[Bro-Dev] [JIRA] (BIT-991) Imap Analyzer
Johanna Amann (JIRA)
jira at bro-tracker.atlassian.net
Mon Oct 19 13:14:00 PDT 2015
[ https://bro-tracker.atlassian.net/browse/BIT-991?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22604#comment-22604 ]
Johanna Amann commented on BIT-991:
While having an imap analyzer would be interesting, I don't think we want to add one that is hand-written (i.e. parses the protocol in C-code) because it is easy to have a lot of subtle bugs in them.
Would you potentially be interested in re-writing this to use binpac for the protocol parsing instead? https://github.com/bro/bro/tree/topic/johanna/imap-starttls actually already has an imap analyzer template in binpac, to add StartTLS support. Adding more protocol features to this should not be too hard.
> Imap Analyzer
> Key: BIT-991
> URL: https://bro-tracker.atlassian.net/browse/BIT-991
> Project: Bro Issue Tracker
> Issue Type: Patch
> Components: Bro
> Affects Versions: git/master
> Reporter: nicolas
> Assignee: Seth Hall
> Priority: Low
> Labels: Imap, analyzer
> Fix For: 2.5
> Attachments: 0001-IMAP-analyzer.patch
> Here is an Imap Analyzer and a quick script sample. It is inspired of the POP3 Analyzer.
> No problem to make some coding changes if you ask.
This message was sent by Atlassian JIRA
More information about the bro-dev