[Bro-Commits] [git/bro] fastpath: Fixed a bug with the MIME analyzer not removing whitespace on wrapped headers. (89cb103)

Were you able to test this in any form?


Yes, I have a non-distributable tracefile that this fixes. It should be easy to find an example though, wrapped headers in SMTP is really common we could probably even find one in our test trace files somewhere, we just need to find it. :slight_smile:

I had applied this, but I'm not sure it's actually correct. RFC 822

        Unfolding is accomplished by regarding CRLF immediately
        followed by a LWSP-char as equivalent to the LWSP-char.

Which seems to say the white-space should be left in except for the

Also, by removing it, the two parts now flow togehter. Here's an
example I found with the test-suite:

    Old: ([xx.xx.xx.xx])\x09by xxx.xxx.gov
    New: ([xx.xx.xx.xx])by xxx.xxx.gov

So I'm reverting this for now until we've decided what's right.