Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SMTP: Add enable_mail_data_file_analysis

Browse source 
Enabling this option will instantiate a new fa_file instance for every
mail data (message content) transferred over an SMTP connection. A new
event smtp_mail_data_file() can be used to intercept and identify the
creation of such files.
This commit is contained in:
Arne Welzel 2025-07-12 17:10:59 +02:00
parent 74dc2efccc
commit f9b72bc332
5 changed files with 53 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scripts/base/init-bare.zeek
View file

@ -667,6 +667,12 @@ export {
## is introduced and a weird is raised. Conventionally, MIME messages
## have a maximum line length of 1000 octets when properly encoded.
const bdat_max_line_length = 4096 &redef;
## Whether to send data of individual top-level RFC822 messages
## in SMTP transactions to the file analysis framework.
##
## :zeek:see:`smtp_mail_data_file`.
const enable_mail_data_file_analysis = F &redef;
}
module TCP;