mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 14:48:21 +00:00
21 lines
705 B
Text
21 lines
705 B
Text
# @TEST-DOC: Test case for extracting a mail that contains attachments.
|
|
#
|
|
# @TEST-EXEC: zeek -C -b -r $TRACES/smtp-attachment-msg.pcap %INPUT
|
|
# @TEST-EXEC: zeek-cut -m fuid uid mime_type seen_bytes parent_fuid sha1 < files.log > files.cut
|
|
# @TEST-EXEC: btest-diff files.cut
|
|
# @TEST-EXEC: btest-diff --binary extract_files/mail
|
|
|
|
@load base/files/hash
|
|
@load base/files/extract
|
|
@load base/protocols/smtp
|
|
|
|
redef SMTP::enable_rfc822_msg_file_analysis = T;
|
|
|
|
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
|
|
{
|
|
if ( f$id == c$smtp$rfc822_msg_fuid )
|
|
{
|
|
Files::add_analyzer(f, Files::ANALYZER_SHA1);
|
|
Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename="mail"]);
|
|
}
|
|
}
|