suricata smtp协议解析源码注释七-完结篇
发布时间
阅读量：
阅读量
一。ProcessBodyLine
SMTPParse-> SMTPProcessRequest-> SMTPProcessCommandDATA-> MimeDecParseLine-> ProcessMimeEntity-> ProcessMimeBody->ProcessBodyLine
该函数处理body数据， 根据头部字段设置编码标志对数据进行解码，base64，quote-prntable。
如果数据未编码则不需要解码，解码后将数据存储到mime_state->data_chunk中，如果没有存储空间则调用ProcessDecodedDataChunk函数对数据进行处理，其中主要是获取每行数据从中提取url并保存，之后并调用函数指针state->DataChunkProcessorFunc，该函数指针是在函数SMTPProcessRequest中创建（MimeDecParseState）mime_state时进行的初始化，提供自定义处理功能。
static int ProcessBodyLine(const uint8_t *buf, uint32_t len,
MimeDecParseState *state)
{
int ret = MIME_DEC_OK;
uint32_t remaining, offset, avail, tobuf;
//获取当前信件体的指针
MimeDecEntity *entity = (MimeDecEntity *) state->stack->top->data;
SCLogDebug("Processing body line");
/* Track length */
entity->body_len += len + 2; /* With CRLF */
//判断编码标志，如果是base64则解码，
/* Process base-64 content if enabled */
MimeDecConfig *mdcfg = MimeDecGetConfig();
if (mdcfg != NULL && mdcfg->decode_base64 &&
(entity->ctnt_flags & CTNT_IS_BASE64)) {
ret = ProcessBase64BodyLine(buf, len, state);
if (ret != MIME_DEC_OK) {
SCLogDebug("Error: ProcessBase64BodyLine() function failed");
}
} else if (mdcfg != NULL && mdcfg->decode_quoted_printable &&
//判断编码标志，如果是quoted-print编码则解码，
(entity->ctnt_flags & CTNT_IS_QP)) {
/* Process quoted-printable content if enabled */
ret = ProcessQuotedPrintableBodyLine(buf, len, state);
if (ret != MIME_DEC_OK) {
SCLogDebug("Error: ProcessQuotedPrintableBodyLine() function "
"failed");
}
} else {
//未编码数据，直接复制到data_chunk变量中
/* Process non-decoded content */
remaining = len;
offset = 0;
while (remaining > 0) {
/* Plan to add CRLF to the end of each line */
avail = DATA_CHUNK_SIZE - state->data_chunk_len;
tobuf = avail > remaining + EOL_LEN ? remaining : avail - EOL_LEN;
/* Copy over to buffer */
memcpy(state->data_chunk + state->data_chunk_len, buf + offset, tobuf);
state->data_chunk_len += tobuf;
//每行数据后增加\r\n，不是很明白加这个干啥
/* Now always add a CRLF to the end */
if (tobuf == remaining) {
memcpy(state->data_chunk + state->data_chunk_len, CRLF, EOL_LEN);
state->data_chunk_len += EOL_LEN;
}
if ((int) (DATA_CHUNK_SIZE - state->data_chunk_len) < 0) {
SCLogDebug("Error: Invalid Chunk length: %u",
state->data_chunk_len);
ret = MIME_DEC_ERR_PARSE;
break;
}
//data_chunk数据满了，调用函数ProcessDecodedDataChunk处理该变量，
//这个函数主要提取url并存储，最后调用了初始化mime_state变量时设置的
//子定义函数指针,那个函数指针指向的函数，主要处理了附件相关操作
/* If buffer full, then invoke callback */
if (DATA_CHUNK_SIZE - state->data_chunk_len < EOL_LEN + 1) {
/* Invoke pre-processor and callback */
ret = ProcessDecodedDataChunk(state->data_chunk,
state->data_chunk_len, state);
if (ret != MIME_DEC_OK) {
SCLogDebug("Error: ProcessDecodedDataChunk() function "
"failed");
}
}
remaining -= tobuf;
offset += tobuf;
}
}
return ret;
}
完结！
全部评论 (0)
还没有任何评论哟~