手写一个C语言SMTP协议解析器：从网络抓包到提取邮件正文和附件

SMTPC语言网络协议邮件解析

于 2026-05-31 12:06:45 修改

·本内容遵循CC 4.0 BY-SA版权协议

手写一个C语言SMTP协议解析器：从网络抓包到提取邮件正文和附件

在数字化通信中，电子邮件作为最古老的互联网服务之一，其底层传输协议SMTP（Simple Mail Transfer Protocol）至今仍是技术栈中不可或缺的组成部分。对于C语言开发者和网络安全研究者而言，深入理解SMTP协议的工作机制并实现一个完整的协议解析器，不仅能提升对网络协议栈的认知水平，更能培养处理二进制数据流的实战能力。本文将带领读者从零构建一个SMTP协议解析器，涵盖从网络抓包解析到邮件内容提取的全流程，重点解决MIME格式解析、Base64解码等关键技术难点。

1. 环境准备与基础架构

1.1 开发环境配置

构建SMTP解析器需要以下核心组件：

libpcap/nids库：用于捕获或解析网络数据包
OpenSSL：提供Base64解码等加密相关功能
开发工具链：

BASH

# Ubuntu环境安装示例

sudo apt-get install build-essential libpcap-dev libssl-dev

1.2 项目目录结构

建议采用模块化设计，目录结构如下：

TEXT

smtp_parser/

├── include/ # 头文件目录

│ ├── packet.h # 数据包处理声明

│ └── mime.h # MIME解析声明

├── src/

│ ├── main.c # 程序入口

│ ├── packet.c # 包解析实现

│ └── mime.c # MIME处理实现

├── samples/ # 测试用pcap文件

└── Makefile # 构建配置

2. 数据包捕获与预处理

2.1 网络抓包接口选择

对于实时流量分析，推荐使用libpcap的API：

# include <pcap.h>

pcap_t *handle = pcap_open_live("eth0", BUFSIZ, 1, 1000, errbuf);

if (handle == NULL) {

fprintf(stderr, "Couldn't open device: %s\n", errbuf);

return 1;

}

2.2 离线文件处理

对于已捕获的.pcap文件，可使用如下处理方式：

pcap_t *handle = pcap_open_offline("sample.pcap", errbuf);

struct pcap_pkthdr header;

const u_char *packet;

while ((packet = pcap_next(handle, &header)) != NULL) {

process_packet(packet, header.len);

}

2.3 TCP流重组关键代码

由于SMTP基于TCP协议，需要处理数据包乱序和重组问题：

struct tcp_session {

uint32_t seq;

uint32_t ack_seq;

u_char *data;

size_t length;

};

void process_tcp_packet(const u_char *packet, int length) {

struct iphdr *ip_header = (struct iphdr*)(packet + sizeof(struct ethhdr));

struct tcphdr *tcp_header = (struct tcphdr*)(packet + sizeof(struct ethhdr) + ip_header->ihl*4);

int tcp_payload_length = length - sizeof(struct ethhdr) - ip_header->ihl*4 - tcp_header->doff*4;

if (tcp_payload_length <= 0) return;

// 处理TCP流重组逻辑

handle_tcp_stream(ip_header->saddr, ip_header->daddr,

tcp_header->source, tcp_header->dest,

packet + sizeof(struct ethhdr) + ip_header->ihl*4 + tcp_header->doff*4,

tcp_payload_length);

}

3. SMTP协议状态机实现

3.1 命令解析状态转移

SMTP协议采用请求-响应模式，需要实现完整的状态机：

enum smtp_state {

INIT,

HELO_RECEIVED,

MAIL_FROM_RECEIVED,

RCPT_TO_RECEIVED,

DATA_RECEIVED,

QUIT_RECEIVED

};

struct smtp_session {

enum smtp_state state;

char from[256];

char to[512];

char *data;

size_t data_len;

};

void handle_smtp_command(struct smtp_session *session, const char *command) {

if (strncmp(command, "HELO", 4) == 0 || strncmp(command, "EHLO", 4) == 0) {

session->state = HELO_RECEIVED;

} else if (strncmp(command, "MAIL FROM:", 10) == 0) {

extract_email_address(command + 10, session->from, sizeof(session->from));

session->state = MAIL_FROM_RECEIVED;

} else if (strncmp(command, "RCPT TO:", 8) == 0) {

if (session->to[0] != '\0') strcat(session->to, ",");

extract_email_address(command + 8, session->to + strlen(session->to),

sizeof(session->to) - strlen(session->to));

session->state = RCPT_TO_RECEIVED;

} else if (strncmp(command, "DATA", 4) == 0) {

session->state = DATA_RECEIVED;

} else if (strncmp(command, "QUIT", 4) == 0) {

session->state = QUIT_RECEIVED;

}

3.2 邮件头解析技术

邮件头采用键值对格式，需特殊处理多行头和编码问题：

void parse_mail_headers(const char *data, struct email *mail) {

char *line = strtok(data, "\r\n");

while (line != NULL) {

if (line[0] == '\0') break; // 空行表示头部结束

if (isspace(line[0])) {

// 处理多行头部的续行

append_header_value(mail, line + 1);

} else {

char *colon = strchr(line, ':');

if (colon != NULL) {

*colon = '\0';

char *value = colon + 1;

while (isspace(*value)) value++;

add_header(mail, line, value);

}

line = strtok(NULL, "\r\n");

}

4. MIME内容解析实战

4.1 多部分内容类型处理

现代邮件普遍采用MIME格式，需要处理multipart结构：

struct mime_part {

char *headers;

char *content;

size_t content_length;

struct mime_part *next;

};

void parse_mime_content(const char *data, const char *boundary) {

char full_boundary[128];

snprintf(full_boundary, sizeof(full_boundary), "--%s", boundary);

char *part_start = strstr(data, full_boundary);

while (part_start != NULL) {

part_start += strlen(full_boundary);

if (strncmp(part_start, "--", 2) == 0) break; // 结束边界

char *part_end = strstr(part_start, full_boundary);

if (part_end == NULL) break;

struct mime_part *part = parse_mime_part(part_start, part_end - part_start);

process_mime_part(part);

part_start = part_end;

}

4.2 Base64解码实现

邮件附件和部分正文采用Base64编码，需使用OpenSSL解码：

# include <openssl/bio.h>

# include <openssl/evp.h>

char *base64_decode(const char *input, size_t length, size_t *out_len) {

BIO *bio, *b64;

char *buffer = malloc(length);

b64 = BIO_new(BIO_f_base64());

bio = BIO_new_mem_buf(input, length);

bio = BIO_push(b64, bio);

*out_len = BIO_read(bio, buffer, length);

buffer[*out_len] = '\0';

BIO_free_all(bio);

return buffer;

}

4.3 附件提取与保存

处理Content-Disposition字段获取附件信息：

void save_attachment(const char *filename, const char *data, size_t length) {

FILE *fp = fopen(filename, "wb");

if (fp == NULL) {

perror("Failed to open file");

return;

}

fwrite(data, 1, length, fp);

fclose(fp);

printf("Saved attachment: %s (%zu bytes)\n", filename, length);

}

void process_attachment_part(struct mime_part *part) {

char *disposition = get_header_value(part->headers, "Content-Disposition");

if (disposition == NULL) return;

char *filename = extract_filename(disposition);

if (filename == NULL) return;

char *transfer_encoding = get_header_value(part->headers, "Content-Transfer-Encoding");

if (transfer_encoding && strcasecmp(transfer_encoding, "base64") == 0) {

size_t decoded_len;

char *decoded = base64_decode(part->content, part->content_length, &decoded_len);

save_attachment(filename, decoded, decoded_len);

free(decoded);

} else {

save_attachment(filename, part->content, part->content_length);

}

free(filename);

}

5. 性能优化与错误处理

5.1 内存管理策略

协议解析器需要高效处理大量网络数据，推荐采用内存池技术：

struct mem_pool {

void *blocks;

size_t block_size;

size_t used;

};

void *pool_alloc(struct mem_pool *pool, size_t size) {

if (pool->used + size > pool->block_size) {

return NULL; // 或扩展内存池

}

void *ptr = (char *)pool->blocks + pool->used;

pool->used += size;

return ptr;

}

void pool_reset(struct mem_pool *pool) {

pool->used = 0;

}

5.2 错误恢复机制

网络数据可能存在损坏，需要健壮的错误处理：

enum parse_result {

PARSE_OK,

PARSE_INCOMPLETE,

PARSE_ERROR

};

enum parse_result parse_smtp_response(const char *response) {

if (strlen(response) < 3) return PARSE_INCOMPLETE;

if (!isdigit(response[0]) || !isdigit(response[1]) || !isdigit(response[2])) {

return PARSE_ERROR;

}

if (response[3] == '-') {

return PARSE_INCOMPLETE; // 多行响应

}

return PARSE_OK;

}

5.3 多线程处理架构

对于高性能需求，可采用生产者-消费者模型：

# include <pthread.h>

# define MAX_QUEUE_SIZE 1000

struct packet_queue {

struct packet *packets[MAX_QUEUE_SIZE];

int head;

int tail;

pthread_mutex_t lock;

pthread_cond_t not_empty;

pthread_cond_t not_full;

};

void enqueue_packet(struct packet_queue *queue, struct packet *pkt) {

pthread_mutex_lock(&queue->lock);

while ((queue->tail + 1) % MAX_QUEUE_SIZE == queue->head) {

pthread_cond_wait(&queue->not_full, &queue->lock);

}

queue->packets[queue->tail] = pkt;

queue->tail = (queue->tail + 1) % MAX_QUEUE_SIZE;

pthread_cond_signal(&queue->not_empty);

pthread_mutex_unlock(&queue->lock);

}