mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
984e9793db
* origin/topic/seth/faf-updates: (27 commits) Undoing the FTP tests I updated earlier. Update the last two btest FAF tests. File analysis fixes and test updates. Fix a bug with getting analyzer tags. A few test updates. Some tests work now (at least they all don't fail anymore!) Forgot a file. Added protocol description functions that provide a super compressed log representation. Fix a bug where orig file information in http wasn't working right. Added mime types to http.log Clean up queued but unused file_over_new_connections event args. Add jar files to the default MHR lookups. Adding CAB files for MHR checking. Improve malware hash registry script. Fix a small issue with finding smtp entities. Added support for files to the notice framework. Make the custom libmagic database a git submodule. Add an is_orig parameter to file_over_new_connection event. Make magic for emitting application/msword mime type less strict. Disable more libmagic builtin checks that override the magic database. ... Conflicts: doc/scripts/DocSourcesList.cmake scripts/base/init-bare.bro scripts/test-all-policy.bro testing/btest/Baseline/coverage.bare-load-baseline/canonified_loaded_scripts.log testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
62 lines
1.4 KiB
Text
62 lines
1.4 KiB
Text
##! Analysis and logging for MIME entities found in SMTP sessions.
|
|
|
|
@load base/frameworks/files
|
|
@load base/utils/strings
|
|
@load base/utils/files
|
|
@load ./main
|
|
|
|
module SMTP;
|
|
|
|
export {
|
|
type Entity: record {
|
|
## Filename for the entity if discovered from a header.
|
|
filename: string &optional;
|
|
};
|
|
|
|
redef record Info += {
|
|
## The current entity being seen.
|
|
entity: Entity &optional;
|
|
};
|
|
|
|
redef record State += {
|
|
## Track the number of MIME encoded files transferred
|
|
## during a session.
|
|
mime_depth: count &default=0;
|
|
};
|
|
}
|
|
|
|
event mime_begin_entity(c: connection) &priority=10
|
|
{
|
|
c$smtp$entity = Entity();
|
|
++c$smtp_state$mime_depth;
|
|
}
|
|
|
|
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
|
|
{
|
|
if ( f$source == "SMTP" && c?$smtp )
|
|
{
|
|
if ( c$smtp?$entity && c$smtp$entity?$filename )
|
|
f$info$filename = c$smtp$entity$filename;
|
|
f$info$depth = c$smtp_state$mime_depth;
|
|
}
|
|
}
|
|
|
|
event mime_one_header(c: connection, h: mime_header_rec) &priority=5
|
|
{
|
|
if ( ! c?$smtp )
|
|
return;
|
|
|
|
if ( h$name == "CONTENT-DISPOSITION" &&
|
|
/[fF][iI][lL][eE][nN][aA][mM][eE]/ in h$value )
|
|
c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);
|
|
|
|
if ( h$name == "CONTENT-TYPE" &&
|
|
/[nN][aA][mM][eE][:blank:]*=/ in h$value )
|
|
c$smtp$entity$filename = extract_filename_from_content_disposition(h$value);
|
|
}
|
|
|
|
event mime_end_entity(c: connection) &priority=5
|
|
{
|
|
if ( c?$smtp && c$smtp?$entity )
|
|
delete c$smtp$entity;
|
|
}
|