On Tue, Jan 27, 2004 at 06:01:35PM +0800, Mark Fordham wrote:
> body ,^Content-Type: application.* name=".*\.(scr|com|bat|pif|lnk|exe)",i
The way you use '|' requires an extended regular expression, so
make it
body ,^Content-Type: ... name=".*\.(scr|com|bat|pif|lnk|exe)",ie
^
(note the additional 'e' flag at the end)
Optionally, the following flags can be used after the closing
delimiter:
e Extended regular expression. This sets REG_EXTENDED for
regcomp(3).
>From regcomp(3)
REG_EXTENDED Compile modern (``extended'') REs, rather than the
obsolete (``basic'') REs that are the default.
>From re_format(7)
Obsolete (``basic'') regular expressions differ in several respects.
`|', `+', and `?' are ordinary characters and there is no equivalent
for their functionality.
This isn't really related to pf, so just follow-up to me personally if
you have further questions :)
Daniel
