From a53ec79ebc1beb75caeb1b231a6ebd021a26c2f9 Mon Sep 17 00:00:00 2001 From: Michael Mann Date: Sat, 31 Aug 2019 21:49:22 -0400 Subject: SMTP: Consider bytes seen as "data" until a command is seen Create a state for the start of an SMTP conversation. If bytes seen don't match a command and conversation is still in the "start" state, treat bytes as message data, not a command. Bug: 16026 Change-Id: I229b316a77819b07bf8cf93bed72570a947c6cf3 Reviewed-on: https://code.wireshark.org/review/34412 Reviewed-by: Michael Mann Petri-Dish: Michael Mann Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman --- epan/dissectors/packet-smtp.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/epan/dissectors/packet-smtp.c b/epan/dissectors/packet-smtp.c index 76423e4207..096b6780cf 100644 --- a/epan/dissectors/packet-smtp.c +++ b/epan/dissectors/packet-smtp.c @@ -133,6 +133,7 @@ struct smtp_proto_data { * State information stored with a conversation. */ typedef enum { + SMTP_STATE_START, /* Start of SMTP conversion */ SMTP_STATE_READING_CMDS, /* reading commands */ SMTP_STATE_READING_DATA, /* reading message data */ SMTP_STATE_AWAITING_STARTTLS_RESPONSE /* sent STARTTLS, awaiting response */ @@ -429,7 +430,7 @@ dissect_smtp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ * No - create one and attach it. */ session_state = (struct smtp_session_state *)wmem_alloc0(wmem_file_scope(), sizeof(struct smtp_session_state)); - session_state->smtp_state = SMTP_STATE_READING_CMDS; + session_state->smtp_state = SMTP_STATE_START; session_state->auth_state = SMTP_AUTH_STATE_NONE; session_state->msg_last = TRUE; @@ -727,7 +728,7 @@ dissect_smtp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_ /* * Assume it's message data. */ - spd_frame_data->pdu_type = session_state->data_seen ? SMTP_PDU_MESSAGE : SMTP_PDU_CMD; + spd_frame_data->pdu_type = (session_state->data_seen || (session_state->smtp_state == SMTP_STATE_START)) ? SMTP_PDU_MESSAGE : SMTP_PDU_CMD; } } } -- cgit v1.2.3