Re: [exim] Loopp through IP addresses in received header

On 2008-01-11 at 09:47 -0600, Craig Jackson wrote:
> I'd like to loop through all of the IP addresses in the received headers
> and check each one to see if that address is in a list of address
> blocks, like 12.23.0.0/16 : 34.56.67.0/24 : 1.6.0.0/8

Exim 4.67 or more recent, to get the map, filter, reduce etc operators?

List of all IP addresses in Received: headers:
${filter{<\n ${sg{$h_received:}{\N(?m:^[^[]+(?:\[([0-9A-Fa-f:.]+)\])?.+$)\N}{\$1}}}{isip{$item}}}

The core of this is:
${sg{$h_received:}{\N(?m:^[^[]+(?:\[([0-9A-Fa-f:.]+)\])?.+$)\N}{\$1}}

If I save your email (the one I'm replying to) to a file called
"fred1.eml" and then run "exim -bem fred1.eml" (for sufficiently recent
Exim to support the -bem option) then I can do:

> ${sg{$h_received:}{\N(?m:^[^[]+(?:\[([0-9A-Fa-f:.]+)\])?.+$)\N}{\$1}}

2001:630:200:8080:204:23ff:fed6:b664
127.0.0.1
72.245.64.135

>

The blank lines are for the outside parts; the filter just reduces this
to IP addresses, removing blank lines and acting as a sanity check
against anything spuriously caught; there's an assumption that all IP
addresses are in square brackets.

You can put your list of address blocks into a "hostlist"; my Exim
config happens to have one called "bad_host_addresses" defined as:
hostlist bad_host_addresses = <; 0.0.0.0 ; 127.0.0.0/8 ; ::
so purely for my own convenience I'll use that as an example for
extracting an address from that list.

${filter{<\n ${filter{<\n ${sg{$h_received:}{\N(?m:^[^[]+(?:\[([0-9A-Fa-f:.]+)\])?.+$)\N}{\$1}}}{isip{$item}}}}{match_ip{$item}{+bad_host_addresses}}}

Testing, I see:
> ${filter{<\n ${filter{<\n ${sg{$h_received:}{\N(?m:^[^[]+(?:\[([0-9A-Fa-f:.]+)\])?.+$)\N}{\$1}}}{isip{$item}}}}{match_ip{$item}{+bad_host_addresses}}}
127.0.0.1
>

Breaking that down, splitting into components for readability, etc, is
left as an exercise for the reader.

Regards,
-Phil