Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Basic IMAP StartTLS analyzer.

Browse source 
Parses certificates out of imap connections using StartTLS. Aborts
processing if StartTLS is not found.
This commit is contained in:
Johanna Amann 2015-07-22 10:35:49 -07:00
parent 871b340ade
commit 4a5737708c
17 changed files with 331 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/protocols/imap/README Normal file
View file

@ -0,0 +1,5 @@
Support for the Internet Message Access Protocol (IMAP).
Note that currently the IMAP analyzer only supports analyzing IMAP sessions
until they do or do not switch to TLS using StartTLS. Hence, we do not get
mails from IMAP sessions, only X509 certificates.

2
scripts/base/protocols/imap/__load__.bro Normal file
View file

@ -0,0 +1,2 @@
@load ./main

11
scripts/base/protocols/imap/main.bro Normal file
View file

@ -0,0 +1,11 @@
module IMAP;
const ports = { 143/tcp };
redef likely_server_ports += { ports };
event bro_init() &priority=5
{
Analyzer::register_for_ports(Analyzer::ANALYZER_IMAP, ports);
}