<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span>Somebody said that they couldn't find the version 5.0.0-dev. I got it from GitHub about more than one month ago.</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><br>
</span></div>
<div style="color: rgb(0, 0, 0); font-family: Calibri,Helvetica,sans-serif; font-size: 12pt;">
<span><span>/* the name of our binary */<br>
</span>
<div>#define PROG_NAME "Suricata"</div>
<div>#define PROG_VER "5.0.0-dev"<br>
</div>
</span></div>
<div>
<div id="appendonsend"></div>
<div style="color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font color="#000000" face="Calibri, sans-serif" style="font-size:11pt"><b>发件人:</b> Ma Allen <mazhh@outlook.com><br>
<b>发送时间:</b> 2019年3月14日 10:59<br>
<b>收件人:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>主题:</b> Does anybody test IMAP protocol dection under version 5.0.0-dev? I guess it may not work.</font>
<div> </div>
</div>
<div dir="ltr">
<div style="color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
<span>In AppLayerParserRegisterProtocolParsers(),</span></div>
<div style="color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
<span><br>
</span></div>
<div style="color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif; font-size:12pt">
<span><span> /** IMAP */<br>
</span>
<div> AppLayerProtoDetectRegisterProtocol(ALPROTO_IMAP, "imap");</div>
<div> if (AppLayerProtoDetectConfProtoDetectionEnabled("tcp", "imap")) {</div>
<div> if (<span style="color:rgb(200,38,19)">AppLayerProtoDetectPMRegisterPatternCS</span>(IPPROTO_TCP, ALPROTO_IMAP,</div>
<div> "1|20|capability", 12, 0, STREAM_TOSERVER) < 0)</div>
<div> {</div>
<div> SCLogInfo("imap proto registration failure\n");</div>
<div> exit(EXIT_FAILURE);</div>
<div> }</div>
<div> } else {</div>
<div> SCLogInfo("Protocol detection and parser disabled for %s protocol.",</div>
<div> "imap");</div>
<div><span> }</span></div>
<div><br>
</div>
<div><span style="color:rgb(0,0,0)">As </span><span style="border-color:rgb(200,38,19); color:rgb(0,0,0); font-family:Calibri,Helvetica,sans-serif; margin-top:0px; margin-bottom:0px; font-size-adjust:none; font-stretch:100%">AppLayerProtoDetectPMRegisterPatternCS</span><span style="border-bottom-color:rgb(200,38,19); border-left-color:rgb(200,38,19); border-right-color:rgb(200,38,19); border-top-color:rgb(200,38,19); color:rgb(200,38,19); font-family:Calibri,Helvetica,sans-serif; font-size-adjust:none; font-stretch:100%; margin-bottom:0px; margin-top:0px"><font color="#b00000"><span style="color:rgb(0,0,0)">()
is used, 5.0.0-dev will use the pattern "capability" case-sensitively to detect whether the protocol is IMAP.</span></font></span></div>
</span></div>
</div>
</div>
</body>
</html>