Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Added protocol description functions that provide a super compressed log representation.

Browse source
This commit is contained in:
Seth Hall 2013-07-16 12:01:50 -04:00
parent 4dd4c5344e
commit 0bfdcc1fbc
13 changed files with 190 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

21
scripts/base/protocols/smtp/files.bro
View file

@ -14,6 +14,9 @@ export {
## Default file handle provider for SMTP.
global get_file_handle: function(c: connection, is_orig: bool): string;
## Default file describer for SMTP.
global describe_file: function(f: fa_file): string;
}
function get_file_handle(c: connection, is_orig: bool): string
@ -22,9 +25,25 @@ function get_file_handle(c: connection, is_orig: bool): string
c$smtp_state$mime_depth);
}
function describe_file(f: fa_file): string
{
# This shouldn't be needed, but just in case...
if ( f$source != "SMTP" )
return "";
for ( cid in f$conns )
{
local c = f$conns[cid];
return SMTP::describe(c$smtp);
}
return "";
}
event bro_init() &priority=5
{
Files::register_protocol(Analyzer::ANALYZER_SMTP, SMTP::get_file_handle);
Files::register_protocol(Analyzer::ANALYZER_SMTP,
[$get_file_handle = SMTP::get_file_handle,
$describe = SMTP::describe_file]);
}
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5

31
scripts/base/protocols/smtp/main.bro
View file

@ -72,7 +72,10 @@ export {
## ALL_HOSTS - always capture the entire path.
## NO_HOSTS - never capture the path.
const mail_path_capture = ALL_HOSTS &redef;
## Create an extremely shortened representation of a log line.
global describe: function(rec: Info): string;
global log_smtp: event(rec: Info);
}
@ -268,3 +271,29 @@ event connection_state_remove(c: connection) &priority=-5
if ( c?$smtp )
smtp_message(c);
}
function describe(rec: Info): string
{
if ( rec?$mailfrom && rec?$rcptto )
{
local one_to = "";
for ( to in rec$rcptto )
{
one_to = to;
break;
}
local abbrev_subject = "";
if ( rec?$subject )
{
if ( |rec$subject| > 20 )
{
abbrev_subject = rec$subject[0:20] + "...";
}
}
return fmt("%s -> %s%s%s", rec$mailfrom, one_to,
(|rec$rcptto|>1 ? fmt(" (plus %d others)", |rec$rcptto|-1) : ""),
(abbrev_subject != "" ? fmt(": %s", abbrev_subject) : ""));
}
return "";
}