Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 23:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add smtp starttls support

Browse source
This commit is contained in:
Bernhard Amann 2014-05-15 09:57:01 -07:00
parent 746c073729
commit 6bc914458b
10 changed files with 94 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

4
scripts/base/protocols/smtp/files.bro
View file

@ -41,13 +41,13 @@ function describe_file(f: fa_file): string
event bro_init() &priority=5
{
Files::register_protocol(Analyzer::ANALYZER_SMTP,
Files::register_protocol(Analyzer::ANALYZER_SMTP,
[$get_file_handle = SMTP::get_file_handle,
$describe = SMTP::describe_file]);
}
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( c?$smtp )
if ( c?$smtp && !c$smtp$tls )
c$smtp$fuids[|c$smtp$fuids|] = f$id;
}

11
scripts/base/protocols/smtp/main.bro
View file

@ -49,7 +49,10 @@ export {
path: vector of addr &log &optional;
## Value of the User-Agent header from the client.
user_agent: string &log &optional;
## Indicates that the connection has switched to using TLS
tls: bool &default=F;
## Indicates if the "Received: from" headers should still be
## processed.
process_received_from: bool &default=T;
@ -276,6 +279,12 @@ event connection_state_remove(c: connection) &priority=-5
smtp_message(c);
}
event smtp_starttls(c: connection) &priority=5
{
if ( c?$smtp )
c$smtp$tls = T;
}
function describe(rec: Info): string
{
if ( rec?$mailfrom && rec?$rcptto )