Skip to content

Comments

Pop3 protocol detection 6366 v6#10982

Closed
catenacyber wants to merge 2 commits intoOISF:masterfrom
catenacyber:pop3-protocol-detection-6366-v6
Closed

Pop3 protocol detection 6366 v6#10982
catenacyber wants to merge 2 commits intoOISF:masterfrom
catenacyber:pop3-protocol-detection-6366-v6

Conversation

@catenacyber
Copy link
Contributor

Link to redmine ticket:
https://redmine.openinfosecfoundation.org/issues/6366

Describe changes:

  • pop3 protocol detection

SV_BRANCH=OISF/suricata-verify#1481

Rebase of #10890 as one PR that introduces QA changes

First preliminary part for #8892 and https://redmine.openinfosecfoundation.org/issues/1125

After that :

  • See first commits of Smtp server detection 1125 v17 #8892 about generic protocol detection and see if we can craft tests to identify these bugs
  • Make eve.json stats field about flows match the count of flow with app_proto because of so many corner cases
  • Add FTP and SMTP server side detection

@suricata-qa
Copy link

WARNING:

ERROR: QA failed on SURI_TLPR1_alerts_cmp.

ERROR: QA failed on IPS_AFP_drop_chk.

field baseline test %
SURI_TLPW1_stats_chk
.app_layer.flow.ftp 52 43 82.69%
.app_layer.tx.ftp 819 188 22.95%
.app_layer.error.ftp.gap 2 0 -
.app_layer.error.ftp.parser 2 0 -
.ftp.memuse 348 3 0.86%
SURI_TLPR1_stats_chk
.memcap.pressure 57 52 91.23%
.memcap.pressure_max 62 66 106.45%
.ftp.memuse 11385 10638 93.44%
IPS_AFP_stats_chk
.ips.blocked 1395360 747360 53.56%
.ips.drop_reason.flow_drop 1296000 680400 52.5%
.ips.drop_reason.applayer_error 32400 0 -
.flow.end.state.established 583199 550799 94.44%
.flow.end.state.closed 1016272 1048672 103.19%
.flow.end.tcp_state.established 201960 169560 83.96%
.flow.end.tcp_state.closed 1016272 1048672 103.19%
.app_layer.error.exception_policy.drop_flow 32400 0 -
.app_layer.error.ftp.parser 32400 0 -
.app_layer.flow.ftp 33480 1080 3.23%
.app_layer.tx.ftp 131760 2160 1.64%
TREX_GENERIC_stats_chk
.app_layer.flow.ftp 14871 0 -
.app_layer.tx.ftp 59484 0 -
.app_layer.error.ftp.parser 14871 0 -

Pipeline 20410

@catenacyber
Copy link
Contributor Author

Merged in #11095

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs baseline update QA will need a new base line

Development

Successfully merging this pull request may close these issues.

2 participants