Skip to content

tests/imap-detection: add simple test for protocol detection - v6#1879

Closed
mmaatuq wants to merge 1 commit intoOISF:masterfrom
mmaatuq:imap-bug-2886-v6
Closed

tests/imap-detection: add simple test for protocol detection - v6#1879
mmaatuq wants to merge 1 commit intoOISF:masterfrom
mmaatuq:imap-bug-2886-v6

Conversation

@mmaatuq
Copy link
Contributor

@mmaatuq mmaatuq commented Jun 2, 2024

Ticket #2886

Redmine ticket: imap protocol detection is incomplete
Relates to this PR
changes from PR #1819 : rebase to latest master.

ticket OISF#2886

Signed-off-by: mmmaatuq <mahmoudmatook.mm@gmail.com>
@catenacyber catenacyber added the requires suricata pr Depends on a PR in Suricata label Jun 5, 2024
Copy link
Collaborator

@catenacyber catenacyber left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SV test looks good to me to show imap detection

tcp.state: closed
tcp.syn: true
tcp.tc_max_regions: 1
tcp.tcp_flags: 1b
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit : we do not need to test all these details

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit : we do not need to test all these details

should i also remove all tcp-related details?
like

-      tcp.ack: true
-      tcp.fin: true
-      tcp.psh: true
-      tcp.state: closed
-      tcp.syn: true
-      tcp.tc_max_regions: 1
-      tcp.tcp_flags: 1b
-      tcp.tcp_flags_tc: 1b
-      tcp.tcp_flags_ts: 1b
-      tcp.ts_max_regions: 1

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

indeed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires suricata pr Depends on a PR in Suricata

Development

Successfully merging this pull request may close these issues.

2 participants