Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

SMTP: Add enable_rfc822_msg_file_analysis

Browse source 
Enabling this option will instantiate a new fa_file instance for every
top-level RFC 822 message in an SMTP transaction.
This commit is contained in:
Arne Welzel 2025-07-12 17:10:59 +02:00
parent fba319857b
commit 6f05fbf2ce
4 changed files with 38 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/analyzer/protocol/smtp/SMTP.h
View file

@ -61,6 +61,7 @@ protected:
void ProcessExtension(int ext_len, const char* ext);
void ProcessData(int length, const char* line);
bool ProcessBdatArg(int arg_len, const char* arg, bool orig);
std::string Rfc822MsgDataIn(int len, const u_char* data);
void UpdateState(int cmd_code, int reply_code, bool orig);
@ -90,6 +91,7 @@ protected:
std::unique_ptr<detail::SMTP_BDAT_Analyzer> bdat; // if set, BDAT chunk transfer active
analyzer::mime::MIME_Mail* mail;
std::string rfc822_msg_fuid; // fuid for mail data file analysis
private:
analyzer::tcp::ContentLine_Analyzer* cl_orig;