/
files.zeek
52 lines (43 loc) · 1.22 KB
/
files.zeek
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
@load ./main
@load ./entities
@load base/utils/conn-ids
@load base/frameworks/files
module SMTP;
export {
redef record Info += {
## An ordered vector of file unique IDs seen attached to
## the message.
fuids: vector of string &log &default=string_vec();
};
## Default file handle provider for SMTP.
global get_file_handle: function(c: connection, is_orig: bool): string;
## Default file describer for SMTP.
global describe_file: function(f: fa_file): string;
}
function get_file_handle(c: connection, is_orig: bool): string
{
return cat(Analyzer::ANALYZER_SMTP, c$start_time, c$smtp$trans_depth,
c$smtp_state$mime_depth);
}
function describe_file(f: fa_file): string
{
# This shouldn't be needed, but just in case...
if ( f$source != "SMTP" )
return "";
for ( _, c in f$conns )
{
return SMTP::describe(c$smtp);
}
return "";
}
event zeek_init() &priority=5
{
Files::register_protocol(Analyzer::ANALYZER_SMTP,
[$get_file_handle = SMTP::get_file_handle,
$describe = SMTP::describe_file]);
}
event file_over_new_connection(f: fa_file, c: connection, is_orig: bool) &priority=5
{
if ( c?$smtp && !c$smtp$tls )
c$smtp$fuids += f$id;
}