Project

General

Profile

Actions
Copy link

Bug #7709

closed
JY VJ

pop3: parse error blocks sessions

Bug #7709: pop3: parse error blocks sessions

Added by jun yuan about 1 year ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
8.0.3
Affected Versions:
8.0.0
Effort:
Difficulty:
Label:

Description

Remove all the rules and only one udp will be retained, and the email will not be received.

Files

Download all files
stop.pcapng (11.8 KB) stop.pcapng stop suricata jun yuan, 05/15/2025 12:23 AM
run.pcapng (3.55 KB) run.pcapng run suricata jun yuan, 05/15/2025 12:23 AM

Related issues 1 (1 open — 0 closed)

Related to Suricata - Optimization #7994: pop3: parser improvementsIn ProgressVictor JulienActions

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #1

Run in IPS mode

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #2

  • Priority changed from Normal to High

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #3

  • Status changed from New to Feedback
  • Priority changed from High to Normal
  • Target version changed from 8.0.0 to 8.0.0-rc1

Please add more detail about the test setup, the expected results, the actual results.

If possible add a pcap based test case.

JY Updated by jun yuan about 1 year ago ยท Edited Actions
Copy link Download all files
 #4

pc -- vm -- emailserver

vm run suricata in IPS mode
configure Pop3 port 110 to receive mail on PC

results:
suricata v6 Normal reception
suricata v8 Email not received

stop.pacpng means stop running suricata
run.pacpng means running suricata on vm

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #5

  • Assignee changed from OISF Dev to Victor Julien

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #6

suricata-7.0.10 Can collect emails normally

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #7

  • Priority changed from Normal to High

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #8

  • Assignee changed from Victor Julien to OISF Dev

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #9

  • Priority changed from High to Normal

@junyuan can you please leave the priority at normal. Priorities are set by the team.

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #10

Victor Julien wrote in #note-9:

@junyuan can you please leave the priority at normal. Priorities are set by the team.

ok.
Is there a solution to this problem?

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #11

pop3: Use version 8.0, configure pop3 port 110, and no emails can be received
Is there any progress in this issue?

JY Updated by jun yuan about 1 year ago Actions
Copy link
 #12

  • File stop.pcapng added
  • File run.pcapng added

Victor Julien wrote in #note-3:

Please add more detail about the test setup, the expected results, the actual results.

If possible add a pcap based test case.

pop3: Use version 8.0, configure pop3 port 110, and no emails can be received
Is there any progress in this issue?

pc -- vm -- emailserver

vm run suricata in IPS mode
configure Pop3 port 110 to receive mail on PC

results:
suricata v6 Normal reception
suricata v8 Email not received

stop.pacpng means stop running suricata
run.pacpng means running suricata on vm

JL Updated by Jeff Lucovsky about 1 year ago Actions
Copy link
 #13

  • File deleted (run.pcapng)

JL Updated by Jeff Lucovsky about 1 year ago Actions
Copy link
 #14

  • File deleted (stop.pcapng)

JL Updated by Jeff Lucovsky about 1 year ago Actions
Copy link
 #15

I deleted the 2nd set of pcaps -- they are identical to the original set.

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #16

Maybe disabling pop3 parser in suricata.yaml may help

PA Updated by Philippe Antoine about 1 year ago Actions
Copy link
 #17

  • Target version changed from 8.0.0-rc1 to 9.0.0-beta1

JY Updated by jun yuan 12 months ago Actions
Copy link
 #18

  • Status changed from Feedback to Rejected

JY Updated by jun yuan 11 months ago Actions
Copy link
 #19

  • Status changed from Rejected to In Progress

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #20

Why did you set to in progress ? Are you working on it ?

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #21

  • Affected Versions 8.0.0 added

Ok, I see the bug stop.pcapng has an app-layer-parser error on the pop3 traffic see jq .stats.app_layer.error.pop3 log/eve.json

JY Updated by jun yuan 10 months ago Actions
Copy link
 #22

  • Status changed from In Progress to Feedback

Philippe Antoine wrote in #note-21:

Ok, I see the bug stop.pcapng has an app-layer-parser error on the pop3 traffic see jq .stats.app_layer.error.pop3 log/eve.json

I have temporarily modified it using this method:
https://github.com/OISF/suricata/pull/9500/commits/1fe1af99c2200ff9947cf47d504b015e57b84a3b

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #23

  • Status changed from Feedback to Assigned

VJ Updated by Victor Julien 9 months ago Actions
Copy link
 #24

  • Status changed from Assigned to In Progress
  • Assignee changed from OISF Dev to Victor Julien

VJ Updated by Victor Julien 9 months ago Actions
Copy link
 #25

  • Status changed from In Progress to In Review

https://github.com/OISF/suricata/pull/13960 has a large patch to pop3 as well.

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #26

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #27

  • Subject changed from pop3: Use version 8.0, configure pop3 port 110, and no emails can be received to pop3: parse error blocks sessions
  • Target version changed from 9.0.0-beta1 to 8.0.3

Treating this as the backport ticket for the improvements done as part of #7994.

https://github.com/OISF/suricata/pull/14390

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #28

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: PDF Atom