[Rspamd-Users] regexp operators, how to use?

[Gerald Galster]

> So i added something like this to local.d/multimap.conf
> 
> TEST_REGEX {
> type = "header";
> header = "from";
> map = "$CONFDIR/local.d/test_regex.map";
> description = "testing regex";
> regexp = true;
> score = 5;
> }
> 
> and the map contains:
> 
> /Foo\ Bar &! (foo at bar\.com || foo at bar.org)/iu

This is not regular expression syntax.
If you want to learn it see e.g. https://perldoc.perl.org/perlretut

/Foo\ Bar/ -> space between Foo and Bar is not a special char and
does not have to be escaped with backslash.

&! and || seen as logical operators don't work that way in regular expressions.

'.' means any single char. If you want to match the dot as in
foo at bar\.com you also should escape foo at bar\.org.

If you want "something not followed by", try
/Foo Bar (?!(foo at bar\.com|foo at bar\.org))/
where (?! ...) means not followed by.

Your rspamd probably uses hyperscan for regular expressions, which does
not cover all features of pcre. I don't know if lookahead/behind assertions
are well supported. It is better to keep regular expressions simple and fast.

You could also define multiple maps and use composite symbols if you really have to:
https://rspamd.com/doc/configuration/composites.html

Best regards
Gerald