For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Josh_Hildebran1's avatar
Josh_Hildebran1
Icon for Nimbostratus rankNimbostratus
Jul 11, 2006

SMTP EHLO response

I'd like to make an iRule that looks for a "EHLO " command and simply responds w/ a particular error message. I've tried to piece together something, but I've come up short, apparently. Can anyon...
application delivery
dev
devops
iRules
rapmaster_c_127's avatar
rapmaster_c_127
Historic F5 Account
Jul 13, 2006
Try this:


rule FixUP-SMTP {
   when SERVER_CONNECTED {
        peer { TCP::collect }
    }
    when CLIENT_DATA {
        if { [TCP::payload] starts_with "EHLO" } {
            TCP::respond "500 5.3.3 Unrecognized command\r\n"
            set len [TCP::payload length]
            TCP::payload replace 0 $len ""
            TCP::release
        } else {
           TCP::release
           TCP::collect
        }
    }
}

You might want to disable the rule after it has fired the first time, or after you see the DATA method in order to prevent parsing payload. Up to you, but you get the general idea.