Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 19:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

smtp: Prevent script errors when smtp$entity is not set

Browse source 
This is the same issue presented in 38e226bf75 but
for SMTP instead of HTTP.
This commit is contained in:
Tim Wojtulewicz 2022-10-06 13:21:02 -07:00
parent a4ad4a34b2
commit a91d363e56
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/base/protocols/smtp/entities.zeek
View file

@ -1,6 +1,7 @@
##! Analysis and logging for MIME entities found in SMTP sessions. ##! Analysis and logging for MIME entities found in SMTP sessions.
@load base/frameworks/files @load base/frameworks/files
@load base/frameworks/notice/weird
@load base/utils/strings @load base/utils/strings
@load base/utils/files @load base/utils/files
@load ./main @load ./main
@ -48,6 +49,19 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5
if ( ! c?$smtp ) if ( ! c?$smtp )
return; return;
if ( ! c$smtp?$entity )
{
local weird = Weird::Info(
$ts=network_time(),
$name="missing_SMTP_entity",
$uid=c$uid,
$id=c$id,
$source="SMTP"
);
Weird::weird(weird);
return;
}
if ( h$name == "CONTENT-DISPOSITION" && if ( h$name == "CONTENT-DISPOSITION" &&
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in h$value ) /[fF][iI][lL][eE][nN][aA][mM][eE]/ in h$value )
c$smtp$entity$filename = extract_filename_from_content_disposition(h$value); c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);