From 407249eb5d654b5a951c43bc1722fd397d5d922c Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Tue, 1 Jul 2025 00:40:00 +0200 Subject: Add FTP, SMTP, TFTP, and IGMP; fix an IGMPv3 group-address misparse FTP and SMTP share HTTP's line-based response-code-or-command shape but keep their own command vocabularies in separate files rather than sharing a parser. FTP passwords are shown as-is, not redacted - FTP sends them in the clear regardless, matching Wireshark's own behavior. TFTP is a small binary opcode protocol (RFC 1350) instead. IGMP sits directly on IP like ICMP, so it's dispatched by protocol number rather than through the port-keyed L7Registry the other three use. Live-verified: FTP/SMTP against minimal real TCP servers written for this (nothing installed locally), a full command/response exchange decoded correctly in both directions. TFTP against a real atftpd server and atftp client - the RRQ decoded correctly even though the transfer itself didn't complete (an atftpd sandbox issue, not this code). IGMP against real multicast traffic on wlp1s0, including a genuine query from the actual router. That live IGMP traffic caught a real bug before it shipped further: parse_igmp() read bytes[4:8] as a group address for every message type, but IGMPv3 reports use those bytes for Reserved+RecordCount instead - a real V3 report showed "group=0.0.0.1" (0 reserved, 1 record, misread as an IP). Fixed by only populating group for the types where it's genuinely an address; re-verified against the same live traffic, and a regression test locks in the exact pattern. --- tests/test_smtp.cpp | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 tests/test_smtp.cpp (limited to 'tests/test_smtp.cpp') diff --git a/tests/test_smtp.cpp b/tests/test_smtp.cpp new file mode 100644 index 0000000..610ed4e --- /dev/null +++ b/tests/test_smtp.cpp @@ -0,0 +1,51 @@ +#include + +#include + +#include "packeteer/l7/smtp.hpp" + +using namespace packeteer::net; + +namespace { + +std::vector to_bytes(const std::string& s) { + return std::vector(s.begin(), s.end()); +} + +} // namespace + +TEST_CASE("parse_smtp decodes a greeting response") { + auto msg = parse_smtp(to_bytes("220 mail.example.com ESMTP\r\n")); + REQUIRE(msg.has_value()); + CHECK(msg->is_response); + CHECK(msg->command_or_code == "220"); + CHECK(msg->argument == "mail.example.com ESMTP"); +} + +TEST_CASE("parse_smtp decodes a MAIL FROM command") { + auto msg = parse_smtp(to_bytes("MAIL FROM:\r\n")); + REQUIRE(msg.has_value()); + CHECK_FALSE(msg->is_response); + CHECK(msg->command_or_code == "MAIL"); + CHECK(msg->argument == "FROM:"); +} + +TEST_CASE("parse_smtp decodes a multi-line response's first line, dash included") { + auto msg = parse_smtp(to_bytes("250-mail.example.com Hello\r\n250-PIPELINING\r\n")); + REQUIRE(msg.has_value()); + CHECK(msg->command_or_code == "250"); + CHECK(msg->argument == "mail.example.com Hello"); +} + +TEST_CASE("parse_smtp rejects an unrecognized command word") { + CHECK_FALSE(parse_smtp(to_bytes("BOGUS foo\r\n")).has_value()); +} + +TEST_CASE("SmtpDissector claims port 25") { + SmtpDissector dissector; + CHECK(dissector.port() == kSmtpPort); + + auto summary = dissector.summarize(to_bytes("EHLO client.example.com\r\n")); + REQUIRE(summary.has_value()); + CHECK(*summary == "SMTP EHLO client.example.com"); +} -- cgit v1.2.3