mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
b8dc6ad120
An invalid mail transaction is determined as
* RCPT TO command without a preceding MAIL FROM
* a DATA command without a preceding RCPT TO
and logged as a weird.
The testing pcap for invalid mail transactions was produced with a Python
script against a local exim4 configured to accept more errors and unknown
commands than 3 by default:
# exim4.conf.template
smtp_max_synprot_errors = 100
smtp_max_unknown_commands = 100
See also: https://www.rfc-editor.org/rfc/rfc5321#section-3.3
13 lines
413 B
Text
13 lines
413 B
Text
# @TEST-EXEC: zeek -b -r $TRACES/smtp-mail-transactions-invalid.pcap %INPUT > out
|
|
# @TEST-EXEC: btest-diff smtp.log
|
|
# @TEST-EXEC: btest-diff weird.log
|
|
# @TEST-EXEC: btest-diff out
|
|
|
|
@load base/protocols/smtp
|
|
|
|
redef SMTP::max_invalid_mail_transactions = 2;
|
|
|
|
hook Analyzer::disabling_analyzer(c: connection, atype: AllAnalyzers::Tag, aid: count)
|
|
{
|
|
print network_time(), "disabling_analyzer", c$uid, atype, aid;
|
|
}
|