Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 19:48:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

SMTP: Adapt scripts for SMTP::enable_mail_data_file_analysis

Browse source 
Specifically, set a file's parent_id to the mail_fuid if that's
set and take into account the current mail_fuid for describe_file()
to avoid fuid collisions of top-level mail and mime attachments.
This commit is contained in:
Arne Welzel 2025-07-14 21:04:20 +02:00
parent c34b2eb5aa
commit 6061c9c542
8 changed files with 3000 additions and 2981 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/base/protocols/smtp/files.zeek
View file

@ -10,6 +10,10 @@ export {
## An ordered vector of file unique IDs seen attached to
## the message.
fuids: vector of string &log &default=string_vec();
## Tracks the fuid of the mail message if
## :zeek:see:`SMTP::enable_mail_data_file_analysis` is set.
mail_fuid: string &optional;
};
## Default file handle provider for SMTP.
@ -19,10 +23,17 @@ export {
global describe_file: function(f: fa_file): string;
}
event smtp_mail_data_file(f: fa_file, c: connection)
{
c$smtp$mail_fuid = f$id;
}
function get_file_handle(c: connection, is_orig: bool): string
{
# Adding mail_fuid here if set to ensure the top-level mail message
# and the first MIME attachment do not get the same fuid allocated.
return cat(Analyzer::ANALYZER_SMTP, c$start_time, c$smtp$trans_depth,
c$smtp_state$mime_depth);
c$smtp?$mail_fuid ? c$smtp$mail_fuid : "", c$smtp_state$mime_depth);
}
function describe_file(f: fa_file): string
@ -48,5 +59,12 @@ event zeek_init() &priority=5
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( c?$smtp && !c$smtp$tls )
{
c$smtp$fuids += f$id;
# If the file doesn't yet have a parent and the top-level
# mail is being sent to file analysis, use its id as parent.
if ( ! f?$parent_id && c$smtp?$mail_fuid )
f$parent_id = c$smtp$mail_fuid;
}
}