<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span>Hi Victor,</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><br>
</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span>As you mentioned in the previous email, there indeed exists an endless loop in the parser. After I corrected it, the program now runs well. Thanks very much for your valuable advice.</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><br>
</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span>Best Regards,</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span>Allen Ma</span></div>
<div>
<div style="color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>发件人:</b> Oisf-devel <oisf-devel-bounces@lists.openinfosecfoundation.org> 代表 oisf-devel-request@lists.openinfosecfoundation.org <oisf-devel-request@lists.openinfosecfoundation.org><br>
<b>发送时间:</b> 2019年4月8日 19:36<br>
<b>收件人:</b> oisf-devel@lists.openinfosecfoundation.org<br>
<b>主题:</b> Oisf-devel Digest, Vol 112, Issue 5</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Send Oisf-devel mailing list submissions to<br>
oisf-devel@lists.openinfosecfoundation.org<br>
<br>
To subscribe or unsubscribe via the World Wide Web, visit<br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
or, via email, send a message with subject or body 'help' to<br>
oisf-devel-request@lists.openinfosecfoundation.org<br>
<br>
You can reach the person managing the list at<br>
oisf-devel-owner@lists.openinfosecfoundation.org<br>
<br>
When replying, please edit your Subject line so it is more specific<br>
than "Re: Contents of Oisf-devel digest..."<br>
<br>
<br>
Today's Topics:<br>
<br>
1. 'pcre' misspelled as 'prce' in configure.ac (Luis Recuerda)<br>
2. Re: [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527)<br>
<Warning> (TmThreadDrainPacketThreads) -- [ERRCODE:<br>
SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to<br>
process their packets in time (Victor Julien)<br>
<br>
<br>
----------------------------------------------------------------------<br>
<br>
Message: 1<br>
Date: Mon, 8 Apr 2019 08:26:55 +0200<br>
From: Luis Recuerda <lrecuerda@gmail.com><br>
To: oisf-devel@lists.openinfosecfoundation.org<br>
Subject: [Oisf-devel] 'pcre' misspelled as 'prce' in configure.ac<br>
Message-ID:<br>
<CA+V-yudBrELrOkuAAShPEWUsPLcnX68EGJ1LBmW2Vuu+os5K9Q@mail.gmail.com><br>
Content-Type: text/plain; charset="UTF-8"<br>
<br>
---<br>
configure.ac | 8 ++++----<br>
1 file changed, 4 insertions(+), 4 deletions(-)<br>
<br>
diff --git a/configure.ac b/configure.ac<br>
index 41e1b13..ed5cc6d 100644<br>
--- a/configure.ac<br>
+++ b/configure.ac<br>
@@ -670,7 +670,7 @@<br>
# libpcre 8.35 (especially on debian) has a known issue that<br>
results in segfaults<br>
# see <a href="https://redmine.openinfosecfoundation.org/issues/1693">https://redmine.openinfosecfoundation.org/issues/1693</a><br>
if test "$with_libpcre_libraries" = "no"; then<br>
- PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =<br>
8.35],[libpcre_buggy_found="yes"],[libprce_buggy_found="no"])<br>
+ PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =<br>
8.35],[libpcre_buggy_found="yes"],[libpcre_buggy_found="no"])<br>
if test "$libpcre_buggy_found" = "yes"; then<br>
echo<br>
echo " Warning! vulnerable libpcre version 8.35 found"<br>
@@ -732,10 +732,10 @@<br>
<br>
case $host in<br>
*powerpc64*)<br>
- PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =<br>
8.39],[libpcre_ppc64_buggy_found1="yes"],[libprce_ppc64_buggy_found1="no"])<br>
- PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =<br>
8.40],[libpcre_ppc64_buggy_found2="yes"],[libprce_ppc64_buggy_found2="no"])<br>
+ PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =<br>
8.39],[libpcre_ppc64_buggy_found1="yes"],[libpcre_ppc64_buggy_found1="no"])<br>
+ PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =<br>
8.40],[libpcre_ppc64_buggy_found2="yes"],[libpcre_ppc64_buggy_found2="no"])<br>
<br>
- if test "$libprce_ppc64_buggy_found1" = "yes" || test<br>
"$libprce_ppc64_buggy_found2"; then<br>
+ if test "$libpcre_ppc64_buggy_found1" = "yes" || test<br>
"$libpcre_ppc64_buggy_found2"; then<br>
# on powerpc64, both gcc and clang lead to SIGILL in<br>
# unittests when jit is enabled.<br>
pcre_jit_available="no, pcre 8.39/8.40 jit disabled<br>
for powerpc64"<br>
-- <br>
2.5.5<br>
<br>
<br>
-- <br>
Luis Recuerda Santiago<br>
<br>
lrec@titan.homeip.net<br>
lrecuerda@gmail.com<br>
<br>
<br>
------------------------------<br>
<br>
Message: 2<br>
Date: Mon, 8 Apr 2019 13:36:26 +0200<br>
From: Victor Julien <lists@inliniac.net><br>
To: oisf-devel@lists.openinfosecfoundation.org<br>
Subject: Re: [Oisf-devel] [8778] 7/4/2019 -- 14:26:53 -<br>
(tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) --<br>
[ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to<br>
process their packets in time<br>
Message-ID: <a34815b4-1607-dab8-fd36-568717fd4126@inliniac.net><br>
Content-Type: text/plain; charset=utf-8<br>
<br>
Hi,<br>
<br>
On 07-04-19 08:52, Ma Allen wrote:<br>
> I'm writing protocol detection & parser for IMAP atop of Suricata<br>
> 5.0.0-dev cloned from GitHub and encountered the problem as follows:<br>
> [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning><br>
> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable<br>
> to get all packet threads to process their packets in time<br>
> <br>
> I use CentOS 7.0 VM inVMWare to run Suricata and assigned 2 processor<br>
> cores + 2GB RAM to it.<br>
> <br>
> <br>
> While I met the problem, top command shows that the CPU usage is almost<br>
> full. And I wonder that if I assigned the necessary computing resources<br>
> to the VM. However, previous POP3 extension works well under the same<br>
> environment. <br>
<br>
I think the most likely condition for this would be that some code in<br>
your parser enters an endless loop. I would suggest inspecting the<br>
program with gdb when its running to make sure its not stuck somewhere.<br>
<br>
Regards,<br>
Victor<br>
<br>
<br>
<br>
> top - 14:28:26 up 5:36, 3 users, load average: 4.06, 1.84, 0.73<br>
> Tasks: 372 total, 2 running, 370 sleeping, 0 stopped, 0 zombie<br>
> %Cpu(s): 99.8 us, 0.2 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si,<br>
> 0.0 st<br>
> KiB Mem : 1868688 total, 677668 free, 445832 used, 745188 buff/cache<br>
> KiB Swap: 2097148 total, 2097148 free, 0 used. 1247408 avail Mem<br>
> <br>
> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+<br>
> COMMAND<br>
> 8778 root 20 0 792656 273396 4968 S 199.0 14.6 5:11.97<br>
> Suricata-Main<br>
> 354 root 20 0 0 0 0 S 0.3 0.0 0:20.79<br>
> kworker/0:3<br>
> 8786 coapk 20 0 146472 2348 1456 R 0.3 0.1 0:00.34 top<br>
> 1 root 20 0 41344 3700 2408 S 0.0 0.2 0:02.45<br>
> systemd<br>
> 2 root 20 0 0 0 0 S 0.0 0.0 0:00.04<br>
> kthreadd<br>
> 3 root 20 0 0 0 0 S 0.0 0.0 0:00.26<br>
> ksoftirqd/0<br>
> <br>
> <br>
> The whole log is attached below:<br>
> [coapk@localhost suricata]$ sudo suricata -c ~/suricata/suricata.yaml -r<br>
> ~/pcap/imap/imap_aliyun_outlook_short.pcapng -k none --init-errors-fatal<br>
> [8778] 7/4/2019 -- 14:25:46 - (suricata.c:1085) <Notice> (LogVersion) --<br>
> This is Suricata version 5.0.0-dev (rev e710b06)<br>
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:748) <Notice><br>
> (RegisterImapParsers) -- Imap TCP protocol detection enabled.<br>
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:771) <Notice><br>
> (RegisterImapParsers) -- No imap app-layer configuration, enabling imap<br>
> detection TCP detection on port 143.<br>
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:786) <Notice><br>
> (RegisterImapParsers) -- Registering Imap protocol parser.<br>
> [8778] 7/4/2019 -- 14:25:46 - (output-json-imap.c:179) <Notice><br>
> (JsonImapLogRegister) -- Imap JSON logger registered.<br>
> [8778] 7/4/2019 -- 14:25:47 - (output-json-imap.c:122) <Notice><br>
> (OutputImapLogInitSub) -- Imap log sub-module initialized.<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and<br>
> 3 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 5 other<br>
> sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1<br>
> other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017756 and<br>
> 15 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1<br>
> other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050<br>
> and 1 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in<br>
> 2022053 and 0 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in<br>
> 2022653 and 0 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and<br>
> 11 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs<br>
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning><br>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit<br>
> 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs<br>
> [8778] 7/4/2019 -- 14:25:52 - (tm-threads.c:2172) <Notice><br>
> (TmThreadWaitOnThreadInit) -- all 3 packet processing threads, 4<br>
> management threads initialized, engine started.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice><br>
> (ImapProbingParser) -- Detected as ALPROTO_IMAP.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice><br>
> (ImapStateAlloc) -- Allocating imap state.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice><br>
> (ImapParseRequest) -- Parsing imap request: input=00hi CAPABILITY<br>
> , len=17<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice><br>
> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP<br>
> Server Ready(10.182.157.147)<br>
> * CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH<br>
> AUTH=EXTERNAL<br>
> 00hi OK CAPABILITY completed<br>
> , len=157<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice><br>
> (ImapParseRequest) -- Parsing imap request: input=p6hq LOGIN<br>
> "xxx@yyy.com" "zzzzzz"<br>
> , len=40<br>
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice><br>
> (ImapParseRequest) -- imap command login request, tx_id = 0<br>
> [8778] 7/4/2019 -- 14:25:52 - (suricata.c:2849) <Notice><br>
> (SuricataMainLoop) -- Signal Received. Stopping engine.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice><br>
> (ImapProbingParser) -- Detected as ALPROTO_IMAP.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice><br>
> (ImapStateAlloc) -- Allocating imap state.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice><br>
> (ImapParseRequest) -- Parsing imap request: input=61xu CAPABILITY<br>
> , len=17<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice><br>
> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP<br>
> Server Ready(10.182.157.147)<br>
> * CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH<br>
> AUTH=EXTERNAL<br>
> 61xu OK CAPABILITY completed<br>
> , len=157<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice><br>
> (ImapGetTx) -- Requested tx ID 0.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice><br>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice><br>
> (ImapGetTxCnt) -- Current tx count is 1.<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice><br>
> (ImapParseRequest) -- Parsing imap request: input=ic9a LOGIN<br>
> "xxx@yyy.com" "zzzzzz"<br>
> , len=40<br>
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice><br>
> (ImapParseRequest) -- imap command login request, tx_id = 0<br>
> [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning><br>
> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable<br>
> to get all packet threads to process their packets in time<br>
> <br>
> <br>
> <br>
> [coapk@localhost suricata]$ suricata --build-info<br>
> This is Suricata version 5.0.0-dev (rev e710b06)<br>
> Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG<br>
> LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA<br>
> HAVE_LIBJANSSON TLS MAGIC RUST<br>
> SIMD support: SSE_4_2 SSE_4_1 SSE_3<br>
> Atomic intrisics: 1 2 4 8 16 byte(s)<br>
> 64-bits, Little-endian architecture<br>
> GCC version 4.8.5 20150623 (Red Hat 4.8.5-36), C version 199901<br>
> compiled with _FORTIFY_SOURCE=0<br>
> L1 cache line size (CLS)=64<br>
> thread local storage method: __thread<br>
> compiled with LibHTP v0.5.28, linked against LibHTP v0.5.28<br>
> <br>
> Suricata Configuration:<br>
> AF_PACKET support: yes<br>
> eBPF support: no<br>
> XDP support: no<br>
> PF_RING support: no<br>
> NFQueue support: yes<br>
> NFLOG support: no<br>
> IPFW support: no<br>
> Netmap support: no<br>
> DAG enabled: no<br>
> Napatech enabled: no<br>
> WinDivert enabled: no<br>
> <br>
> Unix socket enabled: yes<br>
> Detection enabled: yes<br>
> <br>
> Libmagic support: yes<br>
> libnss support: yes<br>
> libnspr support: yes<br>
> libjansson support: yes<br>
> liblzma support: no<br>
> hiredis support: no<br>
> hiredis async with libevent: no<br>
> Prelude support: no<br>
> PCRE jit: yes<br>
> LUA support: yes<br>
> libluajit: no<br>
> libgeoip: no<br>
> Non-bundled htp: no<br>
> Old barnyard2 support: no<br>
> Hyperscan support: no<br>
> Libnet support: yes<br>
> liblz4 support: no<br>
> <br>
> Rust support: yes (default)<br>
> Rust strict mode: no<br>
> Rust debug mode: no<br>
> Rust compiler: rustc 1.32.0<br>
> Rust cargo: cargo 1.32.0<br>
> <br>
> Install suricatasc: yes<br>
> Install suricata-update: no<br>
> <br>
> Profiling enabled: no<br>
> Profiling locks enabled: no<br>
> <br>
> Development settings:<br>
> Coccinelle / spatch: no<br>
> Unit tests enabled: no<br>
> Debug output enabled: no<br>
> Debug validation enabled: no<br>
> <br>
> Generic build parameters:<br>
> Installation prefix: /usr<br>
> Configuration directory: /etc/suricata/<br>
> Log directory: /var/log/suricata/<br>
> <br>
> --prefix /usr<br>
> --sysconfdir /etc<br>
> --localstatedir /var<br>
> --datarootdir /usr/share<br>
> <br>
> Host: x86_64-unknown-linux-gnu<br>
> Compiler: gcc (exec name) / gcc (real)<br>
> GCC Protect enabled: no<br>
> GCC march native enabled: yes<br>
> GCC Profile enabled: no<br>
> Position Independent Executable enabled: no<br>
> CFLAGS -g -O2 -march=native<br>
> -I${srcdir}/../rust/gen/c-headers<br>
> PCAP_CFLAGS<br>
> SECCFLAGS<br>
> <br>
> Best Regards,<br>
> Allen Ma<br>
> <br>
> _______________________________________________<br>
> Suricata IDS Devel mailing list: oisf-devel@openinfosecfoundation.org<br>
> Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Participate:
<a href="http://suricata-ids.org/participate/">http://suricata-ids.org/participate/</a><br>
> List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel">
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
> Redmine: <a href="https://redmine.openinfosecfoundation.org/">https://redmine.openinfosecfoundation.org/</a><br>
> <br>
<br>
<br>
-- <br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
<br>
<br>
------------------------------<br>
<br>
Subject: Digest Footer<br>
<br>
_______________________________________________<br>
Oisf-devel mailing list<br>
Oisf-devel@lists.openinfosecfoundation.org<br>
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel</a><br>
<br>
------------------------------<br>
<br>
End of Oisf-devel Digest, Vol 112, Issue 5<br>
******************************************<br>
</div>
</span></font></div>
</div>
</body>
</html>