[Oisf-devel] 回复: Oisf-devel Digest, Vol 112, Issue 5
Ma Allen
mazhh at outlook.com
Tue Apr 9 12:40:57 UTC 2019
Hi Victor,
As you mentioned in the previous email, there indeed exists an endless loop in the parser. After I corrected it, the program now runs well. Thanks very much for your valuable advice.
Best Regards,
Allen Ma
________________________________
发件人: Oisf-devel <oisf-devel-bounces at lists.openinfosecfoundation.org> 代表 oisf-devel-request at lists.openinfosecfoundation.org <oisf-devel-request at lists.openinfosecfoundation.org>
发送时间: 2019年4月8日 19:36
收件人: oisf-devel at lists.openinfosecfoundation.org
主题: Oisf-devel Digest, Vol 112, Issue 5
Send Oisf-devel mailing list submissions to
oisf-devel at lists.openinfosecfoundation.org
To subscribe or unsubscribe via the World Wide Web, visit
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
or, via email, send a message with subject or body 'help' to
oisf-devel-request at lists.openinfosecfoundation.org
You can reach the person managing the list at
oisf-devel-owner at lists.openinfosecfoundation.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Oisf-devel digest..."
Today's Topics:
1. 'pcre' misspelled as 'prce' in configure.ac (Luis Recuerda)
2. Re: [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527)
<Warning> (TmThreadDrainPacketThreads) -- [ERRCODE:
SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to
process their packets in time (Victor Julien)
----------------------------------------------------------------------
Message: 1
Date: Mon, 8 Apr 2019 08:26:55 +0200
From: Luis Recuerda <lrecuerda at gmail.com>
To: oisf-devel at lists.openinfosecfoundation.org
Subject: [Oisf-devel] 'pcre' misspelled as 'prce' in configure.ac
Message-ID:
<CA+V-yudBrELrOkuAAShPEWUsPLcnX68EGJ1LBmW2Vuu+os5K9Q at mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
---
configure.ac | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/configure.ac b/configure.ac
index 41e1b13..ed5cc6d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -670,7 +670,7 @@
# libpcre 8.35 (especially on debian) has a known issue that
results in segfaults
# see https://redmine.openinfosecfoundation.org/issues/1693
if test "$with_libpcre_libraries" = "no"; then
- PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =
8.35],[libpcre_buggy_found="yes"],[libprce_buggy_found="no"])
+ PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =
8.35],[libpcre_buggy_found="yes"],[libpcre_buggy_found="no"])
if test "$libpcre_buggy_found" = "yes"; then
echo
echo " Warning! vulnerable libpcre version 8.35 found"
@@ -732,10 +732,10 @@
case $host in
*powerpc64*)
- PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =
8.39],[libpcre_ppc64_buggy_found1="yes"],[libprce_ppc64_buggy_found1="no"])
- PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =
8.40],[libpcre_ppc64_buggy_found2="yes"],[libprce_ppc64_buggy_found2="no"])
+ PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =
8.39],[libpcre_ppc64_buggy_found1="yes"],[libpcre_ppc64_buggy_found1="no"])
+ PKG_CHECK_MODULES(LIBPCREVERSION, [libpcre =
8.40],[libpcre_ppc64_buggy_found2="yes"],[libpcre_ppc64_buggy_found2="no"])
- if test "$libprce_ppc64_buggy_found1" = "yes" || test
"$libprce_ppc64_buggy_found2"; then
+ if test "$libpcre_ppc64_buggy_found1" = "yes" || test
"$libpcre_ppc64_buggy_found2"; then
# on powerpc64, both gcc and clang lead to SIGILL in
# unittests when jit is enabled.
pcre_jit_available="no, pcre 8.39/8.40 jit disabled
for powerpc64"
--
2.5.5
--
Luis Recuerda Santiago
lrec at titan.homeip.net
lrecuerda at gmail.com
------------------------------
Message: 2
Date: Mon, 8 Apr 2019 13:36:26 +0200
From: Victor Julien <lists at inliniac.net>
To: oisf-devel at lists.openinfosecfoundation.org
Subject: Re: [Oisf-devel] [8778] 7/4/2019 -- 14:26:53 -
(tm-threads.c:1527) <Warning> (TmThreadDrainPacketThreads) --
[ERRCODE: SC_ERR_SHUTDOWN(188)] - unable to get all packet threads to
process their packets in time
Message-ID: <a34815b4-1607-dab8-fd36-568717fd4126 at inliniac.net>
Content-Type: text/plain; charset=utf-8
Hi,
On 07-04-19 08:52, Ma Allen wrote:
> I'm writing protocol detection & parser for IMAP atop of Suricata
> 5.0.0-dev cloned from GitHub and encountered the problem as follows:
> [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning>
> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable
> to get all packet threads to process their packets in time
>
> I use CentOS 7.0 VM inVMWare to run Suricata and assigned 2 processor
> cores + 2GB RAM to it.
>
>
> While I met the problem, top command shows that the CPU usage is almost
> full. And I wonder that if I assigned the necessary computing resources
> to the VM. However, previous POP3 extension works well under the same
> environment.
I think the most likely condition for this would be that some code in
your parser enters an endless loop. I would suggest inspecting the
program with gdb when its running to make sure its not stuck somewhere.
Regards,
Victor
> top - 14:28:26 up 5:36, 3 users, load average: 4.06, 1.84, 0.73
> Tasks: 372 total, 2 running, 370 sleeping, 0 stopped, 0 zombie
> %Cpu(s): 99.8 us, 0.2 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.0 si,
> 0.0 st
> KiB Mem : 1868688 total, 677668 free, 445832 used, 745188 buff/cache
> KiB Swap: 2097148 total, 2097148 free, 0 used. 1247408 avail Mem
>
> PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+
> COMMAND
> 8778 root 20 0 792656 273396 4968 S 199.0 14.6 5:11.97
> Suricata-Main
> 354 root 20 0 0 0 0 S 0.3 0.0 0:20.79
> kworker/0:3
> 8786 coapk 20 0 146472 2348 1456 R 0.3 0.1 0:00.34 top
> 1 root 20 0 41344 3700 2408 S 0.0 0.2 0:02.45
> systemd
> 2 root 20 0 0 0 0 S 0.0 0.0 0:00.04
> kthreadd
> 3 root 20 0 0 0 0 S 0.0 0.0 0:00.26
> ksoftirqd/0
>
>
> The whole log is attached below:
> [coapk at localhost suricata]$ sudo suricata -c ~/suricata/suricata.yaml -r
> ~/pcap/imap/imap_aliyun_outlook_short.pcapng -k none --init-errors-fatal
> [8778] 7/4/2019 -- 14:25:46 - (suricata.c:1085) <Notice> (LogVersion) --
> This is Suricata version 5.0.0-dev (rev e710b06)
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:748) <Notice>
> (RegisterImapParsers) -- Imap TCP protocol detection enabled.
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:771) <Notice>
> (RegisterImapParsers) -- No imap app-layer configuration, enabling imap
> detection TCP detection on port 143.
> [8778] 7/4/2019 -- 14:25:46 - (app-layer-imap.c:786) <Notice>
> (RegisterImapParsers) -- Registering Imap protocol parser.
> [8778] 7/4/2019 -- 14:25:46 - (output-json-imap.c:179) <Notice>
> (JsonImapLogRegister) -- Imap JSON logger registered.
> [8778] 7/4/2019 -- 14:25:47 - (output-json-imap.c:122) <Notice>
> (OutputImapLogInitSub) -- Imap log sub-module initialized.
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'HTTP.UncompressedFlash' is checked but not set. Checked in 2016396 and
> 3 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.pdf.in.http' is checked but not set. Checked in 2017150 and 5 other
> sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.JS.Obfus.Func' is checked but not set. Checked in 2017246 and 1
> other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.http.PK' is checked but not set. Checked in 2019835 and 3 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.JavaArchiveOrClass' is checked but not set. Checked in 2017756 and
> 15 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.WinHttpRequest' is checked but not set. Checked in 2019822 and 1
> other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.wininet.UA' is checked but not set. Checked in 2021312 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MS.XMLHTTP.ip.request' is checked but not set. Checked in 2022050
> and 1 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MS.XMLHTTP.no.exe.request' is checked but not set. Checked in
> 2022053 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MS.WinHttpRequest.no.exe.request' is checked but not set. Checked in
> 2022653 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.IE7.NoRef.NoCookie' is checked but not set. Checked in 2023671 and
> 11 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'et.MCOFF' is checked but not set. Checked in 2019837 and 1 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'min.gethttp' is checked but not set. Checked in 2023711 and 0 other sigs
> [8778] 7/4/2019 -- 14:25:48 - (detect-flowbits.c:480) <Warning>
> (DetectFlowbitsAnalyze) -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit
> 'ET.armwget' is checked but not set. Checked in 2024241 and 1 other sigs
> [8778] 7/4/2019 -- 14:25:52 - (tm-threads.c:2172) <Notice>
> (TmThreadWaitOnThreadInit) -- all 3 packet processing threads, 4
> management threads initialized, engine started.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice>
> (ImapProbingParser) -- Detected as ALPROTO_IMAP.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice>
> (ImapStateAlloc) -- Allocating imap state.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=00hi CAPABILITY
> , len=17
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice>
> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP
> Server Ready(10.182.157.147)
> * CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH
> AUTH=EXTERNAL
> 00hi OK CAPABILITY completed
> , len=157
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70c276cb0.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=p6hq LOGIN
> "xxx at yyy.com" "zzzzzz"
> , len=40
> [8781] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice>
> (ImapParseRequest) -- imap command login request, tx_id = 0
> [8778] 7/4/2019 -- 14:25:52 - (suricata.c:2849) <Notice>
> (SuricataMainLoop) -- Signal Received. Stopping engine.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:279) <Notice>
> (ImapProbingParser) -- Detected as ALPROTO_IMAP.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:179) <Notice>
> (ImapStateAlloc) -- Allocating imap state.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=61xu CAPABILITY
> , len=17
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:584) <Notice>
> (ImapParseResponse) -- Parsing imap response: input=* OK AliYun IMAP
> Server Ready(10.182.157.147)
> * CAPABILITY IMAP4rev1 IDLE XLIST UIDPLUS ID SASL-IR AUTH=XOAUTH
> AUTH=EXTERNAL
> 61xu OK CAPABILITY completed
> , len=157
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:661) <Notice>
> (ImapGetTx) -- Requested tx ID 0.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:666) <Notice>
> (ImapGetTx) -- Transaction 0 found, returning tx object 0x7fe70827e870.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:652) <Notice>
> (ImapGetTxCnt) -- Current tx count is 1.
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:472) <Notice>
> (ImapParseRequest) -- Parsing imap request: input=ic9a LOGIN
> "xxx at yyy.com" "zzzzzz"
> , len=40
> [8780] 7/4/2019 -- 14:25:52 - (app-layer-imap.c:535) <Notice>
> (ImapParseRequest) -- imap command login request, tx_id = 0
> [8778] 7/4/2019 -- 14:26:53 - (tm-threads.c:1527) <Warning>
> (TmThreadDrainPacketThreads) -- [ERRCODE: SC_ERR_SHUTDOWN(188)] - unable
> to get all packet threads to process their packets in time
>
>
>
> [coapk at localhost suricata]$ suricata --build-info
> This is Suricata version 5.0.0-dev (rev e710b06)
> Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG
> LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA
> HAVE_LIBJANSSON TLS MAGIC RUST
> SIMD support: SSE_4_2 SSE_4_1 SSE_3
> Atomic intrisics: 1 2 4 8 16 byte(s)
> 64-bits, Little-endian architecture
> GCC version 4.8.5 20150623 (Red Hat 4.8.5-36), C version 199901
> compiled with _FORTIFY_SOURCE=0
> L1 cache line size (CLS)=64
> thread local storage method: __thread
> compiled with LibHTP v0.5.28, linked against LibHTP v0.5.28
>
> Suricata Configuration:
> AF_PACKET support: yes
> eBPF support: no
> XDP support: no
> PF_RING support: no
> NFQueue support: yes
> NFLOG support: no
> IPFW support: no
> Netmap support: no
> DAG enabled: no
> Napatech enabled: no
> WinDivert enabled: no
>
> Unix socket enabled: yes
> Detection enabled: yes
>
> Libmagic support: yes
> libnss support: yes
> libnspr support: yes
> libjansson support: yes
> liblzma support: no
> hiredis support: no
> hiredis async with libevent: no
> Prelude support: no
> PCRE jit: yes
> LUA support: yes
> libluajit: no
> libgeoip: no
> Non-bundled htp: no
> Old barnyard2 support: no
> Hyperscan support: no
> Libnet support: yes
> liblz4 support: no
>
> Rust support: yes (default)
> Rust strict mode: no
> Rust debug mode: no
> Rust compiler: rustc 1.32.0
> Rust cargo: cargo 1.32.0
>
> Install suricatasc: yes
> Install suricata-update: no
>
> Profiling enabled: no
> Profiling locks enabled: no
>
> Development settings:
> Coccinelle / spatch: no
> Unit tests enabled: no
> Debug output enabled: no
> Debug validation enabled: no
>
> Generic build parameters:
> Installation prefix: /usr
> Configuration directory: /etc/suricata/
> Log directory: /var/log/suricata/
>
> --prefix /usr
> --sysconfdir /etc
> --localstatedir /var
> --datarootdir /usr/share
>
> Host: x86_64-unknown-linux-gnu
> Compiler: gcc (exec name) / gcc (real)
> GCC Protect enabled: no
> GCC march native enabled: yes
> GCC Profile enabled: no
> Position Independent Executable enabled: no
> CFLAGS -g -O2 -march=native
> -I${srcdir}/../rust/gen/c-headers
> PCAP_CFLAGS
> SECCFLAGS
>
> Best Regards,
> Allen Ma
>
> _______________________________________________
> Suricata IDS Devel mailing list: oisf-devel at openinfosecfoundation.org
> Site: http://suricata-ids.org | Participate: http://suricata-ids.org/participate/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
> Redmine: https://redmine.openinfosecfoundation.org/
>
--
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------
------------------------------
Subject: Digest Footer
_______________________________________________
Oisf-devel mailing list
Oisf-devel at lists.openinfosecfoundation.org
https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
------------------------------
End of Oisf-devel Digest, Vol 112, Issue 5
******************************************
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20190409/5742d7a8/attachment-0001.html>
More information about the Oisf-devel
mailing list