From 3b8c7ad8bbd2eaa1228b6c90de0f0de55acbb3c1 Mon Sep 17 00:00:00 2001 From: pavlov Date: Mon, 19 Nov 2007 23:07:00 +0000 Subject: update stripped subset of l7 patterns to 11-03-2007 patterns git-svn-id: svn://svn.openwrt.org/openwrt/trunk@9582 3c298f89-4303-0410-b956-a3cf2f4a3e73 --- package/iptables/files/l7/smtp.pat | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) (limited to 'package/iptables/files/l7/smtp.pat') diff --git a/package/iptables/files/l7/smtp.pat b/package/iptables/files/l7/smtp.pat index 1bab7a1df..eb98ae72f 100644 --- a/package/iptables/files/l7/smtp.pat +++ b/package/iptables/files/l7/smtp.pat @@ -1,22 +1,17 @@ # SMTP - Simple Mail Transfer Protocol - RFC 2821 (See also RFC 1869) -# Pattern quality: great fast +# Pattern attributes: great notsofast fast +# Protocol groups: mail ietf_internet_standard +# Wiki: http://www.protocolinfo.org/wiki/SMTP +# # usually runs on port 25 # -# This pattern has been tested and is believed to work well. If it does not -# work for you, or you believe it could be improved, please post to -# l7-filter-developers@lists.sf.net . This list may be subscribed to at -# http://lists.sourceforge.net/lists/listinfo/l7-filter-developers +# This pattern has been tested and is believed to work well. -smtp # As usual, no text is required after "220", but all known servers have some # there. It (almost?) always has string "smtp" in it. The RFC examples # does not, so we match those too, just in case anyone has copied them # literally. -^220[\x09-\x0d -~]* (e?smtp|simple mail) - -# This is ~3x faster if the stream starts with "220" -#^220.* (e?smtp|simple mail) - +# # Some examples: # 220 mail.stalker.com ESMTP CommuniGate Pro 4.1.3 # 220 mail.vieodata.com ESMTP Merak 6.1.0; Mon, 15 Sep 2003 13:48:11 -0400 @@ -37,3 +32,8 @@ smtp # RFC examples: # 220 xyz.com Simple Mail Transfer Service Ready (RFC example) # 220 dbc.mtview.ca.us SMTP service ready + +smtp +^220[\x09-\x0d -~]* (e?smtp|simple mail) +userspace pattern=^220[\x09-\x0d -~]* (E?SMTP|[Ss]imple [Mm]ail) +userspace flags=REG_NOSUB REG_EXTENDED -- cgit v1.2.3