Mailing List Archive

smtp_expn.nasl regex change
The regex lines for the smtp_expn.nasl needs to be modfied to adequately
report on some SMTP servers that are sending 550- or 250- results rather
than "550 <result>" etc.

Line 110:
if(ereg(string:r, pattern:"^(250|550).*$"))

Line 125:
if(ereg(string:r, pattern:"^(250|550).*$"))

Note the removal of the space from 550).*$ )

--
..:[ grutz at jingojango dot net ]:..
GPG fingerprint: 5FD6 A27D 63DB 3319 140F B3FB EC95 2A03 8CB3 ECB4
"There's just no amusing way to say, 'I have a CISSP'."
Re: smtp_expn.nasl regex change [ In reply to ]
RFC821:

The format for multiline replies requires that every line,
except the last, begin with the reply code, followed
immediately by a hyphen, "-" (also known as minus), followed by

For example:
123-First line
123-Second line
123-234 text beginning with numbers
123 The last line

In many cases the sender-SMTP then simply needs to search for
the reply code followed by <SP> at the beginning of a line, and
ignore all preceding lines. In a few cases, there is important
data for the sender in the reply "text". The sender will know
these cases from the current context.

On Thu, Apr 21, 2005 at 10:21:19AM -0400, Thomas Reinke brazenly wrote:
> Isn't the '-' (e.g. 550-) an incomplete line indicator meaning
> that there will be a follow up line with a '550 ' (550 space)
> following it? Same with 250?
>
> Thomas
>
> Kurt Grutzmacher wrote:
> >The regex lines for the smtp_expn.nasl needs to be modfied to adequately
> >report on some SMTP servers that are sending 550- or 250- results rather
> >than "550 <result>" etc.
> >
> >Line 110:
> > if(ereg(string:r, pattern:"^(250|550).*$"))
> >
> >Line 125:
> > if(ereg(string:r, pattern:"^(250|550).*$"))
> >
> >Note the removal of the space from 550).*$ )
> >
>

--
..:[ grutz at jingojango dot net ]:..
GPG fingerprint: 5FD6 A27D 63DB 3319 140F B3FB EC95 2A03 8CB3 ECB4
"There's just no amusing way to say, 'I have a CISSP'."
Re: smtp_expn.nasl regex change [ In reply to ]
On Wed Apr 20 2005 at 17:14, Kurt Grutzmacher wrote:

> The regex lines for the smtp_expn.nasl

sendmail_expn.nasl ?

> needs to be modfied to adequately
> report on some SMTP servers that are sending 550- or 250- results rather
> than "550 <result>" etc.

I've also seen broken servers which did not include a space after the
3 digit code. Maybe we should handle this too.