appreciated!
>
> Thx!
>

The regexp expression looks correct to me. How are you configuring it
in main.cf ? It should look something like:

header_checks = regexp:/etc/postfix/header_checks

or if you have PCRE available (postconf -m to check)

header_checks = pcre:/etc/postfix/header_checks

It's interesting that the Postfix source code doesn't contain
the word "operand" (from your error message).

--
Greg

Greg Hackney wrote:
> swu30@hotmail.com wrote:
> > Hi. I'm trying to do some simple header filtering in Postfix 2.0.19.
> > We're using SA to tag messges as spam and now I'd like Postfix to throw
> > away the messages with the tagged subject lines. So, I setup this
> > header check but it produces an error when I look in the mail logs:
> >
> > "repetition - operator operand invalid"
> >
> > Here's my header check:
> >
> > /^Subject: Tagged as SPAM/ DISCARD
> >
> > Obviously I'm not the Regexp guru. Any help in writing this *simple*
> > header check would be greatly appreciated!
> >
> > Thx!
> >
>
> The regexp expression looks correct to me. How are you configuring it
> in main.cf ? It should look something like:
>
> header_checks = regexp:/etc/postfix/header_checks
>
> or if you have PCRE available (postconf -m to check)
>
> header_checks = pcre:/etc/postfix/header_checks
>
> It's interesting that the Postfix source code doesn't contain
> the word "operand" (from your error message).
>
> --
> Greg

Hi -

Here's the error message hot off the press, the main.cf and
header_check file.

Thx!

Oct 16 00:00:09 smtp postfix/cleanup[48049]: warning: regexp map
/usr/local/etc/
postfix/header_checks, line 2: repetition-operator operand invalid


header_checks = regexp:/usr/local/etc/postfix/header_checks


/^Content-(Type|Disposition):.*(file)?name=.*\.(asd|bat|chm| cmd|com|dll|exe|hlp|
hta|js|jse|lnk|ocx|pif|scr|shb|shm|shs|vb|vbe|vbs| vbx|vxd|wsf|wsh|zip)/
DISCARD
Sorry, we do not accept .${3} file types.
/^Subject: ** Tagged as SPAM/ DISCARD

swu30@hotmail.com wrote:
> Greg Hackney wrote:
>> swu30@hotmail.com wrote:
>>> Hi. I'm trying to do some simple header filtering in Postfix 2.0.19.
>>> We're using SA to tag messges as spam and now I'd like Postfix to throw
>>> away the messages with the tagged subject lines. So, I setup this
>>> header check but it produces an error when I look in the mail logs:
>>>
>>> "repetition - operator operand invalid"
>>>
>>> Here's my header check:
>>>
>>> /^Subject: Tagged as SPAM/ DISCARD
>>>
>>> Obviously I'm not the Regexp guru. Any help in writing this *simple*
>>> header check would be greatly appreciated!
>>>
>>> Thx!
>>>
>> The regexp expression looks correct to me. How are you configuring it
>> in main.cf ? It should look something like:
>>
>> header_checks = regexp:/etc/postfix/header_checks
>>
>> or if you have PCRE available (postconf -m to check)
>>
>> header_checks = pcre:/etc/postfix/header_checks
>>
>> It's interesting that the Postfix source code doesn't contain
>> the word "operand" (from your error message).
>>
>> --
>> Greg
>
> Hi -
>
> Here's the error message hot off the press, the main.cf and
> header_check file.
>
> Thx!
>
> Oct 16 00:00:09 smtp postfix/cleanup[48049]: warning: regexp map
> /usr/local/etc/
> postfix/header_checks, line 2: repetition-operator operand invalid
>
>
> header_checks = regexp:/usr/local/etc/postfix/header_checks
>
>
> /^Content-(Type|Disposition):.*(file)?name=.*\.(asd|bat|chm| cmd|com|dll|exe|hlp|
> hta|js|jse|lnk|ocx|pif|scr|shb|shm|shs|vb|vbe|vbs| vbx|vxd|wsf|wsh|zip)/
> DISCARD
> Sorry, we do not accept .${3} file types.
> /^Subject: ** Tagged as SPAM/ DISCARD
>


I hope that first line is all on one line in your file, as it came
across as 4 lines in my newsreader client.

Otherwise, it shouldn't produce that error, unless maybe your
system's regex() functions are horked.

When you run the command, "postconf -m", do you see both regexp and pcre listed ?
Perhaps try using pcre instead.

Regarding your regexp statement... what are you trying to search for?
If it is literally "Subject: ** Tagged as SPAM". then the regexp would be:
/^Subject: \*\* Tagged as SPAM/

But if the search is for "Subject: something something * Tagged as SPAM"
then it would be
/^Subject:.*\* Tagged as SPAM/

In other words, delimit a search for a real asterisk with a backslash.

You can manually test the expressions in a file to see if there is
a match, or error. Example:

$ postmap -q "Subject: ** Tagged as SPAM" regexp:header_checks
DISCARD

$ postmap -q "Subject: ** Tagged as SPAM" pcre:header_checks
DISCARD

--
Greg

Greg Hackney wrote:
> swu30@hotmail.com wrote:
> > Greg Hackney wrote:
> >> swu30@hotmail.com wrote:
> >>> Hi. I'm trying to do some simple header filtering in Postfix 2.0.19.
> >>> We're using SA to tag messges as spam and now I'd like Postfix to throw
> >>> away the messages with the tagged subject lines. So, I setup this
> >>> header check but it produces an error when I look in the mail logs:
> >>>
> >>> "repetition - operator operand invalid"
> >>>
> >>> Here's my header check:
> >>>
> >>> /^Subject: Tagged as SPAM/ DISCARD
> >>>
> >>> Obviously I'm not the Regexp guru. Any help in writing this *simple*
> >>> header check would be greatly appreciated!
> >>>
> >>> Thx!
> >>>
> >> The regexp expression looks correct to me. How are you configuring it
> >> in main.cf ? It should look something like:
> >>
> >> header_checks = regexp:/etc/postfix/header_checks
> >>
> >> or if you have PCRE available (postconf -m to check)
> >>
> >> header_checks = pcre:/etc/postfix/header_checks
> >>
> >> It's interesting that the Postfix source code doesn't contain
> >> the word "operand" (from your error message).
> >>
> >> --
> >> Greg
> >
> > Hi -
> >
> > Here's the error message hot off the press, the main.cf and
> > header_check file.
> >
> > Thx!
> >
> > Oct 16 00:00:09 smtp postfix/cleanup[48049]: warning: regexp map
> > /usr/local/etc/
> > postfix/header_checks, line 2: repetition-operator operand invalid
> >
> >
> > header_checks = regexp:/usr/local/etc/postfix/header_checks
> >
> >
> > /^Content-(Type|Disposition):.*(file)?name=.*\.(asd|bat|chm| cmd|com|dll|exe|hlp|
> > hta|js|jse|lnk|ocx|pif|scr|shb|shm|shs|vb|vbe|vbs| vbx|vxd|wsf|wsh|zip)/
> > DISCARD
> > Sorry, we do not accept .${3} file types.
> > /^Subject: ** Tagged as SPAM/ DISCARD
> >
>
>
> I hope that first line is all on one line in your file, as it came
> across as 4 lines in my newsreader client.
>
> Otherwise, it shouldn't produce that error, unless maybe your
> system's regex() functions are horked.
>
> When you run the command, "postconf -m", do you see both regexp and pcre listed ?
> Perhaps try using pcre instead.
>
> Regarding your regexp statement... what are you trying to search for?
> If it is literally "Subject: ** Tagged as SPAM". then the regexp would be:
> /^Subject: \*\* Tagged as SPAM/
>
> But if the search is for "Subject: something something * Tagged as SPAM"
> then it would be
> /^Subject:.*\* Tagged as SPAM/
>
> In other words, delimit a search for a real asterisk with a backslash.
>
> You can manually test the expressions in a file to see if there is
> a match, or error. Example:
>
> $ postmap -q "Subject: ** Tagged as SPAM" regexp:header_checks
> DISCARD
>
> $ postmap -q "Subject: ** Tagged as SPAM" pcre:header_checks
> DISCARD
>
> --
> Greg

I do have both regexp and pcre. It is one line. I've also tried a new
file with just my subject check with the same results.

We tag our spam with ** Tagged as SPAM ** - so I should be able to
search for the whole string or just part of it.

$ postmap -q "Subject: Tagged as SPAM" regexp:header_checks /DISCARD
postmap: warning: regexp map header_checks, line 2: repetition-operator
operand invalid
postmap: fatal: open database /DISCARD.db: No such file or directory

Thx - Steve

swu30@hotmail.com wrote:

> We tag our spam with ** Tagged as SPAM ** - so I should be able to
> search for the whole string or just part of it.
>
> $ postmap -q "Subject: Tagged as SPAM" regexp:header_checks /DISCARD
> postmap: warning: regexp map header_checks, line 2: repetition-operator
> operand invalid
> postmap: fatal: open database /DISCARD.db: No such file or directory



Here is the header_checks file entry:

/^Subject:.*\*\* Tagged as SPAM \*\*/ DISCARD


Here is an example test:

$ postmap -q "Subject: 123** Tagged as SPAM **" regexp:/etc/postfix/header_checks

with a result of:
DISCARD

Greg Hackney wrote:
> swu30@hotmail.com wrote:
>
> > We tag our spam with ** Tagged as SPAM ** - so I should be able to
> > search for the whole string or just part of it.
> >
> > $ postmap -q "Subject: Tagged as SPAM" regexp:header_checks /DISCARD
> > postmap: warning: regexp map header_checks, line 2: repetition-operator
> > operand invalid
> > postmap: fatal: open database /DISCARD.db: No such file or directory
>
>
>
> Here is the header_checks file entry:
>
> /^Subject:.*\*\* Tagged as SPAM \*\*/ DISCARD
>
>
> Here is an example test:
>
> $ postmap -q "Subject: 123** Tagged as SPAM **" regexp:/etc/postfix/header_checks
>
> with a result of:
> DISCARD

Got it. Thanks for the tutorial Greg. It's working like a charm now.

Onto setting up Postgrey...

Thx again!