Forum Discussion

Nimbostratus

Oct 16, 2019

add IP client for SMTP in v13.1: stream::replace not working

HI I try to add the client IP source in the SMTP stream by using this code but it seems the Stream::replace does not work. Could you help please ? output: 220 server1 Frontend ehlo 250...

Nimbostratus

Oct 17, 2019

If i use the following code:

when CLIENT_ACCEPTED {
        set caddr [IP::client_addr]
        log local0. "Client addr: $caddr"
      STREAM::expression {@.*LO.*\r\n@@}
      STREAM::enable
    }
when STREAM_MATCHED {
    set mstring [STREAM::match]
    log local0. "STREAM_MATCHED: string: $mstring"
    set replacment [string range $mstring 0 1]
    append replacment "LO $caddr\r\n"
    log local0. "STREAM_MATCHED: replacement string: $replacment"
    STREAM::replace "$replacment"
    event STREAM_MATCHED enable
}

i don`t have any change in the output

220 Server1 Default Frontend

HELO

250 Server1 Hello [10.1.2.3]

Oct 17 11:15:50 slot1/LB01 info tmm[17518]: Rule /Common/IP_payload_v3 <CLIENT_ACCEPTED>: Client addr: 10.4.5.6

Oct 17 11:15:53 slot1/LB01 info tmm[17518]: Rule /Common/IP_payload_v3 <STREAM_MATCHED>: STREAM_MATCHED: string: HELO

Oct 17 11:15:53 slot1/LB01 info tmm[17518]: Rule /Common/IP_payload_v3 <STREAM_MATCHED>: STREAM_MATCHED: replacement string: HELO 10.4.5.6

boneyard
MVP
Oct 17, 2019
I believe you are working on the wrong side, the way you do it now you modify the request send to the mail server.

you need an event that is triggered when the server returns data, like the HTTP_RESPONSE in some examples.