[
https://bro-tracker.atlassian.net/browse/BIT-991?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22604#comment-22604
]
Johanna Amann commented on BIT-991:
-----------------------------------
While having an imap analyzer would be interesting, I don't think we want to
add one that is hand-written (i.e. parses the protocol in C-code) because it is
easy to have a lot of subtle bugs in them.
Would you potentially be interested in re-writing this to use binpac for the
protocol parsing instead?
https://github.com/bro/bro/tree/topic/johanna/imap-starttls actually already
has an imap analyzer template in binpac, to add StartTLS support. Adding more
protocol features to this should not be too hard.
> Imap Analyzer
> -------------
>
> Key: BIT-991
> URL: https://bro-tracker.atlassian.net/browse/BIT-991
> Project: Bro Issue Tracker
> Issue Type: Patch
> Components: Bro
> Affects Versions: git/master
> Reporter: nicolas
> Assignee: Seth Hall
> Priority: Low
> Labels: Imap, analyzer
> Fix For: 2.5
>
> Attachments: 0001-IMAP-analyzer.patch
>
>
> Here is an Imap Analyzer and a quick script sample. It is inspired of the
> POP3 Analyzer.
> No problem to make some coding changes if you ask.
> Nicolas
--
This message was sent by Atlassian JIRA
(v7.0.0-OD-08-002#70107)
_______________________________________________
bro-dev mailing list
[email protected]
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
