suricata icon indicating copy to clipboard operation
suricata copied to clipboard

Pop3 protocol detection 6366 v6

Open catenacyber opened this issue 1 year ago • 1 comments

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/6366

Describe changes:

  • pop3 protocol detection

SV_BRANCH=https://github.com/OISF/suricata-verify/pull/1481

Rebase of #10890 as one PR that introduces QA changes

First preliminary part for https://github.com/OISF/suricata/pull/8892 and https://redmine.openinfosecfoundation.org/issues/1125

After that :

  • See first commits of #8892 about generic protocol detection and see if we can craft tests to identify these bugs
  • Make eve.json stats field about flows match the count of flow with app_proto because of so many corner cases
  • Add FTP and SMTP server side detection

catenacyber avatar Apr 29 '24 09:04 catenacyber

WARNING:

ERROR: QA failed on SURI_TLPR1_alerts_cmp.

ERROR: QA failed on IPS_AFP_drop_chk.

field baseline test %
SURI_TLPW1_stats_chk
.app_layer.flow.ftp 52 43 82.69%
.app_layer.tx.ftp 819 188 22.95%
.app_layer.error.ftp.gap 2 0 -
.app_layer.error.ftp.parser 2 0 -
.ftp.memuse 348 3 0.86%
SURI_TLPR1_stats_chk
.memcap.pressure 57 52 91.23%
.memcap.pressure_max 62 66 106.45%
.ftp.memuse 11385 10638 93.44%
IPS_AFP_stats_chk
.ips.blocked 1395360 747360 53.56%
.ips.drop_reason.flow_drop 1296000 680400 52.5%
.ips.drop_reason.applayer_error 32400 0 -
.flow.end.state.established 583199 550799 94.44%
.flow.end.state.closed 1016272 1048672 103.19%
.flow.end.tcp_state.established 201960 169560 83.96%
.flow.end.tcp_state.closed 1016272 1048672 103.19%
.app_layer.error.exception_policy.drop_flow 32400 0 -
.app_layer.error.ftp.parser 32400 0 -
.app_layer.flow.ftp 33480 1080 3.23%
.app_layer.tx.ftp 131760 2160 1.64%
TREX_GENERIC_stats_chk
.app_layer.flow.ftp 14871 0 -
.app_layer.tx.ftp 59484 0 -
.app_layer.error.ftp.parser 14871 0 -

Pipeline 20410

suricata-qa avatar Apr 30 '24 08:04 suricata-qa

Merged in https://github.com/OISF/suricata/pull/11095

catenacyber avatar May 20 '24 19:05 catenacyber