Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Add STLS command to POP3 DPD signature

Browse source
This commit is contained in:
Jan Grashoefer 2025-05-14 16:37:25 +02:00
parent 734fd62325
commit 84cc4b890d
2 changed files with 2 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/base/protocols/pop3/dpd.sig
View file

@ -8,6 +8,6 @@ signature dpd_pop3_server {
signature dpd_pop3_client {
ip-proto == tcp
payload /(|.*[\r\n])[[:space:]]*([uU][sS][eE][rR][[:space:]]|[aA][pP][oO][pP][[:space:]]|[cC][aA][pP][aA]|[aA][uU][tT][hH])/
payload /(|.*[\r\n])[[:space:]]*([uU][sS][eE][rR][[:space:]]|[aA][pP][oO][pP][[:space:]]|[cC][aA][pP][aA]|[aA][uU][tT][hH]|[sS][tT][lL][sS])/
tcp-state originator
}

13
testing/btest/scripts/base/protocols/pop3/starttls.zeek
View file

@ -5,15 +5,4 @@
@load base/protocols/conn
@load base/protocols/ssl
module POP3;
const ports = {
110/tcp
};
redef likely_server_ports += { ports };
event zeek_init() &priority=5
{
Analyzer::register_for_ports(Analyzer::ANALYZER_POP3, ports);
}
@load base/protocols/pop3