From 06287966a166d9a2d33a84084898009bfe86eea3 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@icir.org>
Date: Wed, 10 Jul 2013 14:19:00 -0700
Subject: [PATCH] Bringing the DPD POP3 signature back.

This also avoids the need for updating the external test suite.
---
 scripts/base/init-default.bro                       |  1 +
 scripts/base/protocols/pop3/__load__.bro            |  2 ++
 scripts/base/protocols/pop3/dpd.sig                 | 13 +++++++++++++
 .../canonified_loaded_scripts.log                   |  5 +++--
 4 files changed, 19 insertions(+), 2 deletions(-)
 create mode 100644 scripts/base/protocols/pop3/__load__.bro
 create mode 100644 scripts/base/protocols/pop3/dpd.sig

diff --git a/scripts/base/init-default.bro b/scripts/base/init-default.bro
index 6c40a7547f..6aa8ff5e26 100644
--- a/scripts/base/init-default.bro
+++ b/scripts/base/init-default.bro
@@ -41,6 +41,7 @@
 @load base/protocols/http
 @load base/protocols/irc
 @load base/protocols/modbus
+@load base/protocols/pop3
 @load base/protocols/smtp
 @load base/protocols/socks
 @load base/protocols/ssh
diff --git a/scripts/base/protocols/pop3/__load__.bro b/scripts/base/protocols/pop3/__load__.bro
new file mode 100644
index 0000000000..c5ddf0e788
--- /dev/null
+++ b/scripts/base/protocols/pop3/__load__.bro
@@ -0,0 +1,2 @@
+
+@load-sigs ./dpd.sig
diff --git a/scripts/base/protocols/pop3/dpd.sig b/scripts/base/protocols/pop3/dpd.sig
new file mode 100644
index 0000000000..8d7e3567da
--- /dev/null
+++ b/scripts/base/protocols/pop3/dpd.sig
@@ -0,0 +1,13 @@
+signature dpd_pop3_server {
+  ip-proto == tcp
+  payload /^\+OK/
+  requires-reverse-signature dpd_pop3_client
+  enable "pop3"
+  tcp-state responder
+}
+
+signature dpd_pop3_client {
+  ip-proto == tcp
+  payload /(|.*[\r\n])[[:space:]]*([uU][sS][eE][rR][[:space:]]|[aA][pP][oO][pP][[:space:]]|[cC][aA][pP][aA]|[aA][uU][tT][hH])/
+  tcp-state originator
+}
diff --git a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
index 6d6906d924..999fd7c841 100644
--- a/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
+++ b/testing/btest/Baseline/coverage.default-load-baseline/canonified_loaded_scripts.log
@@ -3,7 +3,7 @@
 #empty_field	(empty)
 #unset_field	-
 #path	loaded_scripts
-#open	2013-07-10-03-19-58
+#open	2013-07-10-21-18-31
 #fields	name
 #types	string
 scripts/base/init-bare.bro
@@ -178,6 +178,7 @@ scripts/base/init-default.bro
   scripts/base/protocols/modbus/__load__.bro
     scripts/base/protocols/modbus/consts.bro
     scripts/base/protocols/modbus/main.bro
+  scripts/base/protocols/pop3/__load__.bro
   scripts/base/protocols/smtp/__load__.bro
     scripts/base/protocols/smtp/main.bro
     scripts/base/protocols/smtp/entities.bro
@@ -194,4 +195,4 @@ scripts/base/init-default.bro
   scripts/base/protocols/tunnels/__load__.bro
   scripts/base/misc/find-checksum-offloading.bro
 scripts/policy/misc/loaded-scripts.bro
-#close	2013-07-10-03-19-58
+#close	2013-07-10-21-18-31