Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Merge remote-tracking branch 'origin/topic/awelzel/3264-smtp-bdat'

Browse source 
* origin/topic/awelzel/3264-smtp-bdat:
  btest/smtp: Test with smtp-bdat-pipeline-8bitmime.pcap
  SMTP: Add BDAT support
This commit is contained in:
Arne Welzel 2024-01-12 10:48:33 +01:00
commit 2182ec03b3
43 changed files with 791 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/protocols/smtp/main.zeek
View file

@ -247,13 +247,21 @@ event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &
c$smtp_state$trans_mail_from_seen = T;
c$smtp_state$trans_rcpt_to_seen = F; # Reset state on MAIL FROM
}
else if ( upper_command == "DATA" )
else if ( upper_command == "DATA" || upper_command == "BDAT" )
{
if ( mail_transaction_validation )
{
if ( ! c$smtp_state$trans_rcpt_to_seen ) # mail from checked in rctp to
mail_transaction_invalid(c, "data missing rcpt to");
}
if ( upper_command == "BDAT" && ends_with(arg, " LAST") )
{
# Reset state mail transaction state when we're seeing
# the last BDAT command.
c$smtp_state$trans_mail_from_seen = F;
c$smtp_state$trans_rcpt_to_seen = F;
}
}
else if ( upper_command == "." )
{