I am looking for some input on the following rules used on SA v3.4.6

header          JR_LOWER_TO             ALL:raw =~      /^to:\s/m
header          JR_LOWER_FROM           ALL:raw =~      /^from:\s/m
header          JR_LOWER_SUBJECT        ALL:raw =~      /^subject:\s/m

Although these have served me well, I do not think they will work on SA v4.0.X since the ALL pseudo-header returns all headers folded.  Is another pragmatic
workaround available?

The "m" multi-line modifier doesn't throw any errors in 4.X.X, but seems
superfluous.  Is this just "do-nothing" deprecated with the ALL pseudo-header?


Thanks,

-- Jared Hall
ja...@jaredsec.com
Available for hire.

Reply via email to