ZEEK SMTP Header Parsing Issue

[sumit240690]

There is an issue with SMTP parsing where header extraction continues parsing into the body and attachments of emails. A common case which leads this issue to surface appears when emails are sent as attachments. If you have an attachment that itself is an email, the headers from the attached email will override headers parsed from the actual email.

This incidentally might be the cause of previously seen issues such as #254.

[timwoj]

Do you by chance have a pcap that illustrates it? That would help in tracking down the issue.

[sumit240690]

Hi,

We have proposed the following changes as explained in the below PR:

#1357

Please let us know if you still need pcap ?

Thanks.

[0xxon]

Hi,

thanks for the PR. A pcap actually still would be helpful for reproduction - and for inclusion in the testsuite. Alternatively - it would be great if you could add a testcase to the PR :).

Thank you very much,
Johanna

[theavgjojo]

@0xxon, check out #1365 -- PCAP and test case added.