NAME

Net::Inspect::L7::SMTP - guesses and handles SMTP traffic

SYNOPSIS

my $conn = ...
my $smtp = Net::Inspect::L7::SMTP->new($conn);
my $guess = Net::Inspect::L5::GuessProtocol->new;
$guess->attach($smtp);
...

DESCRIPTION

This class extracts SMTP traffic from TCP connections. It provides all hooks required for Net::Inspect::L4::TCP and is usually used together with it. It provides the guess_protocol hook so it can be used with Net::Inspect::L5::GuessProtocol.

Hooks provided:

guess_protocol($guess,$dir,$data,$eof,$time,$meta)

new_connection($meta)

This returns an object for the connection.

$connection->in($dir,$data,$eof,$time)

Processes new data and returns number of bytes processed. Any data not processed must be sent again with the next call.

$data are the data as string. Gaps are currently not support.

$connection->fatal($reason,$dir,$time)

The attached flow object needs to implement the following hooks:

new_connection($meta)

Called on start of SMTP connection to initialize object.

$obj->greeting($msg,$time)

Called when the initial greeting is read. $msg is the full greeting.

$obj->command($cmd,$time)

Called when a command is read. $cmd is the full command line.

$obj->response($msg,$time)

Called when a response is read. $msg is the full response.

$obj->mail_data($chunk,$time)

Called when a chunk is read inside DATA. Dot-escaping will be removed before calling mail_data End of mail data will be signaled with an empty chunk.

$obj->auth_data($line,$time)

Called within the AUTH handshake for the data send from client to server. The data (challenges) from server to client are delivered through response.

$obj->fatal($dir,$reason,$time)

Called on fatal protocol errors.