# @TEST-DOC: Test case for extracting a mail that has non-ascii text in the mail portion of the file.
#
# @TEST-EXEC: zeek -C -b -r $TRACES/smtp/rfc3030-bdat-nonascii.pcap %INPUT
# @TEST-EXEC: zeek-cut -m fuid uid mime_type seen_bytes parent_fuid sha1 < files.log > files.cut
# @TEST-EXEC: btest-diff files.cut
# @TEST-EXEC: btest-diff --binary extract_files/mail
# @TEST-EXEC: grep -q "[^\x00-\x7f]" extract_files/mail

@load base/files/hash
@load base/files/extract
@load base/protocols/smtp

redef SMTP::enable_rfc822_msg_file_analysis = T;

event file_over_new_connection(f: fa_file, c: connection, is_orig: bool)
	{
	if ( f$id == c$smtp$rfc822_msg_fuid )
		{
		Files::add_analyzer(f, Files::ANALYZER_SHA1);
		Files::add_analyzer(f, Files::ANALYZER_EXTRACT, [$extract_filename="mail"]);
		}
	}