Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

SMTP: Add enable_rfc822_msg_file_analysis

Browse source 
Enabling this option will instantiate a new fa_file instance for every
top-level RFC 822 message in an SMTP transaction.
This commit is contained in:
Arne Welzel 2025-07-12 17:10:59 +02:00
parent fba319857b
commit 6f05fbf2ce
4 changed files with 38 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/base/init-bare.zeek
View file

@ -667,6 +667,14 @@ export {
## is introduced and a weird is raised. Conventionally, MIME messages
## have a maximum line length of 1000 octets when properly encoded.
const bdat_max_line_length = 4096 &redef;
## Whether to send data of individual top-level RFC822 messages
## in SMTP transactions to the file analysis framework.
##
## If this option is enabled, the first :zeek:see:`file_over_new_connection`
## event for a new SMTP transaction will be for the top-level RFC822
## message. The file's :zeek:field:`mime_type` will be ``message/rfc822``.
const enable_rfc822_msg_file_analysis = F &redef;
}
module TCP;