public object applyOn(SpotterMultipart spotter)
{
spotter.Reset();
while (spotter.HasNextPart())
{
var s = spotter.GetNextPart();
var o = s.Accept(this);
var part = o as MailMsg;
if (part != null && !part.IsEmpty)
{
return(part);
}
spotter.UnloadPart(s);
}
return(new MailMsg());
}
public object applyOn(SpotterMultipart spotter)
{
var list = new List <MailMsg>();
spotter.Reset();
while (spotter.HasNextPart())
{
var s = spotter.GetNextPart();
var o = s.Accept(this);
var partList = o as List <MailMsg>;
if (partList != null)
{
list.AddRange(partList);
}
spotter.UnloadPart(s);
}
return(list);
}
public void TestSpotterMultipart()
{
this.FrameworkController.ProcessCapture(this.PrepareCaptureForProcessing(SnoopersPcaps.Default.webmail_webmail_yahoo_rc4_pcapng));
var conversations = this.L7Conversations.ToArray();
var pk = File.ReadAllText(PrivateKeys.Default.pk_pem);
foreach (var conversation in conversations)
{
conversation.Key = new CypherKey();
conversation.Key.ServerPrivateKey = pk;
}
this.FrameworkController.ExportData(this.AvailableSnoopers.Where(x => x is SnooperHTTP.SnooperHTTP), conversations, this.CurrentTestBaseDirectory, true);
var msgObject = this.SnooperExports.ToArray()[0].ExportObjects[9] as SnooperExportedDataObjectHTTP;
Assert.AreNotEqual(null, msgObject);
var msg = msgObject.Message;
var spotter = new SpotterMultipart(new SpotterPool());
spotter.Init(msg);
/* verify true states */
Assert.AreEqual(true, spotter.IsSpottable());
Assert.AreEqual(true, spotter.ContainsOneOf(new[] { "nieco", "Inbox" }, SpotterBase.SpotterContext.ContentValue));
Assert.AreEqual(true, spotter.Contains("successRequests", SpotterBase.SpotterContext.AllKey));
Assert.AreEqual(true, spotter.ContainsKeyValuePair("name", "msgid", SpotterBase.SpotterContext.ContentPair));
/* verify false states */
Assert.AreEqual(false, spotter.ContainsOneOf(new[] { "nieco", "ine" }, SpotterBase.SpotterContext.ContentKey));
Assert.AreEqual(false, spotter.Contains("hocico", SpotterBase.SpotterContext.AllKey));
Assert.AreEqual(false, spotter.ContainsKeyValuePair("subject", "Confidentioal", SpotterBase.SpotterContext.AllPair));
}
public object applyOn(SpotterMultipart spotter)
{
throw new NotImplementedException();
}
