Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

btest: Add tests for full email extraction

Browse source
This commit is contained in:
cccs-jsjm 2025-07-14 21:38:47 +02:00 • committed by Arne Welzel
parent 4c60dfd6c5
commit 1b3b3892b5
11 changed files with 147 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

22
testing/btest/scripts/base/protocols/smtp/rfc822-msg-file-analysis-binary.test Normal file
View file

@ -0,0 +1,22 @@
# @TEST-DOC: Test case for extracting a mail that has non-ascii text in the mail portion of the file.
#
# @TEST-EXEC: zeek -C -b -r $TRACES/smtp/rfc3030-bdat-nonascii.pcap %INPUT
# @TEST-EXEC: zeek-cut -m fuid uid mime_type seen_bytes parent_fuid sha1 < files.log > files.cut
# @TEST-EXEC: btest-diff files.cut
# @TEST-EXEC: btest-diff --binary extract_files/mail
# @TEST-EXEC: grep -q "[^\x00-\x7f]" extract_files/mail
@load base/files/hash
@load base/files/extract
@load base/protocols/smtp
redef SMTP::enable_rfc822_msg_file_analysis = T;
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( f$id == c$smtp$rfc822_msg_fuid )
{
Files::add_analyzer(f, Files::ANALYZER_SHA1);
Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename="mail"]);
}
}

20
testing/btest/scripts/base/protocols/smtp/rfc822-msg-file-analysis-multi-mail.test Normal file
View file

@ -0,0 +1,20 @@
# @TEST-DOC: Test case for extracting multiple mails from the same SMTP session.
#
# @TEST-EXEC: zeek -C -b -r $TRACES/smtp/smtp-bdat-pipeline-8bitmime.pcap %INPUT
# @TEST-EXEC: zeek-cut -m fuid uid mime_type seen_bytes parent_fuid sha1 < files.log > files.cut
# @TEST-EXEC: btest-diff files.cut
@load base/files/hash
@load base/files/extract
@load base/protocols/smtp
redef SMTP::enable_rfc822_msg_file_analysis = T;
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( f$id == c$smtp$rfc822_msg_fuid )
{
Files::add_analyzer(f, Files::ANALYZER_EXTRACT);
Files::add_analyzer(f, Files::ANALYZER_SHA1);
}
}

17
testing/btest/scripts/base/protocols/smtp/rfc822-msg-file-analysis-multi-session.test Normal file
View file

@ -0,0 +1,17 @@
# @TEST-DOC: Test case for analyzing RFC822 messages from multiple SMTP sessions.
#
# @TEST-EXEC: zeek -C -b -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: zeek-cut -m fuid uid mime_type seen_bytes parent_fuid sha1 < files.log > files.cut
# @TEST-EXEC: btest-diff files.cut
@load base/files/hash
@load base/files/extract
@load base/protocols/smtp
redef SMTP::enable_rfc822_msg_file_analysis = T;
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( f$id == c$smtp$rfc822_msg_fuid )
Files::add_analyzer(f, Files::ANALYZER_SHA1);
}

21
testing/btest/scripts/base/protocols/smtp/rfc822-msg-file-analysis.test Normal file
View file

@ -0,0 +1,21 @@
# @TEST-DOC: Test case for extracting a mail that contains attachments.
#
# @TEST-EXEC: zeek -C -b -r $TRACES/smtp-attachment-msg.pcap %INPUT
# @TEST-EXEC: zeek-cut -m fuid uid mime_type seen_bytes parent_fuid sha1 < files.log > files.cut
# @TEST-EXEC: btest-diff files.cut
# @TEST-EXEC: btest-diff --binary extract_files/mail
@load base/files/hash
@load base/files/extract
@load base/protocols/smtp
redef SMTP::enable_rfc822_msg_file_analysis = T;
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
{
if ( f$id == c$smtp$rfc822_msg_fuid )
{
Files::add_analyzer(f, Files::ANALYZER_SHA1);
Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename="mail"]);
}
}