Project

General

Profile

Actions

Feature #4386

closed

Support for RFC2231

Added by Gatewatcher Dev Team about 3 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:
C, Protocol

Description

We noticed a lack of support for multiline header attributes in mime documents as defined in RFC2231 (standard track).
This RFC documents a way to split header attributes across multiple lines, so that the line length remains short.
This wrapping is implemented by some popular MUA, including Thunderbird. Lack of support for this RFC results in Suricata not noticing/storing email attachments with filenames wrapped that way (filename*0=, filename*1=...).
This can also be considered as a evasion technique, although this is a standard track RFC.

We attached a pcap file containing an email attachment ignored by Suricata.

Thank you,

Cheers,
Florian Maury


Files

exemple_mime_sans_name_rfc.pcap (82.3 KB) exemple_mime_sans_name_rfc.pcap Gatewatcher Dev Team, 03/09/2021 09:17 AM

Subtasks 1 (0 open1 closed)

Feature #5478: Support for RFC2231 (6.0.x backport)ClosedPhilippe AntoineActions
Actions

Also available in: Atom PDF