Arne Welzel b8dc6ad120 smtp: Validate mail transaction and disable SMTP analyzer if excessive ... An invalid mail transaction is determined as * RCPT TO command without a preceding MAIL FROM * a DATA command without a preceding RCPT TO and logged as a weird. The testing pcap for invalid mail transactions was produced with a Python script against a local exim4 configured to accept more errors and unknown commands than 3 by default: # exim4.conf.template smtp_max_synprot_errors = 100 smtp_max_unknown_commands = 100 See also: https://www.rfc-editor.org/rfc/rfc5321#section-3.3		2023-03-27 18:41:47 +02:00
..
conn	Expand Conn::Info$duration comment to clarify TCP end-of-connection handling	2022-11-30 09:39:57 -08:00
dce-rpc	Spelling fixes: scripts	2022-11-02 17:36:39 -04:00
dhcp	Spelling fixes: scripts	2022-11-02 17:36:39 -04:00
dnp3	Support for log filter policy hooks	2020-09-30 12:32:45 -07:00
dns	dns: Remove AD and CD flags from log	2023-03-16 10:09:27 +01:00
finger	Add BIF have_spicy_analyzers().	2023-02-03 13:47:26 +01:00
ftp	ftp: Limit user, password, arg and reply_msg column sizes in log	2023-02-21 12:28:07 -07:00
http	{http,smtp}/entities: Align header regexes with extract_filename_from_content_disposition()	2022-11-08 16:45:25 -07:00
imap	Merge remote-tracking branch 'origin/topic/seth/zeek_init'	2019-04-19 11:24:29 -07:00
irc	annotate base scripts with &is_used as needed	2022-05-26 17:39:17 -07:00
krb	Spelling fixes: scripts	2022-11-02 17:36:39 -04:00
modbus	Add a field to Modbus/TCP log to indicate the Modbus PDU type	2022-07-24 02:41:26 +00:00
mqtt	mqtt: Move from policy/ into base/	2022-11-30 10:14:20 +01:00
mysql	MySQL: Fix endianness, introduce mysql_eof() event	2023-01-27 10:59:23 +01:00
ntlm	scripts/dce-rpc,ntlm: Do not load base/frameworks/dpd	2022-08-31 16:50:37 +02:00
ntp	&is_set => &is_assigned	2021-02-04 12:18:46 -08:00
pop3	Rename all scripts to have ".zeek" file extension	2019-04-11 21:12:40 -05:00
radius	deprecation messages for unused base script functions	2022-05-27 14:36:30 -07:00
rdp	Merge remote-tracking branch 'jeff-bb/patch-2'	2023-01-23 12:50:23 -07:00
rfb	Support for log filter policy hooks	2020-09-30 12:32:45 -07:00
sip	Support for log filter policy hooks	2020-09-30 12:32:45 -07:00
smb	smb1: Prevent accessing uninitialized referenced_tree	2023-01-27 19:22:13 +01:00
smtp	smtp: Validate mail transaction and disable SMTP analyzer if excessive	2023-03-27 18:41:47 +02:00
snmp	Spelling fixes: scripts	2022-11-02 17:36:39 -04:00
socks	Spelling fixes: scripts	2022-11-02 17:36:39 -04:00
ssh	ssh: Test for c$ssh$analyzer_id existence	2022-11-16 16:35:57 +01:00
ssl	Spelling fixes: scripts	2022-11-02 17:36:39 -04:00
syslog	Add BIF have_spicy_analyzers().	2023-02-03 13:47:26 +01:00
tunnels	Add Teredo packet analyzer, disable old analyzer	2021-11-23 19:36:50 -07:00
xmpp	Merge remote-tracking branch 'origin/topic/seth/zeek_init'	2019-04-19 11:24:29 -07:00