Links in SMTP round 2

Zeek
1

So here’s where I’m at:

event bro_init()
    {
    local filter: Log::Filter = [$name="smtp-http", $path="smtp-http", $include=set("ts", "uid", "id.orig_h", "id.orig_p", "id.resp_h", "id.resp_p", "mailfrom", "rcptto", "date", "from", "to", "reply_to"
, "msg_id", "subject")];
    Log::add_filter(SMTP::LOG, filter);
    }

redef record SMTP::Info += {
    smtp_http: string &log;
};

event mime_entity_data(c:connection, length: count, data:string)

My snags are:

error in /usr/local/bro/share/bro/base/protocols/smtp/./main.bro, line 10: extension field must be &optional or have &default (SMTP::Info)
error in ./testfiles/test.bro, line 12: syntax error, at end of file

I’m hoping the first error is because I haven’t defined the new field of smtp_http yet. As for the second, I’m not sure how to create that field. I’ve been looking heavily at http://www.bro.org/sphinx-git/frameworks/logging.html, but so far this is all I have. ANY help…tutorials…pointers…something would really save me some time. Thank you.

James

2

error in /usr/local/bro/share/bro/base/protocols/smtp/./main.bro, line 10: extension field must be &optional or have &default (SMTP::Info)

Yep.. you need to mark it as &optional like it says.

error in ./testfiles/test.bro, line 12: syntax error, at end of file

You just need to handle that event and extract the links.

I’m hoping the first error is because I haven’t defined the new field of smtp_http yet. As for the second, I’m not sure how to create that field. I’ve been looking heavily at http://www.bro.org/sphinx-git/frameworks/logging.html, but so far this is all I have. ANY help…tutorials…pointers…something would really save me some time. Thank you.

Here is a script that adds a field to the conn log, it does all the
things you need to do:

3

Thanks a BUNCH Justin…this helps. As I’m looking at this, I think what I’m hoping for, is something like:

"if the smtp message stream contains http, then log the link to smtp_http.log, otherwise don’t log anything about the stream to smtp_http.log"

Something I’m stumbling on is…how do I specify the smtp stream, and how do I find out if it contains http ( looking at the bro cheat sheet I don’t see “=~” ). Again, thanks so much Justin…I think I’m getting closer.

James

4

You pasted how to do this in your first message:

event mime_entity_data(c:connection, length: count, data:string)
        { print find_all_urls(data); }

The only tricky part is find_all_urls would return a vector so your log
field needs to be a 'vector of string' and not just a 'string'

5

Awesome…thank you much Justin.

James