Negative look ahead with capturing using pcre

[Erik Nørgaard]

Hi:

I am trying to write some rules for filtering email with postfix header
rules. In particular, I'd like to discard anything in a character set I
don't understand, or rather accept ascii, iso-8859-* and utf-8.

So I have created the following rule for mime header checks:

/^Content-Type:.*?charset\s*=\s*"?(?!us-ascii|iso-8859-\d+|utf-8)(.*?)"?.*$/i
    WARN   MHD1000 Invalid charset: "$1". Use UTF-8 or ISO-8859-X

I have two problems:

First: This rule catches a lot of legitimate mail, ascii or iso
character sets

Secondly: I'd like to catch the character set that is rejected so I can
adjust it if legitimate mail gets blocked. In the above I don't allow
windows-1252 for example.

So, how do I do negative look ahead with capturing using pcre?

Thanks, Erik

-- 
Ph: +34.666334818                                  web: www.locolomo.org
S/MIME Certificate: www.daemonsecurity.com/ca/8D03551FFCE04F06.crt
Subject ID:  9E:AA:18:E6:94:7A:91:44:0A:E4:DD:87:73:7F:4E:82:E7:08:9C:72
Fingerprint: 5B:D5:1E:3E:47:E7:EC:1C:4C:C8:3A:19:CC:AE:14:F5:DF:18:0F:B9