Community Discussions and Support
Mercury and transaction-level expression filtering

As empty HELO greetings aren't RFC compliant we will probably have Mercury reject them by default in v5. Thanks for pointing this out!

 

<p>As empty HELO greetings aren't RFC compliant we will probably have Mercury reject them by default in v5. Thanks for pointing this out!</p><p> </p>

How to prevent any further communication if a connection comes in with an incomplete HELO/EHLO greeting message?

In this case the HELO/EHLO message is empty. The following snippet was logged: "11:38:06.427: >> EHLO<cr><lf>".


&lt;p&gt;How to prevent any further communication if a connection comes in with an incomplete HELO/EHLO greeting message?&lt;/p&gt;&lt;p&gt;In this case the HELO/EHLO message is empty. The following snippet was logged: &quot;11:38:06.427: &amp;gt;&amp;gt; EHLO&amp;lt;cr&amp;gt;&amp;lt;lf&amp;gt;&quot;.&lt;/p&gt;&lt;p&gt; &lt;/p&gt;

This rule should catch that specific case and add the IP address to the shorttime blacklist:

H,"[EHeh][EHeh]LO??", RS,  "554 Illegal HELO, connection refused."


&lt;p&gt;This rule should catch that specific case and add the IP address to the shorttime blacklist:&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-size: 10pt;&quot;&gt;H,&lt;/span&gt;&quot;[EHeh][EHeh]LO&lt;span style=&quot;font-size: 10pt;&quot;&gt;??&quot;, RS,&amp;nbsp;&amp;nbsp;&quot;554 Illegal HELO, connection refused.&quot;&lt;/span&gt;&lt;/p&gt;&lt;p&gt; &lt;/p&gt;

Hmmm. This does not work. Mercury 4.80beta accepts further commands. I would expect that Mercury refuses the connection.

01:00:14.121: >> EHLO<cr><lf><br></lf></cr>

01:00:14.152: << 250-foo.bar Hello ; ESMTPs are:<cr><lf>250-TIME<cr><lf><br></lf></cr></lf></cr>

01:00:14.152: << 250-SIZE 123456789<cr><lf><br></lf></cr>

01:00:14.152: << 250-STARTTLS<cr><lf><br></lf></cr>

01:00:14.152: << 250 HELP<cr><lf><br></lf></cr>

01:00:31.433: >> MAIL FROM: foobar@foo.bar<cr><lf><br></lf></cr>

01:00:31.433: << 250 Sender OK - send RCPTs.<cr><lf><br></lf></cr>

01:01:01.277: >> RCPT TO: foobar@foo.bar<cr><lf><br></lf></cr>

01:01:01.277: << 250 Recipient OK - send RCPT or DATA.<cr><lf><br></lf></cr>

01:01:11.949: >> DATA<cr><lf><br></lf></cr>

01:01:11.949: << 354 OK, send data, end with CRLF.CRLF<cr><lf><br></lf></cr>

01:01:13.980: >> .<cr><lf><br></lf></cr>

01:01:13.980: << 250 Data received OK.<cr><lf><br></lf></cr>

01:01:17.605: >> QUIT<cr><lf><br></lf></cr>

01:01:17.605: << 221 foo.bar Service closing channel.<cr><lf><br></lf></cr>

01:01:17.605: --- Connection closed normally at 26 Jul 2015, 1:01:17.605. ---

01:01:17.605:

 

 

I will use a work-around until somebody posts a better solution. A test with the following filtering rule works as expected:

M, "*foobar@foo.bar*", RS, "Mail from foobar@foo.bar - Connection refused"

19:15:31.574: >> EHLO<cr><lf><br></lf></cr>

19:15:31.621: << 250-foo.bar Hello ; ESMTPs are:<cr><lf>250-TIME<cr><lf><br></lf></cr></lf></cr>

19:15:31.636: << 250-SIZE 123456789<cr><lf><br></lf></cr>

19:15:31.636: << 250-STARTTLS<cr><lf><br></lf></cr>

19:15:31.636: << 250 HELP<cr><lf><br></lf></cr>

19:15:31.933: << MAIL FROM: foobar@foo.bar<cr><lf><br></lf></cr>

19:15:31.933: << Mail from foobar@foo.bar - Connection refused<cr><lf><br></lf></cr>

19:15:32.246: >> RCPT TO: barfoo@bar.foo<cr><lf><br></lf></cr>

19:15:32.246: << 554 Shunned connection - only the QUIT command will be accepted.<cr><lf><br></lf></cr>

19:15:32.543: >> 

19:15:32.558: --- Connection closed normally at 25 Jul 2015, 19:15:32.558. ---

19:15:32.558:

&lt;p&gt;Hmmm. This does not work. Mercury 4.80beta accepts further commands. I would expect that Mercury refuses the connection.&lt;/p&gt; &lt;p&gt;01:00:14.121: &amp;gt;&amp;gt; EHLO&lt;cr&gt;&lt;lf&gt; 01:00:14.152: &amp;lt;&amp;lt; 250-foo.bar Hello ; ESMTPs are:&lt;cr&gt;&lt;lf&gt;250-TIME&lt;cr&gt;&lt;lf&gt; 01:00:14.152: &amp;lt;&amp;lt; 250-SIZE 123456789&lt;cr&gt;&lt;lf&gt; 01:00:14.152: &amp;lt;&amp;lt; 250-STARTTLS&lt;cr&gt;&lt;lf&gt; 01:00:14.152: &amp;lt;&amp;lt; 250 HELP&lt;cr&gt;&lt;lf&gt; 01:00:31.433: &amp;gt;&amp;gt; MAIL FROM: foobar@foo.bar&lt;cr&gt;&lt;lf&gt; 01:00:31.433: &amp;lt;&amp;lt; 250 Sender OK - send RCPTs.&lt;cr&gt;&lt;lf&gt; 01:01:01.277: &amp;gt;&amp;gt; RCPT TO: foobar@foo.bar&lt;cr&gt;&lt;lf&gt; 01:01:01.277: &amp;lt;&amp;lt; 250 Recipient OK - send RCPT or DATA.&lt;cr&gt;&lt;lf&gt; 01:01:11.949: &amp;gt;&amp;gt; DATA&lt;cr&gt;&lt;lf&gt; 01:01:11.949: &amp;lt;&amp;lt; 354 OK, send data, end with CRLF.CRLF&lt;cr&gt;&lt;lf&gt; 01:01:13.980: &amp;gt;&amp;gt; .&lt;cr&gt;&lt;lf&gt; 01:01:13.980: &amp;lt;&amp;lt; 250 Data received OK.&lt;cr&gt;&lt;lf&gt; 01:01:17.605: &amp;gt;&amp;gt; QUIT&lt;cr&gt;&lt;lf&gt; 01:01:17.605: &amp;lt;&amp;lt; 221 foo.bar Service closing channel.&lt;cr&gt;&lt;lf&gt; 01:01:17.605: --- Connection closed normally at 26 Jul 2015, 1:01:17.605. --- 01:01:17.605:&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt; &lt;p&gt;&amp;nbsp;&lt;/p&gt; &lt;p&gt;I will use a work-around until somebody posts a better solution. A test with the following filtering rule works as expected:&lt;/p&gt; &lt;p&gt;M, &quot;*foobar@foo.bar*&quot;, RS, &quot;Mail from foobar@foo.bar - Connection refused&quot;&lt;/p&gt; &lt;p&gt;19:15:31.574: &amp;gt;&amp;gt; EHLO&lt;cr&gt;&lt;lf&gt; 19:15:31.621: &amp;lt;&amp;lt; 250-foo.bar Hello ; ESMTPs are:&lt;cr&gt;&lt;lf&gt;250-TIME&lt;cr&gt;&lt;lf&gt; 19:15:31.636: &amp;lt;&amp;lt; 250-SIZE 123456789&lt;cr&gt;&lt;lf&gt; 19:15:31.636: &amp;lt;&amp;lt; 250-STARTTLS&lt;cr&gt;&lt;lf&gt; 19:15:31.636: &amp;lt;&amp;lt; 250 HELP&lt;cr&gt;&lt;lf&gt; 19:15:31.933: &amp;lt;&amp;lt; MAIL FROM: foobar@foo.bar&lt;cr&gt;&lt;lf&gt; 19:15:31.933: &amp;lt;&amp;lt; Mail from foobar@foo.bar - Connection refused&lt;cr&gt;&lt;lf&gt; 19:15:32.246: &amp;gt;&amp;gt; RCPT TO: barfoo@bar.foo&lt;cr&gt;&lt;lf&gt; 19:15:32.246: &amp;lt;&amp;lt; 554 Shunned connection - only the QUIT command will be accepted.&lt;cr&gt;&lt;lf&gt; 19:15:32.543: &amp;gt;&amp;gt;&amp;nbsp; 19:15:32.558: --- Connection closed normally at 25 Jul 2015, 19:15:32.558. --- 19:15:32.558:&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/lf&gt;&lt;/cr&gt;&lt;/p&gt;

Damn, I made a config failure. After changing the rule position your posted rule works now...
 
15:00:25.347: --- 30 Jul 2015, 15:00:25.347 ---
15:00:25.363: Accepted connection from '222.124.200.250', timeout 60 seconds.
15:00:25.378: Connection from 222.124.200.250, Thu Jul 30 15:00:25 2015<lf>
15:00:25.378: << 220-foo.bar ESMTP server ready.<cr><lf>
15:00:25.722: >> EHLO<cr><lf>
15:00:25.753: << 554 Illegal HELO, connection refused.<cr><lf>
15:00:26.081: >> 
15:00:26.081: --- Connection closed normally at 30 Jul 2015, 15:00:26.081. ---
15:00:26.081: 

&lt;div&gt;Damn, I made a config failure. After changing the rule position your posted rule&lt;span style=&quot;font-size: 10pt; font-family: Tahoma, Arial, Helvetica;&quot;&gt;&amp;nbsp;works now...&lt;/span&gt;&lt;/div&gt;&lt;div&gt;&amp;nbsp;&lt;/div&gt;&lt;div&gt;15:00:25.347: --- 30 Jul 2015, 15:00:25.347 ---&lt;/div&gt;&lt;div&gt;15:00:25.363: Accepted connection from &#039;222.124.200.250&#039;, timeout 60 seconds.&lt;/div&gt;&lt;div&gt;15:00:25.378: Connection from 222.124.200.250, Thu Jul 30 15:00:25 2015&amp;lt;lf&amp;gt;&lt;/div&gt;&lt;div&gt;15:00:25.378: &amp;lt;&amp;lt; 220-foo.bar ESMTP server ready.&amp;lt;cr&amp;gt;&amp;lt;lf&amp;gt;&lt;/div&gt;&lt;div&gt;15:00:25.722: &amp;gt;&amp;gt; EHLO&amp;lt;cr&amp;gt;&amp;lt;lf&amp;gt;&lt;/div&gt;&lt;div&gt;15:00:25.753: &amp;lt;&amp;lt; 554 Illegal HELO, connection refused.&amp;lt;cr&amp;gt;&amp;lt;lf&amp;gt;&lt;/div&gt;&lt;div&gt;15:00:26.081: &amp;gt;&amp;gt;&amp;nbsp;&lt;/div&gt;&lt;div&gt;15:00:26.081: --- Connection closed normally at 30 Jul 2015, 15:00:26.081. ---&lt;/div&gt;&lt;div&gt;15:00:26.081:&amp;nbsp;&lt;/div&gt;&lt;div&gt; &lt;/div&gt;
live preview
enter atleast 10 characters
WARNING: You mentioned %MENTIONS%, but they cannot see this message and will not be notified
Saving...
Saved
With selected deselect posts show selected posts
All posts under this topic will be deleted ?
Cancel
Delete
Pending draft ... Click to resume editing
Discard draft