[Bro-Dev] [JIRA] (BIT-991) Imap Analyzer

[Johanna Amann (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-991?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22604#comment-22604 ] 

Johanna Amann commented on BIT-991:
-----------------------------------

While having an imap analyzer would be interesting, I don't think we want to add one that is hand-written (i.e. parses the protocol in C-code) because it is easy to have a lot of subtle bugs in them.

Would you potentially be interested in re-writing this to use binpac for the protocol parsing instead? https://github.com/bro/bro/tree/topic/johanna/imap-starttls actually already has an imap analyzer template in binpac, to add StartTLS support. Adding more protocol features to this should not be too hard.

> Imap Analyzer
> -------------
>
>                 Key: BIT-991
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-991
>             Project: Bro Issue Tracker
>          Issue Type: Patch
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: nicolas
>            Assignee: Seth Hall
>            Priority: Low
>              Labels: Imap, analyzer
>             Fix For: 2.5
>
>         Attachments: 0001-IMAP-analyzer.patch
>
>
> Here is an Imap Analyzer and a quick script sample. It is inspired of the POP3 Analyzer.
> No problem to make some coding changes if you ask.
> Nicolas



--
This message was sent by Atlassian JIRA
(v7.0.0-OD-08-002#70107)