OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: header_checks.regexp line 6 out of range

From: Wietse Venema (wietseporcupine.org)
Date: Tue Jul 17 2007 - 16:27:30 CDT


mouss:
> > ([^ ]+ +[he]+lo=|[he]+lo +) is $1
> > Doesn't $1 become either "[^ ]+ +[he]+lo=" or "[he]+lo +" depending
> > on which pattern matches?
> >
> > (mydomain\.org) is $2
> >
>
> I've seen that, but for some reason this is not accepted. try pcre or
> use $1 instead of $2.
>
> PS. note that your expression matches
> Received: from blah (blah heeheelo= mydomain.org)
> but not
> Received: from blah (blah helo=mydomain.org)

Sorry, the pattern

/^Received: +from +[^ ]+ +\(([^ ]+ +[he]+lo=|[he]+lo +)(mydomain\.org)\)/

does not match " " after "=".

The original poster's patterns appear to be pasted from the
BACKSCATTER_README file, and the expressions in question are the
same for regexp: or pcre: maps.

Perhaps the original poster is confused about what is line 6.

BTW Postfix 2.1 regexps don't complain when $2 refers to unmatched
text. The warning is generated at compile time, before the rules
are executed.

        Wietse