Skip to content

Comments

Pop3 protocol detection 6366 v5#10890

Closed
catenacyber wants to merge 2 commits intoOISF:masterfrom
catenacyber:pop3-protocol-detection-6366-v5
Closed

Pop3 protocol detection 6366 v5#10890
catenacyber wants to merge 2 commits intoOISF:masterfrom
catenacyber:pop3-protocol-detection-6366-v5

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6366

Describe changes:

  • pop3 protocol detection

SV_BRANCH=OISF/suricata-verify#1481

Rebase of #10373 now that #10785 has been merged

First preliminary part for #8892 and https://redmine.openinfosecfoundation.org/issues/1125

This will require a QA rebaseline

After that :

  • See first commits of Smtp server detection 1125 v17 #8892 about generic protocol detection and see if we can craft tests to identify these bugs
  • Make eve.json stats field about flows match the count of flow with app_proto because of so many corner cases
  • Add FTP and SMTP server side detection

@suricata-qa
Copy link

WARNING:

ERROR: QA failed on IPS_AFP_drop_chk.

field baseline test %
SURI_TLPW1_stats_chk
.app_layer.flow.ftp 52 43 82.69%
.app_layer.tx.ftp 819 188 22.95%
.app_layer.error.ftp.gap 2 0 -
.app_layer.error.ftp.parser 2 0 -
.ftp.memuse 348 3 0.86%
SURI_TLPR1_stats_chk
.ftp.memuse 11385 10637 93.43%
IPS_AFP_stats_chk
.ips.blocked 1395360 747360 53.56%
.ips.drop_reason.flow_drop 1296000 680400 52.5%
.ips.drop_reason.applayer_error 32400 0 -
.flow.end.state.established 583199 550799 94.44%
.flow.end.state.closed 1016272 1048672 103.19%
.flow.end.tcp_state.established 201960 169560 83.96%
.flow.end.tcp_state.closed 1016272 1048672 103.19%
.app_layer.error.exception_policy.drop_flow 32400 0 -
.app_layer.error.ftp.parser 32400 0 -
.app_layer.flow.ftp 33480 1080 3.23%
.app_layer.tx.ftp 131760 2160 1.64%
TREX_GENERIC_stats_chk
.app_layer.flow.ftp 14871 0 -
.app_layer.tx.ftp 59484 0 -
.app_layer.error.ftp.parser 14871 0 -

Pipeline 20237

@catenacyber
Copy link
Contributor Author

Rebased in #10982

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants