Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Switch the MIME fields in smtp.log back to showing what's actually given.

Browse source 
- SMTP protocol headers now do some minimal parsing to clean up
   email addresses.
 - New function named split_mime_email_addresses to take MIME headers
   and get addresses split apart but including the display name.
 - Update tests.
This commit is contained in:
Seth Hall 2016-06-16 16:40:52 -04:00
parent 9df12a8146
commit f5a689a760
10 changed files with 198 additions and 180 deletions
Download patch file Download diff file Expand all files Collapse all files

23
scripts/base/utils/email.bro
View file

@ -44,4 +44,25 @@ function extract_first_email_addr(str: string): string
return addrs[0];
else
return "";
}
}
## Split email addresses from MIME headers. The email addresses will
## include the display name and email address as it was given by the mail
## mail client. Note that this currently does not account for MIME group
## addresses and won't handle them correctly. The group name will show up
## as part of an email address.
##
## str: The argument from a MIME header.
##
## Returns: A set of addresses or empty string if none found.
function split_mime_email_addresses(line: string): set[string]
{
local output = string_set();
local addrs = find_all(line, /(\"[^"]*\")?[^,]+/);
for ( part in addrs )
{
add output[strip(part)];
}
return output;
}