From b4fdce8d5b069ef4a827c9e3625cfecfbcd73b95 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Wed, 18 Sep 2024 14:05:43 +0200 Subject: [PATCH] btest/pop3: Add somewhat more elaborate testing PCAP taken from here: https://tranalyzer.com/tutorial/pop and reference added to Traces/README. --- .../conn.log | 21 ++++++++ .../scripts.base.protocols.pop3.basic/out | 48 ++++++++++++++++++ testing/btest/Traces/README | 3 ++ testing/btest/Traces/pop3/pop3.pcap | Bin 0 -> 29993 bytes .../scripts/base/protocols/pop3/basic.zeek | 20 ++++++++ 5 files changed, 92 insertions(+) create mode 100644 testing/btest/Baseline/scripts.base.protocols.pop3.basic/conn.log create mode 100644 testing/btest/Baseline/scripts.base.protocols.pop3.basic/out create mode 100644 testing/btest/Traces/pop3/pop3.pcap create mode 100644 testing/btest/scripts/base/protocols/pop3/basic.zeek diff --git a/testing/btest/Baseline/scripts.base.protocols.pop3.basic/conn.log b/testing/btest/Baseline/scripts.base.protocols.pop3.basic/conn.log new file mode 100644 index 0000000000..d123788c75 --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.pop3.basic/conn.log @@ -0,0 +1,21 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +#separator \x09 +#set_separator , +#empty_field (empty) +#unset_field - +#path conn +#open XXXX-XX-XX-XX-XX-XX +#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents +#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] +XXXXXXXXXX.XXXXXX CHhAvVGS1DHFjwGM9 192.168.0.4 26242 212.227.15.188 110 tcp - 0.050692 0 0 REJ T F 0 Sr 1 52 1 40 - +XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.0.4 26242 212.227.15.188 110 tcp - 0.060847 0 0 REJ T F 0 Sr 1 52 1 40 - +XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.0.4 26245 212.227.15.171 110 tcp - 0.050705 0 0 REJ T F 0 Sr 1 52 1 40 - +XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.0.4 26245 212.227.15.171 110 tcp - 0.050062 0 0 REJ T F 0 Sr 1 52 1 40 - +XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.0.4 26242 212.227.15.188 110 tcp - 0.050967 0 0 REJ T F 0 Sr 1 48 1 40 - +XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.0.4 26245 212.227.15.171 110 tcp - 0.047718 0 0 REJ T F 0 Sr 1 48 1 40 - +XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.0.4 26272 212.227.15.166 110 tcp pop3 0.163506 12 175 SF T F 0 ShAdDafF 6 264 6 427 - +XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.0.4 26284 212.227.15.166 110 tcp pop3 3.469839 86 205 SF T F 0 ShAdDafF 9 470 9 577 - +XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.0.4 26304 212.227.15.166 110 tcp pop3 0.206558 12 175 SF T F 0 ShAdDafF 6 264 6 427 - +XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.0.4 26308 212.227.15.166 110 tcp pop3 0.537230 96 297 SF T F 0 ShAdDafF 9 468 10 709 - +XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.0.4 26383 212.227.15.166 110 tcp pop3 1.213485 138 19651 SF T F 0 ShAdDafF 22 1030 30 20863 - +#close XXXX-XX-XX-XX-XX-XX diff --git a/testing/btest/Baseline/scripts.base.protocols.pop3.basic/out b/testing/btest/Baseline/scripts.base.protocols.pop3.basic/out new file mode 100644 index 0000000000..199ebac41b --- /dev/null +++ b/testing/btest/Baseline/scripts.base.protocols.pop3.basic/out @@ -0,0 +1,48 @@ +### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63. +CP5puj4I8PtEU4qzYg, pop3_reply, F, OK, POP server ready H mimap4 0MHoUr-1VDxRD3Ui5-003eq2 +CP5puj4I8PtEU4qzYg, pop3_request, T, CAPA, +CP5puj4I8PtEU4qzYg, pop3_reply, F, OK, Capability list follows +CP5puj4I8PtEU4qzYg, pop3_request, T, QUIT, +CP5puj4I8PtEU4qzYg, pop3_reply, F, OK, POP server signing off +C37jN32gN3y3AZzyf6, pop3_reply, F, OK, POP server ready H mimap8 0MHXFQ-1VDgSF1308-003NYq +C37jN32gN3y3AZzyf6, pop3_request, T, AUTH, +C37jN32gN3y3AZzyf6, pop3_reply, F, ERR, 1 argument required +C37jN32gN3y3AZzyf6, pop3_request, T, CAPA, +C37jN32gN3y3AZzyf6, pop3_reply, F, OK, Capability list follows +C37jN32gN3y3AZzyf6, pop3_request, T, AUTH, PLAIN +C37jN32gN3y3AZzyf6, pop3_reply, F, ERR, authentication failed +C3eiCBGOLw3VtHfOj, pop3_reply, F, OK, POP server ready H mimap9 0MK0or-1VBlin3ixZ-001RVN +C3eiCBGOLw3VtHfOj, pop3_request, T, CAPA, +C3eiCBGOLw3VtHfOj, pop3_reply, F, OK, Capability list follows +C3eiCBGOLw3VtHfOj, pop3_request, T, QUIT, +C3eiCBGOLw3VtHfOj, pop3_reply, F, OK, POP server signing off +CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, POP server ready H mimap13 0MW5rZ-1VayeZ2jFp-00XVZd +CwjjYJ2WqgTbAqiHl6, pop3_request, T, AUTH, +CwjjYJ2WqgTbAqiHl6, pop3_reply, F, ERR, 1 argument required +CwjjYJ2WqgTbAqiHl6, pop3_request, T, CAPA, +CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, Capability list follows +CwjjYJ2WqgTbAqiHl6, pop3_request, T, AUTH, PLAIN +CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, mailbox "digitalinvestigator@networksims.com" has 3 messages (19191 octets) H mimap13 +CwjjYJ2WqgTbAqiHl6, pop3_request, T, QUIT, +CwjjYJ2WqgTbAqiHl6, pop3_reply, F, OK, POP server signing off +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, POP server ready H mimap15 0LfD5x-1VsVU4327M-00pHSn +C0LAHyvtKSQHyJxIl, pop3_request, T, AUTH, +C0LAHyvtKSQHyJxIl, pop3_reply, F, ERR, 1 argument required +C0LAHyvtKSQHyJxIl, pop3_request, T, CAPA, +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, Capability list follows +C0LAHyvtKSQHyJxIl, pop3_request, T, AUTH, PLAIN +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, mailbox "digitalinvestigator@networksims.com" has 3 messages (19191 octets) H mimap15 +C0LAHyvtKSQHyJxIl, pop3_request, T, STAT, +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, 3 19191 +C0LAHyvtKSQHyJxIl, pop3_request, T, LIST, +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, +C0LAHyvtKSQHyJxIl, pop3_request, T, UIDL, +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, +C0LAHyvtKSQHyJxIl, pop3_request, T, RETR, 1 +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, +C0LAHyvtKSQHyJxIl, pop3_request, T, RETR, 2 +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, +C0LAHyvtKSQHyJxIl, pop3_request, T, RETR, 3 +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, +C0LAHyvtKSQHyJxIl, pop3_request, T, QUIT, +C0LAHyvtKSQHyJxIl, pop3_reply, F, OK, POP server signing off diff --git a/testing/btest/Traces/README b/testing/btest/Traces/README index 0b2ccd1db1..41c796d0df 100644 --- a/testing/btest/Traces/README +++ b/testing/btest/Traces/README @@ -29,3 +29,6 @@ Trace Index/Sources: - dns/dynamic-update.pcap: : Harvested from CTU-SME-11 (Experiment-VM-Microsoft-Windows7AD-1) dataset, filtering on tcp port 53. https://zenodo.org/records/7958259 (DOI 10.5281/zenodo.7958258). +- pop3/POP3.pcap: Picked up from POP tutorial on tranalyzer.com + https://tranalyzer.com/tutorial/pop + https://tranalyzer.com/download/data/pop3.pcap diff --git a/testing/btest/Traces/pop3/pop3.pcap b/testing/btest/Traces/pop3/pop3.pcap new file mode 100644 index 0000000000000000000000000000000000000000..856c498950b1c7d2bc0e4cdfc25d173aa0e9a64b GIT binary patch literal 29993 zcmeHw3z!^bnQn!IONN;MtD>N1_h$%ULZ&a(_wJbqnfr9+n(4V^BE;(M>h8*PS9Q9o zXQq=?5%97ci4u;tU3_FkSp{50S9BFwL~+qwQD;RH6=4w-0S~U{pd#my^L~GI_4I8z z69~`4K97^9d#1apzW@8a|NFno|GicD{?|VH_ooS)1ncL87X)DgKKy6q{K@gpoh9_( zZ+eZq_Nn;!;Rk;29=_Utme4Nuppea>GXfvuyNyQ8#Zh@jVMM6n*|?^)61k~(&ZG}1YwsDJmaQoi5gKARM5l^ zsD5qY)q>DJD+rH)%I)9X(15R<3!JZ(_3}j&=kGb~6!6vlrY2!0_@!5kzMMOsBfieR zrXF8e=<5%+7WD;P5l_9Bo_z{<`c2!}4Rm#RGw12eMV@X?yj@VQd0^H~TBkWo{#WH3 z5?>phSqES5!yMjToWr*hHBfcX96oTHAp8teJ~q0k5nq>azV@$|FQVu=@AMPv>x6u5 z`)qTAIlR1`^Ci{ei{|j~A6Ms)czSobOpa(T@>NXFgfv>DI)}g8GGD z{LNX`9B%koDPCYhETd$ktcN*AhqUROO`Pdlp6qi^ zD_)z^>6Q<=TAFC|?`+>9bYf(B)yQBU{bw%2kL$?r?8NKN+tRXG5PG{Ox=mVFUe=J- zmpH8-Rna;J`rx!q|A`>%nGR2xv_AOrEy56ZqF0Sp+Kya9TG{g2Dy=*Vt(-G)uF!nX zM+8Bfe0=%!Ee~z`!K?PY>mR@S{8NKIlJ~|Zw+J_YCcSFtUUTGHuI(?^r3-C8KVfRS zSISCJC9N0*mR59wCA4%}Thd#arp6~)nx-TDlXwsJjkGjHrbZ%o?~aVHiIMK`SW8oQ zbYi4`w0~@>dn!CW#*Cbzf=)}5-4y&!U~m%5(W{2Rz9Vnv3_e%M;KwE)_-iIE5Sk^a z#vF7dsVZucX^Dh6LiDLEr3G3uG1KQaV?Q`vZS1NXE0mt=2y4wuaU@ik9; zk^Av}r^enY+)seq&)mQsazDw)farDx$o-7%J=oGjqd$1$>;~>9ayOUZSREOTlKb($ zPY}ANr-n>g{{H3$E@Sr-T$0aLNpcjD$Ye`T4G6-ozWCFpF2D0pS$OWWk8k|K;yvx3 zCLVtnZWgfa`KxB;dUpSc)BQkQy3o)ke=G>L{>e!uGAWnLXJplYhd!8Ba&p|{`{MhW z8|i?r#|_`F(t(UwxC1&kGx!0^1rx6a3oQ-Y+wLbhuhUh$-T@sf&}?3M>}7Rt#Nflv ztw!M*qxD4Y=M(aQ-5oebz#8GN8cq|DZ*WfEU&ZMXI6WJj zK6B?U!Rg>+cHWhC?wwuEM%DRr%uSyMoKg4g?r3Jl8FvK>l6x#0og2;Xbp?&?L2oKH zm`=x%U0p3r=Yod^e`5xM`oUoL(_FTrRkEE8**;IQU7!_BPs$r9*qsuS3`J8}LQ>LX zd^CdcY$FG}``3JgPgRX@DIeiHq4~)-2?9~MrHo3AuG%91#&z|bDqVdZx@tp6dE)rB zCY3#hHZ*c*|IVpASeMFqpmL2#MYwz&bxnClfkQje28r$>H}K?sL1=|U{f}-ex$7E< zJabq`SDo?yZYl9{ub|%bi$A;v=E6hDjUAOCg(zNr(`xo#<3{QQfP0TU@tOY#s_&%$ z@E4C%1^}Y?aZp@40L(qhdHh%vkM9N5cT)h^i_l9{re;rX5C9%|fh^$eXqg2NU+*Tq z$i~j3_0u5#3?cvwJ2lEbd(w*PR+i@x0K~}|WI{ChC%$re1Lrq~(V^%6RY!)eQvmql zM=j?^w4QHBYp=j*-B?BI{g8&!x-)O(pG2$w17|b{CXa#^wDO@Ut$ZC?c|TdvfgplO zXU8*3?|as>Y$0iqhN6D{PWS% zID_T+0LJ-IE(o= z5HHUkEb;PnL4Bruf+`#CEH=Ve$~TRO;u}!Q_TV_ZYWS+>EWV!J^1TG8hRInxh@7Lm zSS5-QD6Xyb`L?<|hCww+&f+z3Q_}YgZWa(#_^XC5N%fO;*e@$HU*aoCe37$g#@sb> z7NQ&8V%D3RhqsUl^1SQ7Ko;I&Ze||Qii9|N>*faDVqWAzM5`1{Lfi~*(UL=)G1En& zbz#1#!3tLcT$FOZN21&eQO0TNw|NDj?N3JYMHhZjz4!6Ue!8;tYl-83MRa|jyLP&$ z207iqDixV@p`ypX*(hBk`ju1A z>*-azehE65rs<4+<7M?m#Nb13XtWJ9Kf;CWt`c@Sy=CP!lrG*Ks!SJ&;zf@&s1n-M z4leS(N|9Gy1Cb>X`PWMj8R_EdXI_2NJ2zeTf8G;`e&`)tM0e|zEy6NZ2EA$$h6D36 zoYM_eoJ!#I0!kP6{`4iJiwF7(qf3-B5+6V4Xtcqhc5?YPR>^k(?)^#Z<>#R)-;vdsu zhHU8Dt(_>*Z8G@14>#H+non^>?Wj`JEl`vJMIB4O)r!)WK-eqAM)|SY#f9yz64rpQ zpCn-)xU9w4f*QV~|BfPO{g!l3hkRNY-QV@vBLuFKIjH7Kn%VpkP zCG#gC^9=}j-+T2XCY22zU*)9^l>(>2>QXrmRJNK_9*D1I*|ieY33>2)D>p!*+sN;2 z{gogrL88ssMtkgs|DJd`{66f$A0tc~h9A@{mUq?*m0^?rQaQ_@kW1-&gUt1ypxX$ot!SOiAy3uDL3;M4Uq2@5!(59TK8-NNi9lx2?=^QOcGJ7bOl+UQJVfJIb4DzI)~qfA_wlKmYbs z@4DfPxAxxofmx#aNAH#fA#Y_br@O66MJ8RS=l~3J?Hv-L|ChgO9x zbnq4mdC#GAGDF@nXw4MN&ENVPz$^2_>o*^-;`J@i!G$!PPcU;jU#1OUV(^Sh8+G~) ze~JrR+RQAjtP3IRaSD0e@2d=XMA3L`!`hin`^r8(J)tU*k3-~bByw&AA|vDtB)09m zW^%gF|L!|JKKyHB|xFye&<{;MK3+)MyRg#TE5%m7-Gn+K&e)!C!X6JmSe1m0VfUWgk(==t-O}`<>u$QBjd+|t+Ncme{AJE#X(zU5 zb}D%62agXu{SdOAaHPm%%kUY(3|u|EYFzoy%9WhQ*H`h_4;~TXh33SEIFBt&BJ+BE zP@#(jJRwnyLrf?M8 z(yNB!YghJj6Z&Zt$1*rRL>xOmQ{vb;8W`7-aOQzY1yZy8m({O8ryVg*L6|{#~2bwj$fgoA?ZQs^tAD9lg1%?L)+ZTqh)t#P?abw3 z-T5SQIZ;x&#E|F-c|2@~)8%xwG)>Ae85hJuERoYPEECPA7wn>>#zi8?+N!_U=Mr6Z zm&+u|GRyXbyc(BPv+rt;%dAb+;&NAJSKv1bxIDTSvy-abh9+hQp(_2wHy<)CsLDc8MKK>dNVoO;1TKudjo} zx^i+_T9)GuWb)ax+`-~qmKyB&g%0qlcO}zWR7&Goqf2!A{bDc>2zWY}(xvCKSuJPm zD!+n7Q(a5R`FOt+3G@z*4#>M@15|u_$6USR_p^ z(eP-$ZAQ-N*qjaxU`|4jeDr`EGeT2Z2-mY-4KuD9wy8o^4vm^+hAkWq(S&!fXxD-M z*`b5Gz24yR+;qYr7Ut#NSiuqA6CD~J+#Q`fD9wS2`@lp%>DjU1LKAA*NFDM{Mx~MX z+;ZPoZe&>;3QSIV$23_PbPYRw&Y{_vrJ=&ou&*~cG$MO@r~1O#J`Gg*Qgh@LnWkuD=(C~|lY@g_N*~Oq82I+K{jIr8^ zO-rP2U5!oARM<$i=w4z&Q`LGz7PvKVdbI|%JRBAqA%dN7zJpBC9zCC zZ75kOXE>xZxfHZV7RjLCY~oU`(A8QxVSm{P_JBX&4!E2?Uu#QKX+*e_PUmQSW$vnS zDde=)=d0#y6FF^BO6s;SM4EBBLc`8b*5#O*)P@f(E%gONUo5IR_V#%e1AXbe^M`iC z4)r+_iOGVb$EVZtEltdIuvbp$qcbB~ZXy<$SlH1$liB0b2YbD~>HO&6(xlQqKdA53 zXOrSWVKz2AiNb?r-J{)oBS~*`IyP~@h#ZQIC1QoK-rWV=>rBt|2b~#hY{3}yj;7MR zQ#yJ6kHGUcD7OBU$ETI5Xngg)_D2p;v32x$?3{qgkER;Nk0_5H*Hp%jM-Ex>Lq(KZ z*z4_s0P{{cxMw*&7mLLu{gAI`GMrD%ER3gO!QI*Xj_}f+!9-3<&gRm61Nxo=eKWm_ zxTr@AADkO;h@xwBI+7Y)QX^tdbk9g%>VQk}9vquVD^7Jd=RKgNvKf75Y&-&sVgutd z-3Rm~U5{n717pdcBOa7S#q7|`(DINg?Cu_!Thy1wjNxf<+>sqo#{Cj5axA;176+zg z=Cc04l>eZVbd2g#G0izP>gbR8W(NG(zWMMWS2Q^49rE`Kdy;S$46lCd!=$yWY+LuD zXlb(9PGH8>%fgVC4M#RDDJp_QO3LZ7(Umt6Hh8Ym`pHSEo{)34el?~cASXlYU|vIP zwq=25F{Ef(ZfR<18j^vFVF;~kNlqiU%FNJMLCfcuDlakF#{HcXi($bT7tsY%DM?+R zGk7S>>jYdW_XgHAbXj}ck zk(3fkSrWw33PAy+oXiL2qF&CzI#ci^jsb4ZDr5Sl`K$_}K1hOL;Y9-aG8kdPNDIQm-`Hf2xa?x%~^RniP zD+xgH8SC6hrqFYyX& zx}oQfanFBsrRV>--SYg$vCW1>T;NV*4P!Hhu2={0IA(g=8A4W{ZlB#Z2CApnFe|9?U!;9V|C;hb~LGSjv&q?AcWIa-+-L zr+R`xr@uHxzj{E!>QBi_nXDvMNjpb-9 ziqg7FYcSeM4`r?O9_;_al_aHHTyH0jGbtwleZ+c+V;Qqve6J)D?a0+LSz7vPJ`)8a z?x5H0^9LBSv6=2E1|u2lVSca6>qdU&Z)xg2n3wcCK$L7qgL`XdqSGdNSP#lSHmOPR zb{0u%`DCh{^~h*Bq_8;f)riR4k?wXj&Feun3x||c{A&KIekhbO*^aX8x+(@yIOOwOVdZ9gwZoO3C>FLfts@x1a>@fC z=ZFtl#f)h=l|ot0mIp_EXf;6Eil?49Oaer^jyQ?fU~0>Xlbp#)ex_b**fdwuYUt!X zgev|MhRsR_I`iCM(#pU2muI~`yJ7L0dmuGWma zrgp1my*Bza=0o_vfdhj-p+Rt}%v*d+XTlfYlqJ5QUw zy%MMRasPWO0(kV&@irH!@{+w(+z&SGQ8#8yR(gNv4 zCk2*<9Hx1jj_oC62*uc5xprQ3oac%v>6*v-O3HN>Qk^7Vbt%<3NQSrCWGb$h>rGkr5$T9e!?`Q!q={mig1M#9mb1IMJi{iA}#66=43dpS8Q(5=`b0z z@`FxCF=1Fo(qglfS^@tmHoE8T@He@`e4y50KJ(6r*PZj*&!CsiTLI{(ko*0{(+zM? zwiTHi=eMdFO3%C#j`KQd1-$C|Vk_XnhhO*WfAHm=IQW&=^?f{{|6Nm~RzQL$^lzC>uP0X_DfJk>0cx=WR^ik!1cG1Q2d@AWhQ0wHg(x&dH|ObmojNumO1 zqdj{s_8B!~`YKg+<%Vd`!`e~cda23_QbKt(-qT1BollyGOKB6J30u!*C5rkXOvh@qhg#I7TBk+ z+DKmKg{%!HVrx)~%0T3EPvq4m730%a>!vWM4?tRJo&nV5X1Gq){UnClbTZAqH*E*?N@Z0Hzt6<`WTT z+aa$n7*8FF1-yyWp+jQA<4U=lfmlkEWnW5+%TBzBfs~ktOE}V24X%sA2fo#RKVr;M)`Z({K}s?#9JI6y-p9_+9w9)qY{)i{16dHi@wW&C({ zmlZ!gf0H1TdF?WzJCVySJN4xJb$w%H9p$FWYQ1&cm2T&2z8H8x-9hug~QR`uDrtUhmoqm>T2U1zAhjn);&mH2vY|Py`LNN`IJF z7gTLYgl3^yHs2C4~f_``G648rmIfenZkt-$Uo!Gi@ivhdS z2^c^v*22l7nhPc+QdBb=!mU>3hFv@*oo;2FYh*r1=BTl?F4QsF=Se2D*C#Zr4Dc=odZyU~jibuYvw<k*YfIYP_fs zEjOM+v$Nc%)8T>fiGEw}_}Ex~@6`BYh=t>qIJfqxmt3}WavXnQ`Qv?HPv6)jTc^@G z4!qb_?z$COPX*NzSFh3An%8ZT9#a(P%QB^@b#{BTrBXlB&@|0XKU9u~nUrA(G>rJC zzA!`SN&ouMIgaLY$rKyo6&>y8QwNK>vUpqp{=!~!JP$lf0e>J{MYjlBQh9Ww(P-nH zEfhde5T@QZwMewAp=9zIw7Sv~0Ap0h;cE@o)3#m~Z9Cir%X`6e3wD;Fml)6Ux(?Kt zo;TZ>3aC-D5^dB=b=m{V$_BcJXrY;KD0V=LBE01mfI(wHm)(5{4MdHeReIEYL?uZ# zN`M*z^+Z0$do#L`$MZSJv*Ng}EVB%9#_Ngn&18jDhAoZ5yt z+`?h7>0vs$s8GKWjHQ$$wUy*}zStiG>q8pa!ozsuvpPj>b+bg}9aQSn!jHyzRY#Pu z3rx*6S#HBUA)1;-ia^Zh*fCGX(Qq}01#-*n5DE1?I+X;5(_?9k+LmAuZ6##=OirV> zhRT@7CZbH@L5`x~(ATsHPe*uZ&ikW9ODLA;b{3|#zS$--8?$J%nw>QaB!e0tS5Oo0 z|8vBEB^p;C_WdR9M9rQrDO5+RT`h{csN~Sg!i++9V1s51TL=lXb#*&gYGccfYq*s3 zfgLh9dY~7qXN{1JQg00!A>u7faVdicP+STbsQ~?MV5iueHvR{XdTw5`qBlfwJXH zTGc~~)QJL`H>Af>Fht!}+PK1AOeVCLK`LmTsnt6Zs^+^~{A9!fc%<&K)e9K->%u*V^~8~{dGjFv71HHTwqY019iwrja00C|qd z{$3lY(c^4Ime!eqE2G~T*+5$k5EmPT9Ild5Tm_!B72b}cTZuFe$dyy!?kfdkj9DV6 zN*S517?f2RwxZ=K=&V*DvxF`Yy{yf&UN|UorEcdu>P8_g@9eyYHkTcju>o+x`ea0E zj+N2bWsa7nT?yLCNk}mux;7s!e#j{4La4P@%0zRD1U!k6Y9+idI{$FiHZkO49_Gbe z244L3;Ws{aytxsrUfg2{T2(~AxEI&bKhG)^a2g@TYgoBBPF0ZZ}l0za8u4UgPBufXJ@z(ZM9gsL1 zP*h5S>ms9T&>8}oZrG5Fn7MlY7;<#dgcJg*YN4HBdrT$9hF}Ug`ik?0OZn6gnhp-g zD1?GR;s%HuWat+=y*_uZNMDe_*y1wwy*NlGL@;3@Bb#Gz1d5D^S~JW5e_|Cq1q7-% z!EiyZXTa||;c$Em9v%4Xh(LFg(>4ga4Iy<(NoYxDVJamRpHQ8q=u5~4wI!081hkXp zdQ(}Ltdyttk#Fqz4{*<4_V5DSeqcM}jh5$k#sncvfb}wsaIWQL+P<_=(z1Sr8_)l) zECp^_oe`u30C3^PjLnC+q4{vT0W6LAky#cku4t^lee(l#evvxJ#;YmPFro4<=|r0i zeg4(8zfVc9q=9&clrVV3&Q7>V@-tcpcM4(2=zuQOiGDoq-FX- zbh>=4jAK_EbaCfJ`;hx7i7RLzIG4r)6p?C`glzS|amkSQsMe50Mol`9teOSL z;;_6iA#;%As!5`N)i~JG3QwUf(8uDsYGsS1Z%otYz7pC+V+YM5I<;J*{AhOd7;Mt? zL9IK7sw$#w7YAH!XNTPml5JTZBwIqwqqS#aMPogWd|VPvB`%y6&Dx)D|Y$9i+| zxXU`OQ)vcg%z}JrlumHt1k*#Xi{ZTSLl;{{Zt`H-fcZC+Pwr}U(o8m5>wfKO-MMz9 z3Vu$ySf$Ldex(X(Cta+rU8#Z^FgGVxtn$L3ZlwxpCta+rU8#cFNf)bYRI23p-`cox z_%5#;O3xK5-X3?|K3ns-R5>KBFe`^wed=uCC_qH?ssRyQyRty>x^(|+oL5*Kl;IHi~3cwc>YkN>NwRM6T zpRK>d2T5M#n{-Rt6SbxON!IzG%XcG+I;dOk)7@StQ|$8sn;7QI)-AN_SJ|Z*F8$F+ z-D}m`{I(VECZB0s5)m>VhRg2VGwESx>2xS^Y>~9&i=OtI{W!Rs49z46zZNT5- ze(v7d9g=g?xDEL9_qdDLAM7NM*L?P!4IYMLTS=3@`&L_}zdJV#e}~6!3eCU$ND=#U z^PUUt^7LM(j{p0!&wh~Te&L4ZMmzW!o`)}2(LKoN0{e5}1E&`I6AZaT^kOP*{;g|{=Y!7{7`xPSgMR4=U-yQkI#Qn5G;t_wF~=%aG&BOSfdT_K3=ak;0uc4ez(tu`nPOtSFCKW<#VjHUFCaL@jmV< z{9`@5kGlfzQ{;19fS*9G+t=+wsqS@GI3mt0BrQ6kBD-rayT&v$gz;31wd&VB)?+(X zH_*#rohJq3fe$SqtEx0?F?EOhQ?Lb@??BAJ~*K+Mf}d$slA?=p;&Gtyy(rO zGO6g&nonvdS|=rz_$hl3#QH%#1J1QUK9gt{=VU+_bYOz(8hU<>d;Y~r&;NRQR@qT{MBM@&M^^jnf*0M* z{BMsJ;`fl64@sasM-B$yXbrQGOt(%LSY5bq$ z+&_g|e|!7YB!GO87;6IrMBk2keu2`^cqz@{CSg1^AeWD!DT%YYP1r|q1OPw)Isl-g z7yTdF1OTOQxG(I8#8SA&q4G$>UV6I;qyPY>SHpI_f!o^6`-MyU0RSTm;jp)F3Y%GS zI%HljT3};%_5^Nj1WS7X6v;*y2rT58{h}*BLJ}^ldCEn!Tq;Hn7(rWR{~_6i5M%LK&@lyGRS~H@v{`Q z{)q&00XKChnIceU8LU{26L+HFRQ~LQN!h%!9Cx@7O0b-98eLK1N(GG65p!f^4fn1W ze<^W?KL`iAfL;5Rrb;O+`{8%*7O`<@W&s`PTMPS%Ah3@-xuJ#DQQci(vKax=BvgEe z7vNvT=Xepe6w?EM=&E@Vo)jht6z5toqAWy|fS%T^*}$i<)M}50KS_fq7S~A0l>UrQ zdwKC`;^EyCfA0)JKS;BU;VWGQ}pqw?{d zwu`Q}cC(?{bMfkJykM)aG!1KGkDN< z?^xKR^1C}%d8tF?KRJ~z)}?YDsNjE=C_thw<3=jWq1H-N`=Dout +# @TEST-EXEC: btest-diff conn.log +# @TEST-EXEC: btest-diff out +# @TEST-EXEC: test ! -f weird.log +# @TEST-EXEC: test ! -f analyzer.log + +@load base/frameworks/notice/weird +@load base/protocols/conn +@load base/protocols/pop3 + +event pop3_request(c: connection, is_orig: bool, cmd: string, arg: string) + { + print c$uid, "pop3_request", is_orig, cmd, arg; + } + +event pop3_reply(c: connection, is_orig: bool, cmd: string, arg: string) + { + print c$uid, "pop3_reply", is_orig, cmd, arg; + }