Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 09:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

FileAnalysis: integrate w/ SMTP analyzer.

Browse source 
More generally w/ MIME_Mail messages, which POP3 analyzer also uses.
This commit is contained in:
Jon Siwek 2013-03-18 11:30:59 -05:00
parent 31590fbb9b
commit 550c3c477d
3 changed files with 26 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

1
scripts/base/protocols/smtp/__load__.bro
View file

@ -1,3 +1,4 @@
@load ./main @load ./main
@load ./entities @load ./entities
@load ./entities-excerpt @load ./entities-excerpt
@load ./file-analysis

18
scripts/base/protocols/smtp/file-analysis.bro Normal file
View file

@ -0,0 +1,18 @@
@load ./main
@load ./entities
@load base/utils/conn-ids
@load base/frameworks/file-analysis/main
module SMTP;
function get_file_handle(c: connection, is_orig: bool): string
{
if ( ! c?$smtp ) return "";
return fmt("%s smtp(%s, %s)", c$start_time, c$smtp$trans_depth,
c$smtp_state$mime_level);
}
redef FileAnalysis::handle_callbacks += {
[ANALYZER_SMTP] = get_file_handle,
};

6
src/MIME.cc
View file

@ -5,6 +5,7 @@
#include "Event.h" #include "Event.h"
#include "Reporter.h" #include "Reporter.h"
#include "digest.h" #include "digest.h"
#include "file_analysis/Manager.h"
// Here are a few things to do: // Here are a few things to do:
// //
@ -1019,6 +1020,8 @@ void MIME_Mail::Done()
} }
MIME_Message::Done(); MIME_Message::Done();
file_mgr->EndOfFile(analyzer->Conn());
} }
MIME_Mail::~MIME_Mail() MIME_Mail::~MIME_Mail()
@ -1122,6 +1125,9 @@ void MIME_Mail::SubmitData(int len, const char* buf)
analyzer->ConnectionEvent(mime_segment_data, vl); analyzer->ConnectionEvent(mime_segment_data, vl);
} }
file_mgr->DataIn(reinterpret_cast<const u_char*>(buf), len,
analyzer->Conn(), false); // is_orig param N/A
buffer_start = (buf + len) - (char*)data_buffer->Bytes(); buffer_start = (buf + len) - (char*)data_buffer->Bytes();
} }