Forum Discussion
silver78
Oct 17, 2019Nimbostratus
If i use the following code:
when CLIENT_ACCEPTED {
set caddr [IP::client_addr]
log local0. "Client addr: $caddr"
STREAM::expression {@.*LO.*\r\n@@}
STREAM::enable
}
when STREAM_MATCHED {
set mstring [STREAM::match]
log local0. "STREAM_MATCHED: string: $mstring"
set replacment [string range $mstring 0 1]
append replacment "LO $caddr\r\n"
log local0. "STREAM_MATCHED: replacement string: $replacment"
STREAM::replace "$replacment"
event STREAM_MATCHED enable
}
i don`t have any change in the output
220 Server1 Default Frontend
HELO
250 Server1 Hello [10.1.2.3]
Oct 17 11:15:50 slot1/LB01 info tmm[17518]: Rule /Common/IP_payload_v3 <CLIENT_ACCEPTED>: Client addr: 10.4.5.6
Oct 17 11:15:53 slot1/LB01 info tmm[17518]: Rule /Common/IP_payload_v3 <STREAM_MATCHED>: STREAM_MATCHED: string: HELO
Oct 17 11:15:53 slot1/LB01 info tmm[17518]: Rule /Common/IP_payload_v3 <STREAM_MATCHED>: STREAM_MATCHED: replacement string: HELO 10.4.5.6
- boneyardOct 17, 2019MVP
I believe you are working on the wrong side, the way you do it now you modify the request send to the mail server.
you need an event that is triggered when the server returns data, like the HTTP_RESPONSE in some examples.