diff --git a/scripts/base/protocols/smtp/main.bro b/scripts/base/protocols/smtp/main.bro
index bfd8ad02ac..197a014ef4 100644
--- a/scripts/base/protocols/smtp/main.bro
+++ b/scripts/base/protocols/smtp/main.bro
@@ -8,7 +8,6 @@ module SMTP;
export {
redef enum Log::ID += { LOG };
- ## The record type which contains the fields of the SMTP log.
type Info: record {
## Time when the message was first seen.
ts: time &log;
@@ -21,9 +20,9 @@ export {
trans_depth: count &log;
## Contents of the Helo header.
helo: string &log &optional;
- ## Contents of the From header.
+ ## Email addresses found in the From header.
mailfrom: string &log &optional;
- ## Contents of the Rcpt header.
+ ## Email addresses found in the Rcpt header.
rcptto: set[string] &log &optional;
## Contents of the Date header.
date: string &log &optional;
@@ -167,11 +166,14 @@ event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &
{
if ( ! c$smtp?$rcptto )
c$smtp$rcptto = set();
- local rcptto = extract_email_addrs_set(split_string1(arg, /:[[:blank:]]*/)[1]);
- if ( |rcptto| > 0 )
+
+ local rcptto_addrs = extract_email_addrs_set(arg);
+ for ( rcptto_addr in rcptto_addrs )
{
- c$smtp$rcptto = rcptto;
+ rcptto_addr = gsub(rcptto_addr, /ORCPT=rfc822;?/, "");
+ add c$smtp$rcptto[rcptto_addr];
}
+
c$smtp$has_client_activity = T;
}
@@ -180,8 +182,7 @@ event smtp_request(c: connection, is_orig: bool, command: string, arg: string) &
# Flush last message in case we didn't see the server's acknowledgement.
smtp_message(c);
- local partially_done = split_string1(arg, /:[[:blank:]]*/)[1];
- local mailfrom = extract_first_email_addr(split_string1(partially_done, /[[:blank:]]?/)[0]);
+ local mailfrom = extract_first_email_addr(arg);
if ( mailfrom != "" )
c$smtp$mailfrom = mailfrom;
c$smtp$has_client_activity = T;
@@ -231,25 +232,24 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5
c$smtp$subject = h$value;
else if ( h$name == "FROM" )
- {
- local from = extract_first_email_addr(h$value);
- if ( from != "" )
- c$smtp$from = from;
- }
+ c$smtp$from = h$value;
else if ( h$name == "REPLY-TO" )
- {
- local replyto = extract_first_email_addr(h$value);
- if ( replyto != "" )
- c$smtp$reply_to = replyto;
- }
+ c$smtp$reply_to = h$value;
else if ( h$name == "DATE" )
c$smtp$date = h$value;
else if ( h$name == "TO" )
{
- c$smtp$to = extract_email_addrs_set(h$value);
+ if ( ! c$smtp?$to )
+ c$smtp$to = set();
+
+ local to_email_addrs = split_mime_email_addresses(h$value);
+ for ( to_email_addr in to_email_addrs )
+ {
+ add c$smtp$to[to_email_addr];
+ }
}
else if ( h$name == "CC" )
@@ -257,9 +257,9 @@ event mime_one_header(c: connection, h: mime_header_rec) &priority=5
if ( ! c$smtp?$cc )
c$smtp$cc = set();
- local cc_parts = split_string(h$value, /[[:blank:]]*,[[:blank:]]*/);
- for ( i in cc_parts )
- add c$smtp$cc[cc_parts[i]];
+ local cc_parts = split_mime_email_addresses(h$value);
+ for ( cc_part in cc_parts )
+ add c$smtp$cc[cc_part];
}
else if ( h$name == "X-ORIGINATING-IP" )
diff --git a/scripts/base/utils/email.bro b/scripts/base/utils/email.bro
index 1d01e85656..08e8db8500 100644
--- a/scripts/base/utils/email.bro
+++ b/scripts/base/utils/email.bro
@@ -44,4 +44,25 @@ function extract_first_email_addr(str: string): string
return addrs[0];
else
return "";
- }
\ No newline at end of file
+ }
+
+## Split email addresses from MIME headers. The email addresses will
+## include the display name and email address as it was given by the mail
+## mail client. Note that this currently does not account for MIME group
+## addresses and won't handle them correctly. The group name will show up
+## as part of an email address.
+##
+## str: The argument from a MIME header.
+##
+## Returns: A set of addresses or empty string if none found.
+function split_mime_email_addresses(line: string): set[string]
+ {
+ local output = string_set();
+
+ local addrs = find_all(line, /(\"[^"]*\")?[^,]+/);
+ for ( part in addrs )
+ {
+ add output[strip(part)];
+ }
+ return output;
+ }
diff --git a/scripts/policy/frameworks/intel/seen/smtp.bro b/scripts/policy/frameworks/intel/seen/smtp.bro
index 4ea949b43a..268928b57d 100644
--- a/scripts/policy/frameworks/intel/seen/smtp.bro
+++ b/scripts/policy/frameworks/intel/seen/smtp.bro
@@ -1,3 +1,4 @@
+@load base/utils/email
@load base/frameworks/intel
@load base/protocols/smtp
@load ./where-locations
@@ -30,13 +31,10 @@ event mime_end_entity(c: connection)
if ( c$smtp?$mailfrom )
{
- for ( mailfrom_addr in c$smtp$mailfrom )
- {
- Intel::seen([$indicator=mailfrom_addr,
- $indicator_type=Intel::EMAIL,
- $conn=c,
- $where=SMTP::IN_MAIL_FROM]);
- }
+ Intel::seen([$indicator=c$smtp$mailfrom,
+ $indicator_type=Intel::EMAIL,
+ $conn=c,
+ $where=SMTP::IN_MAIL_FROM]);
}
if ( c$smtp?$rcptto )
@@ -52,7 +50,7 @@ event mime_end_entity(c: connection)
if ( c$smtp?$from )
{
- for ( from_addr in c$smtp$from )
+ for ( from_addr in extract_email_addrs_set(c$smtp$from) )
{
Intel::seen([$indicator=from_addr,
$indicator_type=Intel::EMAIL,
@@ -65,7 +63,7 @@ event mime_end_entity(c: connection)
{
for ( email_to_addr in c$smtp$to )
{
- Intel::seen([$indicator=email_to_addr,
+ Intel::seen([$indicator=extract_first_email_addr(email_to_addr),
$indicator_type=Intel::EMAIL,
$conn=c,
$where=SMTP::IN_TO]);
@@ -85,13 +83,10 @@ event mime_end_entity(c: connection)
if ( c$smtp?$reply_to )
{
- for ( replyto_addr in c$smtp$reply_to )
- {
- Intel::seen([$indicator=replyto_addr,
- $indicator_type=Intel::EMAIL,
- $conn=c,
- $where=SMTP::IN_REPLY_TO]);
- }
+ Intel::seen([$indicator=c$smtp$reply_to,
+ $indicator_type=Intel::EMAIL,
+ $conn=c,
+ $where=SMTP::IN_REPLY_TO]);
}
}
}
diff --git a/testing/btest/Baseline/plugins.hooks/output b/testing/btest/Baseline/plugins.hooks/output
index 5963f63bf8..8235abd15d 100644
--- a/testing/btest/Baseline/plugins.hooks/output
+++ b/testing/btest/Baseline/plugins.hooks/output
@@ -238,7 +238,7 @@
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1465969080.55715, node=bro, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1466108964.602, node=bro, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Cluster::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Communication::LOG)) ->
0.000000 MetaHookPost CallFunction(Log::add_default_filter, , (Conn::LOG)) ->
@@ -359,7 +359,7 @@
0.000000 MetaHookPost CallFunction(Log::create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509])) ->
0.000000 MetaHookPost CallFunction(Log::create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])) ->
-0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1465969080.55715, node=bro, filter=ip or not ip, init=T, success=T])) ->
+0.000000 MetaHookPost CallFunction(Log::write, , (PacketFilter::LOG, [ts=1466108964.602, node=bro, filter=ip or not ip, init=T, success=T])) ->
0.000000 MetaHookPost CallFunction(NetControl::check_plugins, , ()) ->
0.000000 MetaHookPost CallFunction(NetControl::init, , ()) ->
0.000000 MetaHookPost CallFunction(Notice::want_pp, , ()) ->
@@ -590,6 +590,7 @@
0.000000 MetaHookPost LoadFile(base<...>/dnp3) -> -1
0.000000 MetaHookPost LoadFile(base<...>/dns) -> -1
0.000000 MetaHookPost LoadFile(base<...>/dpd) -> -1
+0.000000 MetaHookPost LoadFile(base<...>/email) -> -1
0.000000 MetaHookPost LoadFile(base<...>/event.bif) -> -1
0.000000 MetaHookPost LoadFile(base<...>/exec) -> -1
0.000000 MetaHookPost LoadFile(base<...>/extract) -> -1
@@ -896,7 +897,7 @@
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::__create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql]))
-0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1465969080.55715, node=bro, filter=ip or not ip, init=T, success=T]))
+0.000000 MetaHookPre CallFunction(Log::__write, , (PacketFilter::LOG, [ts=1466108964.602, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Cluster::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Communication::LOG))
0.000000 MetaHookPre CallFunction(Log::add_default_filter, , (Conn::LOG))
@@ -1017,7 +1018,7 @@
0.000000 MetaHookPre CallFunction(Log::create_stream, , (Weird::LOG, [columns=, ev=Weird::log_weird, path=weird]))
0.000000 MetaHookPre CallFunction(Log::create_stream, , (X509::LOG, [columns=, ev=X509::log_x509, path=x509]))
0.000000 MetaHookPre CallFunction(Log::create_stream, , (mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql]))
-0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1465969080.55715, node=bro, filter=ip or not ip, init=T, success=T]))
+0.000000 MetaHookPre CallFunction(Log::write, , (PacketFilter::LOG, [ts=1466108964.602, node=bro, filter=ip or not ip, init=T, success=T]))
0.000000 MetaHookPre CallFunction(NetControl::check_plugins, , ())
0.000000 MetaHookPre CallFunction(NetControl::init, , ())
0.000000 MetaHookPre CallFunction(Notice::want_pp, , ())
@@ -1248,6 +1249,7 @@
0.000000 MetaHookPre LoadFile(base<...>/dnp3)
0.000000 MetaHookPre LoadFile(base<...>/dns)
0.000000 MetaHookPre LoadFile(base<...>/dpd)
+0.000000 MetaHookPre LoadFile(base<...>/email)
0.000000 MetaHookPre LoadFile(base<...>/event.bif)
0.000000 MetaHookPre LoadFile(base<...>/exec)
0.000000 MetaHookPre LoadFile(base<...>/extract)
@@ -1553,7 +1555,7 @@
0.000000 | HookCallFunction Log::__create_stream(Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::__create_stream(X509::LOG, [columns=, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::__create_stream(mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1465969080.55715, node=bro, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::__write(PacketFilter::LOG, [ts=1466108964.602, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction Log::add_default_filter(Cluster::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Communication::LOG)
0.000000 | HookCallFunction Log::add_default_filter(Conn::LOG)
@@ -1674,7 +1676,7 @@
0.000000 | HookCallFunction Log::create_stream(Weird::LOG, [columns=, ev=Weird::log_weird, path=weird])
0.000000 | HookCallFunction Log::create_stream(X509::LOG, [columns=, ev=X509::log_x509, path=x509])
0.000000 | HookCallFunction Log::create_stream(mysql::LOG, [columns=, ev=MySQL::log_mysql, path=mysql])
-0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1465969080.55715, node=bro, filter=ip or not ip, init=T, success=T])
+0.000000 | HookCallFunction Log::write(PacketFilter::LOG, [ts=1466108964.602, node=bro, filter=ip or not ip, init=T, success=T])
0.000000 | HookCallFunction NetControl::check_plugins()
0.000000 | HookCallFunction NetControl::init()
0.000000 | HookCallFunction Notice::want_pp()
diff --git a/testing/btest/Baseline/scripts.base.protocols.http.http-connect/smtp.log b/testing/btest/Baseline/scripts.base.protocols.http.http-connect/smtp.log
index f7c07eb9dd..b4491d42d9 100644
--- a/testing/btest/Baseline/scripts.base.protocols.http.http-connect/smtp.log
+++ b/testing/btest/Baseline/scripts.base.protocols.http.http-connect/smtp.log
@@ -3,8 +3,8 @@
#empty_field (empty)
#unset_field -
#path smtp
-#open 2016-01-15-18-41-01
+#open 2016-06-16-20-25-57
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth helo mailfrom rcptto date from to cc reply_to msg_id in_reply_to subject x_originating_ip first_received second_received last_reply path user_agent tls fuids
#types time string addr port addr port count string string set[string] string string set[string] set[string] string string string string addr string string string vector[addr] string bool vector[string]
-1078232255.642953 CXWv6p3arKYeMETxOg 79.26.245.236 3378 254.228.86.79 8240 1 208.191.73.21 Tue, 2 Mar 2004 13:57:49 +0100 Sybille Ostermann thenightwatch@t-online.de - - - - Hier sind die dicken Girls hemmungloser denn je.. grcu - from mail.iosphere.net (mail.iosphere.net [216.58.97.33]) by mail.netsync.net with esmtp; Mrz, 02 2004 12:55:34 -0700 - 250 Message accepted. 254.228.86.79,79.26.245.236,216.58.97.33 Microsoft Outlook Build 10.0.2616 F FVS9k93PUgScEUCOjd
-#close 2016-01-15-18-41-01
+1078232255.642953 CXWv6p3arKYeMETxOg 79.26.245.236 3378 254.228.86.79 8240 1 208.191.73.21 nhfjenna_neumann@lycos.com thenightwatch@t-online.de Tue, 2 Mar 2004 13:57:49 +0100 Sybille Ostermann thenightwatch@t-online.de - - - - Hier sind die dicken Girls hemmungloser denn je.. grcu - from mail.iosphere.net (mail.iosphere.net [216.58.97.33]) by mail.netsync.net with esmtp; Mrz, 02 2004 12:55:34 -0700 - 250 Message accepted. 254.228.86.79,79.26.245.236,216.58.97.33 Microsoft Outlook Build 10.0.2616 F FVS9k93PUgScEUCOjd
+#close 2016-06-16-20-25-57
diff --git a/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/smtp.log b/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/smtp.log
index 0d427ab5cc..6d9b3dfad6 100644
--- a/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/smtp.log
+++ b/testing/btest/Baseline/scripts.base.protocols.smtp.attachment/smtp.log
@@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path smtp
-#open 2015-07-26-19-20-59
+#open 2016-06-16-20-26-56
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth helo mailfrom rcptto date from to cc reply_to msg_id in_reply_to subject x_originating_ip first_received second_received last_reply path user_agent tls fuids
#types time string addr port addr port count string string set[string] string string set[string] set[string] string string string string addr string string string vector[addr] string bool vector[string]
-1254722768.219663 CXWv6p3arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 1 GP Mon, 5 Oct 2009 11:36:07 +0530 "Gurpartap Singh" - - <000301ca4581$ef9e57f0$cedb07d0$@in> - SMTP - - - 250 OK id=1Mugho-0003Dg-Un 74.53.140.153,10.10.1.4 Microsoft Office Outlook 12.0 F Fel9gs4OtNEV6gUJZ5,Ft4M3f2yMvLlmwtbq9,FL9Y0d45OI4LpS6fmh
-1437831787.867142 CRJuHdVW0XPVINV8a 192.168.133.100 49648 192.168.133.102 25 1 [192.168.133.100] ,, Sat, 25 Jul 2015 16:43:07 +0300 Albert Zaharovits ericlim220@yahoo.com davis_mark1@outlook.com,felica4uu@hotmail.com - <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com> Re: Bro SMTP CC Header - - - 250 Ok 192.168.133.102,192.168.133.100 Apple Mail (2.2102) F FKX8fw2lEHCTK8syM3
-#close 2015-07-26-19-20-59
+1254722768.219663 CXWv6p3arKYeMETxOg 10.10.1.4 1470 74.53.140.153 25 1 GP gurpartap@patriots.in raj_deol2002in@yahoo.co.in Mon, 5 Oct 2009 11:36:07 +0530 "Gurpartap Singh" - - <000301ca4581$ef9e57f0$cedb07d0$@in> - SMTP - - - 250 OK id=1Mugho-0003Dg-Un 74.53.140.153,10.10.1.4 Microsoft Office Outlook 12.0 F Fel9gs4OtNEV6gUJZ5,Ft4M3f2yMvLlmwtbq9,FL9Y0d45OI4LpS6fmh
+1437831787.867142 CRJuHdVW0XPVINV8a 192.168.133.100 49648 192.168.133.102 25 1 [192.168.133.100] albert@example.com ericlim220@yahoo.com,davis_mark1@outlook.com,felica4uu@hotmail.com Sat, 25 Jul 2015 16:43:07 +0300 Albert Zaharovits ericlim220@yahoo.com davis_mark1@outlook.com,felica4uu@hotmail.com - <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com> Re: Bro SMTP CC Header - - - 250 Ok 192.168.133.102,192.168.133.100 Apple Mail (2.2102) F FKX8fw2lEHCTK8syM3
+#close 2016-06-16-20-26-56
diff --git a/testing/btest/Baseline/scripts.base.protocols.smtp.basic/smtp.log b/testing/btest/Baseline/scripts.base.protocols.smtp.basic/smtp.log
index efd4670ce0..a6122307f3 100644
--- a/testing/btest/Baseline/scripts.base.protocols.smtp.basic/smtp.log
+++ b/testing/btest/Baseline/scripts.base.protocols.smtp.basic/smtp.log
@@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path smtp
-#open 2015-07-26-19-21-33
+#open 2016-06-16-20-28-28
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth helo mailfrom rcptto date from to cc reply_to msg_id in_reply_to subject x_originating_ip first_received second_received last_reply path user_agent tls fuids
#types time string addr port addr port count string string set[string] string string set[string] set[string] string string string string addr string string string vector[addr] string bool vector[string]
-1254722768.219663 CjhGID4nQcgTWjvg4c 10.10.1.4 1470 74.53.140.153 25 1 GP Mon, 5 Oct 2009 11:36:07 +0530 "Gurpartap Singh" - - <000301ca4581$ef9e57f0$cedb07d0$@in> - SMTP - - - 250 OK id=1Mugho-0003Dg-Un 74.53.140.153,10.10.1.4 Microsoft Office Outlook 12.0 F Fel9gs4OtNEV6gUJZ5,Ft4M3f2yMvLlmwtbq9,FL9Y0d45OI4LpS6fmh
-1437831787.867142 CPbrpk1qSsw6ESzHV4 192.168.133.100 49648 192.168.133.102 25 1 [192.168.133.100] ,, Sat, 25 Jul 2015 16:43:07 +0300 Albert Zaharovits ericlim220@yahoo.com davis_mark1@outlook.com,felica4uu@hotmail.com - <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com> Re: Bro SMTP CC Header - - - 250 Ok 192.168.133.102,192.168.133.100 Apple Mail (2.2102) F FKX8fw2lEHCTK8syM3
-#close 2015-07-26-19-21-33
+1254722768.219663 CjhGID4nQcgTWjvg4c 10.10.1.4 1470 74.53.140.153 25 1 GP gurpartap@patriots.in raj_deol2002in@yahoo.co.in Mon, 5 Oct 2009 11:36:07 +0530 "Gurpartap Singh" - - <000301ca4581$ef9e57f0$cedb07d0$@in> - SMTP - - - 250 OK id=1Mugho-0003Dg-Un 74.53.140.153,10.10.1.4 Microsoft Office Outlook 12.0 F Fel9gs4OtNEV6gUJZ5,Ft4M3f2yMvLlmwtbq9,FL9Y0d45OI4LpS6fmh
+1437831787.867142 CPbrpk1qSsw6ESzHV4 192.168.133.100 49648 192.168.133.102 25 1 [192.168.133.100] albert@example.com ericlim220@yahoo.com,davis_mark1@outlook.com,felica4uu@hotmail.com Sat, 25 Jul 2015 16:43:07 +0300 Albert Zaharovits ericlim220@yahoo.com davis_mark1@outlook.com,felica4uu@hotmail.com - <9ACEE03C-AB98-4046-AEC1-BF4910C61E96@example.com> Re: Bro SMTP CC Header - - - 250 Ok 192.168.133.102,192.168.133.100 Apple Mail (2.2102) F FKX8fw2lEHCTK8syM3
+#close 2016-06-16-20-28-28
diff --git a/testing/btest/Baseline/scripts.base.protocols.smtp.one-side/smtp.log b/testing/btest/Baseline/scripts.base.protocols.smtp.one-side/smtp.log
index 07ed387b08..04e4e97862 100644
--- a/testing/btest/Baseline/scripts.base.protocols.smtp.one-side/smtp.log
+++ b/testing/btest/Baseline/scripts.base.protocols.smtp.one-side/smtp.log
@@ -3,9 +3,9 @@
#empty_field (empty)
#unset_field -
#path smtp
-#open 2015-07-26-18-36-11
+#open 2016-06-16-20-28-13
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p trans_depth helo mailfrom rcptto date from to cc reply_to msg_id in_reply_to subject x_originating_ip first_received second_received last_reply path user_agent tls fuids
#types time string addr port addr port count string string set[string] string string set[string] set[string] string string string string addr string string string vector[addr] string bool vector[string]
-1402446189.935267 CXWv6p3arKYeMETxOg 192.150.187.22 57722 192.150.186.11 25 1 enzo.icir.org - robin@icir.org robin@icir.org - - - - Hello1! - - - - 192.150.186.11,192.150.187.22 - F (empty)
-1402446189.993233 CXWv6p3arKYeMETxOg 192.150.187.22 57722 192.150.186.11 25 1 enzo.icir.org - robin@icir.org rsommer@lbl.gov - - - - Hello2! - - - - 192.150.186.11,192.150.187.22 - F (empty)
-#close 2015-07-26-18-36-11
+1402446189.935267 CXWv6p3arKYeMETxOg 192.150.187.22 57722 192.150.186.11 25 1 enzo.icir.org robin@icir.org robin@icir.org - robin@icir.org robin@icir.org - - - - Hello1! - - - - 192.150.186.11,192.150.187.22 - F (empty)
+1402446189.993233 CXWv6p3arKYeMETxOg 192.150.187.22 57722 192.150.186.11 25 1 enzo.icir.org robin@icir.org rsommer@lbl.gov - robin@icir.org rsommer@lbl.gov - - - - Hello2! - - - - 192.150.186.11,192.150.187.22 - F (empty)
+#close 2016-06-16-20-28-13
diff --git a/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log b/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
index 0e76b7faf4..445456bb3b 100644
--- a/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
+++ b/testing/btest/Baseline/scripts.policy.misc.dump-events/all-events.log
@@ -188,7 +188,7 @@
[3] arg: string = FROM:
1254722769.956765 smtp_reply
- [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.427719, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=]
+ [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=105, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=7, num_bytes_ip=672, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.427719, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=235 Authentication succeeded, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=]
[1] is_orig: bool = F
[2] code: count = 250
[3] cmd: string = MAIL
@@ -196,13 +196,13 @@
[5] cont_resp: bool = F
1254722769.957250 smtp_request
- [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.428204, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=]
+ [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=7, num_bytes_ip=393, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=392, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.428204, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dhcp=, dnp3=, dns=, dns_state=, ftp=, ftp_data_reuse=F, ssl=, http=, http_state=, irc=, krb=, modbus=, mysql=, radius=, rdp=, rfb=, sip=, sip_state=, snmp=, smtp=[ts=1254722768.219663, uid=CjhGID4nQcgTWjvg4c, id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], trans_depth=1, helo=GP, mailfrom=gurpartap@patriots.in, rcptto=, date=, from=, to=, cc=, reply_to=, msg_id=, in_reply_to=, subject=, x_originating_ip=, first_received=, second_received=, last_reply=250 OK, path=[74.53.140.153, 10.10.1.4], user_agent=, tls=F, process_received_from=T, has_client_activity=T, entity=, fuids=[]], smtp_state=[helo=GP, messages_transferred=0, pending_messages=, mime_depth=0], socks=, ssh=, syslog=]
[1] is_orig: bool = T
[2] command: string = RCPT
[3] arg: string = TO:
1254722770.319708 smtp_reply
- [0] c: connection = [id=[orig_h=10.10.1.4, orig_p=1470/tcp, resp_h=74.53.140.153, resp_p=25/tcp], orig=[size=144, state=4, num_pkts=8, num_bytes_ip=472, flow_label=0, l2_addr=00:e0:1c:3c:17:c2], resp=[size=406, state=4, num_pkts=8, num_bytes_ip=720, flow_label=0, l2_addr=00:1f:33:d9:81:60], start_time=1254722767.529046, duration=2.790662, service={\x0aSMTP\x0a}, history=ShAdDa, uid=CjhGID4nQcgTWjvg4c, tunnel=, vlan=, inner_vlan=, dpd=, conn=, extract_orig=F, extract_resp=F, thresholds=, dhcp=, dnp3=, dns=, dns_state=