Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 17:18:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Slightly earlier protocol confirmation for pop3.

Browse source 
This allows, e.g. pop3 sessions that are upgraded via STLS to be
properly marked as such.
This commit is contained in:
Johanna Amann 2015-07-23 16:53:01 -07:00
parent 0d60da7ae6
commit 5ffe76f336
3 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/pop3/POP3.cc
View file

@ -720,14 +720,16 @@ void POP3_Analyzer::ProcessReply(int length, const char* line)
break; break;
} }
case CAPA:
ProtocolConfirmation();
case UIDL: case UIDL:
case LIST: case LIST:
case CAPA:
if (requestForMultiLine == true) if (requestForMultiLine == true)
multiLine = true; multiLine = true;
break; break;
case STLS: case STLS:
ProtocolConfirmation();
tls = true; tls = true;
StartTLS(); StartTLS();
return; return;

10
testing/btest/Baseline/scripts.base.protocols.pop3.starttls/conn.log Normal file
View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open 2015-07-23-23-52-44
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1400173552.423915 CXWv6p3arKYeMETxOg 192.168.4.149 54775 192.168.4.149 110 tcp pop3,ssl 2.489002 851 2590 SF - - 0 ShAadDfFr 16 1695 17 3462 (empty)
#close 2015-07-23-23-52-44

2
testing/btest/scripts/base/protocols/pop3/starttls.bro
View file

@ -1,8 +1,10 @@
# @TEST-EXEC: bro -C -b -r $TRACES/tls/pop3-starttls.pcap %INPUT # @TEST-EXEC: bro -C -b -r $TRACES/tls/pop3-starttls.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ssl.log # @TEST-EXEC: btest-diff ssl.log
# @TEST-EXEC: btest-diff x509.log # @TEST-EXEC: btest-diff x509.log
@load base/protocols/conn @load base/protocols/conn
@load base/frameworks/dpd
@load base/protocols/ssl @load base/protocols/ssl
module POP3; module POP3;