Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-15 13:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: replace script-layer SMTP file analysis.

Browse source 
Notable differences:

- Removed SMTP::MD5 notice.

- Removed ability to specify mime entity excerpt length per mime-type.
This commit is contained in:
Jon Siwek 2013-03-26 15:48:52 -05:00
parent 84a0c2fdac
commit 497496ec83
14 changed files with 224 additions and 206 deletions
Download patch file Download diff file Expand all files Collapse all files

21
testing/btest/scripts/base/protocols/smtp/mime-extract.test
View file

@ -1,24 +1,11 @@
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff smtp_entities.log
# @TEST-EXEC: btest-diff smtp-entity_10.10.1.4:1470-74.53.140.153:25_1.dat
# @TEST-EXEC: btest-diff smtp-entity_10.10.1.4:1470-74.53.140.153:25_2.dat
# @TEST-EXEC: btest-diff smtp-entity-cwR7l6Zctxb-0.dat
# @TEST-EXEC: btest-diff smtp-entity-Ltd7QO7jEv3-1.dat
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT SMTP::extraction_prefix="test"
# @TEST-EXEC: test -e test_10.10.1.4:1470-74.53.140.153:25_1.dat
# @TEST-EXEC: test -e test_10.10.1.4:1470-74.53.140.153:25_2.dat
# @TEST-EXEC: test -e test-cwR7l6Zctxb-0.dat
# @TEST-EXEC: test -e test-Ltd7QO7jEv3-1.dat
@load base/protocols/smtp
redef SMTP::extract_file_types=/text\/plain/;
event bro_init()
{
Log::remove_default_filter(SMTP::ENTITIES_LOG);
Log::add_filter(SMTP::ENTITIES_LOG, [$name="normalized-mime-types",
$pred=function(rec: SMTP::EntityInfo): bool
{
if ( rec?$mime_type )
rec$mime_type = "FAKE_MIME";
return T;
}
]);
}

16
testing/btest/scripts/base/protocols/smtp/mime.test
View file

@ -1,22 +1,6 @@
# Checks logging of mime types and md5 calculation. Mime type in the log
# is normalized to prevent sensitivity to libmagic version.
# @TEST-EXEC: bro -r $TRACES/smtp.trace %INPUT
# @TEST-EXEC: btest-diff smtp_entities.log
@load base/protocols/smtp
redef SMTP::generate_md5=/text\/plain/;
event bro_init()
{
Log::remove_default_filter(SMTP::ENTITIES_LOG);
Log::add_filter(SMTP::ENTITIES_LOG, [$name="normalized-mime-types",
$pred=function(rec: SMTP::EntityInfo): bool
{
if ( rec?$mime_type )
rec$mime_type = "FAKE_MIME";
return T;
}
]);
}