The problem was multiline rules with rawbody. Changing it
to full and things work. (I missed that little detail in
the wiki, and there are body rules in the dist that have /is)
Request
A rule in-between rawbody/full? I.e. the whole body, but not the
headers? Or even better, in addition to that, plain/html/etc..
scanning only the plain or html part of the body.
/Request
Hell, I'll try to write it if anyone can give me some pointers...
e.g.
* Can you add new targets (header/body/etc) from a plugin.
* Where in the code do I look for the message and all its
parts that is in memory.
I know I'm being lazy, read the code. But hints would be
greatly appreciated.
michael...
