Regular Expression help

[glennda]

Just trying to setup a reg ex to modify headers in Zimbra - can anybody see anything wrong with this?

 

thanks in advance!

 

/^Received: from zimbra\-mail1\.domain\.co\.uk .+(by zimbra\-mail1\.domain\.co\.uk .+) / REPLACE Received: $1

[Eric]

Just trying to setup a reg ex to modify headers in Zimbra - can anybody see anything wrong with this?

 

thanks in advance!

 

/^Received: from zimbra\-mail1\.domain\.co\.uk .+(by zimbra\-mail1\.domain\.co\.uk .+) / REPLACE Received: $1

 

I'll bite, though I don't use Zimbra and I'm not even sure if this RE usage is within Zimbra.

 

There is a space after the final ".uk" in the bracketed part of the match (i.e. what you re-use as $1.) Maybe this isn't always there in your input. Also, the final ".+)" in the bracketed match means "match at least one further character, or more." It may well be that you don't know how may characters follow ".uk", or even ".uk[sPACE]" and that sometimes, or always, there are none at all. If you replace ".+" with ".*", then, if this is like the RE systems I have experienced, this will work and mean "zero or more characters."

 

I hope this helped.

[glennda]

Hiya,

 

Thanks for your response - the .+ was to replace further stuff after (the IP below) - I beleive its possible to use Regex with zimbra (I found it on there help site).

 

Basicly I will post what I am trying to replace and it might make more sense - Current zimbra Header

Received: from zimbra-mail1.domain.co.uk (zimbra-mail1.domain.co.uk

[192.168.222.23]) by zimbra-mail1.domain.co.uk (Postfix) with ESMTP id

which shows the internal IP address which i don't want! I would rather it removes this or simply just posts

 

Received: zimbra-mail1.domain.co.uk (Postfix) with ESMTP id

 

Make sense?

[Eric]

TBH I wouldn't worry about your internal IP address - it won't be of any interest to anybody outside your own network. If you would still like to remove it, you could try something like this:

 

match on: /(.*)[1-9]+\.[1-9]+\.[1-9]+\.[1-9]+(.*)/

replace with: /$1$2/

 

Obviously the "/" characters are simply to delineate my regexps: they may not be needed in your application.

[glennda]

its not me that whats to remove it!! At first we thought it was that we had configured it wrong but later can see its a Zimbra "Feature"!!

[Eric]

It's not really a "Zimbra feature." All Mail Transfer Agents (MTA) add lines like these. The intention is that email should be traceable, and to help troubleshooting. Each hop will normally add another line looking somewhat like the one that you want to edit. This collection of "Received:" lines ("timestamps," or "trace fields" in the standards literature (rfc2821)) is invaluable when trouble hits, though it is important to understand that they can be forged along the way. One important use of them is to stop email forwarding loops: every MTA scans incoming messages for its own timestamp - if it finds it, then there is a forwarding loop.

[glennda]

I know each MTA does that - a full header from a Zimbra server has muntiple mentions of itself passing to itself as it goes through various stages before passing externally - one of them being the one which publishes the internal IP rather then an External one - it does later on pass the external IP when it routes to the final destination.

 

For example this is the Zimbra Header parts

 

Received: from zimbra-mail1.mydomain.com ([88.96.72.45]) by

inbound9.messagestream.com with MessageStream Intelligent Transport Agent ;

Thu, 3 May 2012 19:03:36 +0100

Received: from localhost (localhost [127.0.0.1]) by

zimbra-mail1.mydomain.com (Postfix) with ESMTP id 2FA781A3E45 for

; Thu, 3 May 2012 19:03:50 +0100 (BST)

X-Virus-Scanned: amavisd-new at zimbra-mail1.mydomain.com

Received: from zimbra-mail1.mydomain.com ([127.0.0.1]) by localhost

(zimbra-mail1.mydomain.com [127.0.0.1]) (amavisd-new, port 10024) with

ESMTP id pqpY1guLNHsQ for ; Thu, 3 May 2012 19:03:49

+0100 (BST)

Received: from zimbra-mail1.mydomain.com (zimbra-mail1.mydomain.com

[192.168.222.23]) by zimbra-mail1.mydomain.com (Postfix) with ESMTP id

8FC571A3E34 for ; Thu, 3 May 2012 19:03:48 +0100 (BST)

Date: Thu, 3 May 2012 19:03:47 +0100

From: user glennda

[sonofsanta]

Useful link: Regex Tester Online

[Eric]

Surely it's inevitable that you will get the internal IP there, because that's the address the other internal server received it from, inside your own network? The external IP only appears once the message leaves your immediate network.

 

Frankly, there is absolutely no problem revealing the internal IP address of one of your servers. It's meaningless to anyone else.

[glennda]

But its a single server and doesn't forward to any other hosts (direct out) its when it passes it from process to process internally within itself but uses dns to lookup its internally valid FQDN and then routes it to itself (going out and in so putting a duff dns doesn't work) - whereas exchange doesn't it just processes it and sends Edited May 4, 2012 by glennda

[Eric]

That's simply a question of how Zimbra has been put together. The processing steps are done by separate processes, instead of threads, which is probably what Exchange does. Exchange is monolithic and sometimes suffers as a result. Linux programs are usually more loosely-coupled than Windows programs, which can often be beneficial, especially when it comes to understanding what is going on. It really doesn't matter how many Received: lines Zimbra adds: messages crossing the internet can often acquire thirty or more these days.

[glennda]

That's simply a question of how Zimbra has been put together. The processing steps are done by separate processes, instead of threads, which is probably what Exchange does. Exchange is monolithic and sometimes suffers as a result. Linux programs are usually more loosely-coupled than Windows programs, which can often be beneficial, especially when it comes to understanding what is going on. It really doesn't matter how many Received: lines Zimbra adds: messages crossing the internet can often acquire thirty or more these days.

 

Yeah i know - its why i said it was a zimbra "feature" (sarcastically) im not worried by the number of headers just would look neater without an internal IP.