You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

History

Giuseppe Longo 1d7da06d9f imap: implement parser This introduces a parser for IMAP protocol, replacing the detection-only implementation. An IMAP transaction has two states driven by the 'complete' field: - Open (complete = false): waiting for a matching tagged response. - Complete (complete = true): tagged response received, or special conditions met (BYE, server greeting). Completion logic (is_complete): - If a tagged request exists: requires a matching tagged response. - No tagged request + BYE: complete (server closing). - No tagged request + any response: complete (server greeting). Transactions are created in three places: 1. Request parser: every parsed command creates a new tx. 2. Response parser (tagged, no matching request): midstream/async; orphan tagged response gets its own tx. 3. Response parser (untagged, no incomplete tx): server greeting or unsolicited response. Once open, messages accumulate: - Request side: continuation and literal data attach to the most recent incomplete tx. - Response side: untagged responses attach to the most recent incomplete tx; tagged responses attach via find_request(tag). Literals, sent by the client (e.g. APPEND) or by the server (e.g. FETCH), are consumed incrementally and their content is not retained. Hard limits prevent unbounded growth: - IMAP_MAX_TX (256, configurable): total transactions. Exceeded: all incomplete txs force-completed with TooManyTransactions event. - IMAP_MAX_MSGS_PER_TX (512): requests per tx. Exceeded: request dropped, DataLimitReached event. - IMAP_MAX_LINES (512): response lines per tx. Exceeded: line dropped, DataLimitReached event. - IMAP_MAX_LINE_BYTES_PER_STATE (100MB): retained request and response data per flow. Exceeded: data dropped, DataLimitReached event. - IMAP_MAX_LINE_SIZE (8KB): request/response line max length. Exceeded: LineTooLong event. - Literal size: bounded by declared size in {N} specifier. IMAP_MAX_TX only is configurable limit via app-layer.protocols.imap.max-tx. Ticket #8276		1 day ago
..
Makefile.am	imap: implement parser	1 day ago
README.md	imap: implement parser	1 day ago
app-layer-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
bittorrent-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
decoder-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
dhcp-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
dnp3-events.rules	dnp3: bounds reassembly	5 months ago
dns-events.rules	…
enip-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
files.rules	…
ftp-events.rules	ftp: do not error the flow on file before port	4 months ago
http-events.rules	http1: limit the number of compression bombs per flow	4 months ago
http2-events.rules	http2: anomaly event on continuation frame without preceding headers	5 days ago
imap-events.rules	imap: implement parser	1 day ago
ipsec-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
kerberos-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
ldap-events.rules	ldap: bound the number of responses	5 months ago
mdns-events.rules	rules: add mdns rules	1 year ago
modbus-events.rules	…
mqtt-events.rules	mqtt: add too_many_properties event and limit	2 months ago
nfs-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
ntp-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
pgsql-events.rules	pgsql: bound tx.responses (configurable)	2 months ago
pop3-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
quic-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
rfb-events.rules	rfb: limit strings length	2 months ago
sctp-events.rules	decoder/sctp: extend decoder	5 months ago
sip-events.rules	rules: add sip-events.rules	5 months ago
smb-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
smtp-events.rules	smtp: recover from invalid BDAT command syntax	3 months ago
snmp-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
ssh-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
stream-events.rules	rules: SID allocation range is now documented in README.md	6 months ago
tls-events.rules	ssl: add TOO_MANY_SUBJECT_ALTERNATIVE_NAMES event	2 months ago
websocket-events.rules	rules: SID allocation range is now documented in README.md	6 months ago

README.md

Suricata Reserved SID Allocations

See https://sidallocation.org/ for more information.

Unless otherwise noted, each component or protocol is allocated 1000 signature IDs.

Components

Component	Start	End
Decoder	2200000	2200999
Firewall	2201000	2201999
Stream	2210000	2210999
Generic App-Layer	2260000	2260999

App-Layer Protocols

Protocol	Start	End
SMTP	2220000	2220999
HTTP	2221000	2221999
NTP	2222000	2222999
NFS	2223000	2223999
IPsec	2224000	2224999
SMB	2225000	2225999
Kerberos	2226000	2226999
DHCP	2227000	2227999
SSH	2228000	2228999
MQTT	2229000	2229999
TLS	2230000	2230999
QUIC	2231000	2231999
FTP	2232000	2232999
POP3	2236000	2236999
LDAP	2237000	2237999
SNMP	2238000	2238999
SCTP	2239000	2239999
DNS	2240000	2240999
PGSQL	2241000	2241999
mDNS	2242000	2242999
Bittorent	2243000	2243999
IMAP	2244000	2244999
MODBUS	2250000	2250999
DNP3	2270000	2270999
SIP	2280000	2280999
HTTP2	2290000	2290999