Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

SMTP: Adapt scripts for enable_rfc822_msg_file_analysis

Browse source 
Specifically, set a MIME part's parent_id to the rfc822_msg_fuid if it
is set and take into account the current rfc822_msg_fuid for describe_file()
to avoid fuid collisions of the top-level RFC822 message and the first
MIME part.
This commit is contained in:
Arne Welzel 2025-07-16 11:25:55 +02:00
parent a42875d033
commit 4c60dfd6c5
8 changed files with 3013 additions and 2980 deletions
Download patch file Download diff file Expand all files Collapse all files

32
scripts/base/protocols/smtp/files.zeek
View file

@ -10,6 +10,10 @@ export {
## An ordered vector of file unique IDs seen attached to
## the message.
fuids: vector of string &log &default=string_vec();
## Tracks the fuid of the top-level RFC822 mail message if
## :zeek:see:`SMTP::enable_rfc822_msg_file_analysis` is set.
rfc822_msg_fuid: string &optional;
};
## Default file handle provider for SMTP.
@ -21,7 +25,11 @@ export {
function get_file_handle(c: connection, is_orig: bool): string
{
# Adding rfc822_msg_fuid here if set to ensure the top-level mail
# message and the first MIME attachment do not get the same fuid allocated
# when :zeek:see:`SMTP::enable_rfc822_msg_file_analysis` is set.
return cat(Analyzer::ANALYZER_SMTP, c$start_time, c$smtp$trans_depth,
c$smtp?$rfc822_msg_fuid ? c$smtp$rfc822_msg_fuid : "",
c$smtp_state$mime_depth);
}
@ -48,5 +56,29 @@ event zeek_init() &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( c?$smtp && !c$smtp$tls )
{
c$smtp$fuids += f$id;
# If top-level messages are passed to the file analysis
# framework, the first file within a SMTP transaction is
# always the top-level RFC822 message. Keep track of it.
#
# This allows users to implement a low priority file_over_new_connection()
# event and check for f$id == c$smtp$rfc822_msg_fuid to attach analyzers
# to the RFC822 message specifically.
if ( SMTP::enable_rfc822_msg_file_analysis )
{
if ( ! c$smtp?$rfc822_msg_fuid )
c$smtp$rfc822_msg_fuid = f$id;
else
{
# This is a file representing part of the RFC822
# message (e.g. the body or a MIME part). If it
# does not yet have a parent, attach the RFC822
# fuid as the parent.
if ( ! f?$parent_id )
f$parent_id = c$smtp$rfc822_msg_fuid;
}
}
}
}