diff --git a/scripts/base/protocols/smtp/entities.zeek b/scripts/base/protocols/smtp/entities.zeek index 4f6b6855f3..7bc43d7c2a 100644 --- a/scripts/base/protocols/smtp/entities.zeek +++ b/scripts/base/protocols/smtp/entities.zeek @@ -1,6 +1,7 @@ ##! Analysis and logging for MIME entities found in SMTP sessions. @load base/frameworks/files +@load base/frameworks/notice/weird @load base/utils/strings @load base/utils/files @load ./main @@ -48,6 +49,19 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5 if ( ! c?$smtp ) return; + if ( ! c$smtp?$entity ) + { + local weird = Weird::Info( + $ts=network_time(), + $name="missing_SMTP_entity", + $uid=c$uid, + $id=c$id, + $source="SMTP" + ); + Weird::weird(weird); + return; + } + if ( h$name == "CONTENT-DISPOSITION" && /[fF][iI][lL][eE][nN][aA][mM][eE]/ in h$value ) c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);