Suricata

It may be useful to store a whole email, in raw format, as part of an SMTP extracted file.

The proposed feature adds an optional smtp flag, disabled by default, enabling raw-extraction, allowing an e-mail to be dumped in raw format, headers and eventual attachment (base64 encoded) included.
Note that, when this feature is enabled, we won't be able to match on the actual content of the attachment (as we are extracting the email in raw form, the attachment will be base64 encoded).
Of course, this will be disabled by default.

I'm a bit unsure about how to document this feature though (in case it will be accepted). Any suggestion?