suricata

Commit Graph

Author	SHA1	Message	Date
Giuseppe Longo	1d7da06d9f	imap: implement parser This introduces a parser for IMAP protocol, replacing the detection-only implementation. An IMAP transaction has two states driven by the 'complete' field: - Open (complete = false): waiting for a matching tagged response. - Complete (complete = true): tagged response received, or special conditions met (BYE, server greeting). Completion logic (is_complete): - If a tagged request exists: requires a matching tagged response. - No tagged request + BYE: complete (server closing). - No tagged request + any response: complete (server greeting). Transactions are created in three places: 1. Request parser: every parsed command creates a new tx. 2. Response parser (tagged, no matching request): midstream/async; orphan tagged response gets its own tx. 3. Response parser (untagged, no incomplete tx): server greeting or unsolicited response. Once open, messages accumulate: - Request side: continuation and literal data attach to the most recent incomplete tx. - Response side: untagged responses attach to the most recent incomplete tx; tagged responses attach via find_request(tag). Literals, sent by the client (e.g. APPEND) or by the server (e.g. FETCH), are consumed incrementally and their content is not retained. Hard limits prevent unbounded growth: - IMAP_MAX_TX (256, configurable): total transactions. Exceeded: all incomplete txs force-completed with TooManyTransactions event. - IMAP_MAX_MSGS_PER_TX (512): requests per tx. Exceeded: request dropped, DataLimitReached event. - IMAP_MAX_LINES (512): response lines per tx. Exceeded: line dropped, DataLimitReached event. - IMAP_MAX_LINE_BYTES_PER_STATE (100MB): retained request and response data per flow. Exceeded: data dropped, DataLimitReached event. - IMAP_MAX_LINE_SIZE (8KB): request/response line max length. Exceeded: LineTooLong event. - Literal size: bounded by declared size in {N} specifier. IMAP_MAX_TX only is configurable limit via app-layer.protocols.imap.max-tx. Ticket #8276	21 hours ago

Author

SHA1

Message

Date

Giuseppe Longo

1d7da06d9f

imap: implement parser

This introduces a parser for IMAP protocol, replacing the
detection-only implementation.

An IMAP transaction has two states driven by the 'complete' field:
  - Open (complete = false): waiting for a matching tagged response.
  - Complete (complete = true): tagged response received, or special
    conditions met (BYE, server greeting).

  Completion logic (is_complete):
  - If a tagged request exists: requires a matching tagged response.
  - No tagged request + BYE: complete (server closing).
  - No tagged request + any response: complete (server greeting).

  Transactions are created in three places:
  1. Request parser: every parsed command creates a new tx.
  2. Response parser (tagged, no matching request): midstream/async;
     orphan tagged response gets its own tx.
  3. Response parser (untagged, no incomplete tx): server greeting or
     unsolicited response.

  Once open, messages accumulate:
  - Request side: continuation and literal data attach to the most
    recent incomplete tx.
  - Response side: untagged responses attach to the most recent
    incomplete tx; tagged responses attach via find_request(tag).

  Literals, sent by the client (e.g. APPEND) or by the server (e.g.
  FETCH), are consumed incrementally and their content is not retained.

  Hard limits prevent unbounded growth:
  - IMAP_MAX_TX (256, configurable): total transactions. Exceeded:
    all incomplete txs force-completed with TooManyTransactions event.
  - IMAP_MAX_MSGS_PER_TX (512): requests per tx. Exceeded: request
    dropped, DataLimitReached event.
  - IMAP_MAX_LINES (512): response lines per tx. Exceeded: line
    dropped, DataLimitReached event.
  - IMAP_MAX_LINE_BYTES_PER_STATE (100MB): retained request and
    response data per flow. Exceeded: data dropped, DataLimitReached
    event.
  - IMAP_MAX_LINE_SIZE (8KB): request/response line max length.
    Exceeded: LineTooLong event.
  - Literal size: bounded by declared size in {N} specifier.

  IMAP_MAX_TX only is configurable limit via app-layer.protocols.imap.max-tx.

Ticket #8276

1 Commits (1d7da06d9ff32dd6636dcb2afd0371f2dc770a20)