Skip to content

Multipart mime 3487 v40#11188

Closed
catenacyber wants to merge 8 commits intoOISF:masterfrom
catenacyber:multipart-mime-3487-v40
Closed

Multipart mime 3487 v40#11188
catenacyber wants to merge 8 commits intoOISF:masterfrom
catenacyber:multipart-mime-3487-v40

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3487

Describe changes:

  • convert HTTP to use new rust mime parser
  • convert SMTP to use new rust mime parser
  • json schema : add email.received array

Follows #11157 with

  • better json schema
  • improve logging of To, Cc and other fields : skip leading spaces as was already done in C, + improve handling of quotes
  • Do not log empty fields/arrays
  • decapsulate transfered messages (ones with Content-Type: message/rfc822 or such)

Last commits show the changes from previous PR. Let me know if I should squash them in

SV_BRANCH=OISF/suricata-verify#1851

Commas in quotes are not separators...
received and cc were missing
like Content-Type: message/rfc822

And so, keep a vector of indices for the headers
@catenacyber catenacyber force-pushed the multipart-mime-3487-v40 branch from 51d9341 to 924ffc6 Compare May 30, 2024 14:13
@suricata-qa
Copy link

ERROR:

ERROR: QA failed on SURI_TLPW1_files_sha256.

Pipeline 20862

@catenacyber
Copy link
Contributor Author

Cleaner in #11191

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants