Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 20:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

also generate an event when starttls is encounterd for imap.

Browse source
This commit is contained in:
Johanna Amann 2015-07-23 12:37:40 -07:00
parent 1933299543
commit 7f2087af34
4 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/imap/events.bif
View file

@ -8,3 +8,7 @@
## capabilities: The list of IMAP capabilities as sent by the server.
event imap_capabilities%(c: connection, capabilities: string_vec%);
## Generated when a IMAP connection goes encrypted
##
## c: The connection.
event imap_starttls%(c: connection%);

3
src/analyzer/protocol/imap/imap-analyzer.pac
View file

@ -41,7 +41,10 @@ refine connection IMAP_Conn += {
if ( !is_orig && !client_starttls_id.empty() && tags == client_starttls_id )
{
if ( commands == "ok" )
{
bro_analyzer()->StartTLS();
BifEvent::generate_imap_starttls(bro_analyzer(), bro_analyzer()->Conn());
}
else
reporter->Weird(bro_analyzer()->Conn(), "IMAP: server refused StartTLS");
}

1
testing/btest/Baseline/scripts.base.protocols.imap.starttls/.stdout Normal file
View file

@ -0,0 +1 @@
Tls started for connection

6
testing/btest/scripts/base/protocols/imap/starttls.test
View file

@ -2,8 +2,14 @@
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff ssl.log
# @TEST-EXEC: btest-diff x509.log
# @TEST-EXEC: btest-diff .stdout
@load base/protocols/ssl
@load base/protocols/conn
@load base/frameworks/dpd
@load base/protocols/imap
event imap_starttls(c: connection)
{
print "Tls started for connection";
}