mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
f6e7ea43c3
A call to `extract_filename_from_content_disposition()` is only efficient if the string is guaranteed to contain the pattern that is removed by `sub()`. Due to missing brackets around the `[:blank:]` character class, an overly long string (756kb) ending in "Type:dtanameaa=" matched the wrong pattern causing `sub()` to exhibit quadratic runtime. Besides that, we may have potentially extracted wrong information from a crafted header value. (cherry picked from commit 6d385b1ca724a10444865e4ad38a58b31a2e2288)
78 lines
1.7 KiB
Text
78 lines
1.7 KiB
Text
##! Analysis and logging for MIME entities found in SMTP sessions.
|
|
|
|
@load base/frameworks/files
|
|
@load base/frameworks/notice/weird
|
|
@load base/utils/strings
|
|
@load base/utils/files
|
|
@load ./main
|
|
|
|
module SMTP;
|
|
|
|
export {
|
|
type Entity: record {
|
|
## Filename for the entity if discovered from a header.
|
|
filename: string &optional;
|
|
};
|
|
|
|
redef record Info += {
|
|
## The current entity being seen.
|
|
entity: Entity &optional;
|
|
};
|
|
|
|
redef record State += {
|
|
## Track the number of MIME encoded files transferred
|
|
## during a session.
|
|
mime_depth: count &default=0;
|
|
};
|
|
}
|
|
|
|
event mime_begin_entity(c: connection) &priority=10
|
|
{
|
|
if ( c?$smtp )
|
|
c$smtp$entity = Entity();
|
|
if ( c?$smtp_state )
|
|
++c$smtp_state$mime_depth;
|
|
}
|
|
|
|
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
|
|
{
|
|
if ( f$source == "SMTP" && c?$smtp )
|
|
{
|
|
if ( c$smtp?$entity && c$smtp$entity?$filename )
|
|
f$info$filename = c$smtp$entity$filename;
|
|
f$info$depth = c$smtp_state$mime_depth;
|
|
}
|
|
}
|
|
|
|
event mime_one_header(c: connection, h: mime_header_rec) &priority=5
|
|
{
|
|
if ( ! c?$smtp )
|
|
return;
|
|
|
|
if ( ! c$smtp?$entity )
|
|
{
|
|
local weird = Weird::Info(
|
|
$ts=network_time(),
|
|
$name="missing_SMTP_entity",
|
|
$uid=c$uid,
|
|
$id=c$id,
|
|
$source="SMTP"
|
|
);
|
|
Weird::weird(weird);
|
|
return;
|
|
}
|
|
|
|
if ( h$name == "CONTENT-DISPOSITION" &&
|
|
/[fF][iI][lL][eE][nN][aA][mM][eE][[:blank:]]*\*?=/ in h$value )
|
|
c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);
|
|
|
|
if ( h$name == "CONTENT-TYPE" &&
|
|
/[nN][aA][mM][eE][[:blank:]]*=/ in h$value )
|
|
c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);
|
|
}
|
|
|
|
event mime_end_entity(c: connection) &priority=5
|
|
{
|
|
if ( c?$smtp && c$smtp?$entity )
|
|
delete c$smtp$entity;
|
|
}
|