SMTP-S Regular Expression Search for Square Brackets Within HELO

MikeGlen

posted Jan 17 '13 at 2:56 pm

Thank you All,

I'm going to try a few of your suggestions and report back later - watch this space!

Regards

Thank you All,I'm going to try a few of your suggestions and report back later - watch this space!Regards&nbsp;

MikeGlen

posted Jan 15 '13 at 5:37 pm

Hi Everyone,

Does anyone know how to search for square brackets using a regular expression?

I'm trying to block the following type of HELO greeting:

EHLO [190.122.125.138]

I have used [Z-a] to successfully capture "[" and "]" characters, but to me this is a bit of a fudge. Using [[] or []] doesn't work.

This is what I use at present, and it works, but I want improve it:

H, "[heHE][heHE]LO/w[Z-a][0-9]+.[0-9]+.[0-9]+.[0-9]+[Z-a]/w", L, "CAUGHT DOTTED IP WITH SQ BRACKETS IN HELO USING Z-a"

So, does anyone know if it is possible to search for "[" or "]" perhaps by using an escape command (if one exists)?

Thanks in advance :)

Hi Everyone,&nbsp;Does anyone know how to search for square brackets using a regular expression?&nbsp;I'm trying to block the following type of HELO greeting:EHLO [190.122.125.138]I have used [Z-a] to successfully capture "[" and "]" characters, but to me this is a bit of a fudge. Using [[] or []] doesn't work.This is what I use at present, and it works, but I want improve it:&nbsp;H, "[heHE][heHE]LO/w[Z-a][0-9]+.[0-9]+.[0-9]+.[0-9]+[Z-a]/w", L, "CAUGHT DOTTED IP WITH SQ BRACKETS IN HELO USING Z-a"So, does anyone know if it is possible to search for "[" or "]" perhaps by using an escape command (if one exists)?Thanks in advance :)&nbsp;

jef_b

posted Jan 16 '13 at 5:54 pm

You have to use a preceding backslash to match a metacharacter litteraly (square brackets are metacharacters ; they have a specific meaning in a regular expression).

\[ will select the square bracket [

To select litteraly EHLO [192.168.0.1] you can use the regular expression EHLO \[192\.168\.0\.1\]

To select EHLO [ with any valid IPV4 adres ] you can use the regular expression EHLO \[\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b\]

grz

jef_b

You have to use a preceding backslash to match a metacharacter litteraly (square brackets are metacharacters ; they have a specific meaning in a regular expression).\[ will select the square bracket [ To select litteraly&nbsp; &nbsp; &nbsp;&nbsp; EHLO [192.168.0.1] &nbsp; &nbsp; &nbsp; you can use the regular expression&nbsp;&nbsp; &nbsp; &nbsp; EHLO \[192\.168\.0\.1\]To select &nbsp; &nbsp; &nbsp; EHLO [ with any valid IPV4 adres ] &nbsp; &nbsp; &nbsp; you can use the regular expression&nbsp;&nbsp; &nbsp; &nbsp; EHLO \[\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b\]&nbsp;grzjef_b

FJR

posted Jan 16 '13 at 6:35 pm

On help there is no way to masquerade the "]". And the "H" in front of the transaction-rule means, that the rule should apply to HELO or EHLO.

Tested this with a telnet connection on port 25 and worked:

H, "*[[][0-9]+.[0-9]+.[0-9]+.[0-9]+*", L, "CAUGHT DOTTED IP WITH SQ BRACKETS IN HELO USING OPENING BRACKET"

bye

On help there is no way to masquerade the "]". And the "H" in front of the transaction-rule means, that the rule should apply to HELO or EHLO. Tested this with a telnet connection on port 25 and worked:H, "*[[][0-9]+.[0-9]+.[0-9]+.[0-9]+*", L, "CAUGHT DOTTED IP WITH SQ BRACKETS IN HELO USING OPENING BRACKET"bye

FJR

posted Jan 16 '13 at 6:42 pm

[quote user="jef_b"]

You have to use a preceding backslash to match a metacharacter litteraly (square brackets are metacharacters ; they have a specific meaning in a regular expression).

\[ will select the square bracket [

[/quote]

Shure? With Mercury (or Pegasus)?

That's what to do in regular expressions i.e. in PERL or UNIX. But the help of Mercury talks about including metacharacters like *,?,[ in brackets. The problem with the masquerading in Mercury / Pegasus is the ], because this ends up the masquerading and you can't masquerade it that way.

Bye

[quote user="jef_b"]You have to use a preceding backslash to match a metacharacter litteraly (square brackets are metacharacters ; they have a specific meaning in a regular expression).\[ will select the square bracket [ [/quote]Shure? With Mercury (or Pegasus)?That's what to do in regular expressions i.e. in PERL or UNIX. But the help of Mercury talks about including metacharacters like *,?,[ in brackets. The problem with the masquerading in Mercury / Pegasus is the ], because this ends up the masquerading and you can't masquerade it that way. Bye&nbsp;

PaulW

posted Jan 16 '13 at 6:50 pm

[quote user="FJR"]... But the help of Mercury talks about including metacharacters like *,?,[ in brackets. The problem with the masquerading in Mercury / Pegasus is the ], because this ends up the masquerading and you can't masquerade it that way.[/quote]

Do you need to escape ] ? On it's own (without a preceeding [ ) it can be treated literally.

[quote user="FJR"]... But the help of Mercury talks about including metacharacters like *,?,[ in brackets. The problem with the masquerading in Mercury / Pegasus is the ], because this ends up the masquerading and you can't masquerade it that way.[/quote] Do you need to escape ] ?&nbsp; On it's own (without a preceeding [ ) it can be treated literally.

FJR

posted Jan 16 '13 at 7:03 pm

[quote user="PaulW"]

Do you need to escape ] ? On it's own (without a preceeding [ ) it can be treated literally.

[/quote]

Ohh ... in all my years with Pegasus and Mercury I didn't realize this! Good tip - reads logical! Thanks!

So on question of MikeGlen this should work (not tested yet):

H, "*[[][0-9]+.[0-9]+.[0-9]+.[0-9]+]*", L, "CAUGHT DOTTED IP WITH SQ BRACKETS IN HELO USING BOTH BRACKETS"

bye

[quote user="PaulW"]Do you need to escape ] ?&nbsp; On it's own (without a preceeding [ ) it can be treated literally.[/quote]Ohh ... in all my years with Pegasus and Mercury I didn't realize this! Good tip - reads logical! Thanks!So on question of MikeGlen this should work (not tested yet):H, "*[[][0-9]+.[0-9]+.[0-9]+.[0-9]+]*", L, "CAUGHT DOTTED IP WITH SQ BRACKETS IN HELO USING BOTH BRACKETS"bye&nbsp;

Related Topics

Pending draft

Confirm move posts

Insufficient permissions

Select a different topic

Edit history