suricata
suricata copied to clipboard
Pop3 protocol detection 6366 v6
Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/6366
Describe changes:
- pop3 protocol detection
SV_BRANCH=https://github.com/OISF/suricata-verify/pull/1481
Rebase of #10890 as one PR that introduces QA changes
First preliminary part for https://github.com/OISF/suricata/pull/8892 and https://redmine.openinfosecfoundation.org/issues/1125
After that :
- See first commits of #8892 about generic protocol detection and see if we can craft tests to identify these bugs
- Make eve.json stats field about flows match the count of flow with app_proto because of so many corner cases
- Add FTP and SMTP server side detection
WARNING:
ERROR: QA failed on SURI_TLPR1_alerts_cmp.
ERROR: QA failed on IPS_AFP_drop_chk.
| field | baseline | test | % |
|---|---|---|---|
| SURI_TLPW1_stats_chk | |||
| .app_layer.flow.ftp | 52 | 43 | 82.69% |
| .app_layer.tx.ftp | 819 | 188 | 22.95% |
| .app_layer.error.ftp.gap | 2 | 0 | - |
| .app_layer.error.ftp.parser | 2 | 0 | - |
| .ftp.memuse | 348 | 3 | 0.86% |
| SURI_TLPR1_stats_chk | |||
| .memcap.pressure | 57 | 52 | 91.23% |
| .memcap.pressure_max | 62 | 66 | 106.45% |
| .ftp.memuse | 11385 | 10638 | 93.44% |
| IPS_AFP_stats_chk | |||
| .ips.blocked | 1395360 | 747360 | 53.56% |
| .ips.drop_reason.flow_drop | 1296000 | 680400 | 52.5% |
| .ips.drop_reason.applayer_error | 32400 | 0 | - |
| .flow.end.state.established | 583199 | 550799 | 94.44% |
| .flow.end.state.closed | 1016272 | 1048672 | 103.19% |
| .flow.end.tcp_state.established | 201960 | 169560 | 83.96% |
| .flow.end.tcp_state.closed | 1016272 | 1048672 | 103.19% |
| .app_layer.error.exception_policy.drop_flow | 32400 | 0 | - |
| .app_layer.error.ftp.parser | 32400 | 0 | - |
| .app_layer.flow.ftp | 33480 | 1080 | 3.23% |
| .app_layer.tx.ftp | 131760 | 2160 | 1.64% |
| TREX_GENERIC_stats_chk | |||
| .app_layer.flow.ftp | 14871 | 0 | - |
| .app_layer.tx.ftp | 59484 | 0 | - |
| .app_layer.error.ftp.parser | 14871 | 0 | - |
Pipeline 20410
Merged in https://github.com/OISF/suricata/pull/11095