Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Smtp server detection 1125 v2.7 #11493

Closed

Conversation

catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/1125
https://redmine.openinfosecfoundation.org/issues/6821
https://redmine.openinfosecfoundation.org/issues/5491

Describe changes:

  • smtp server detection (ie to_client)
  • ftp server detection (ie to_client)
  • smtp recognize more reply codes

SV_BRANCH=OISF/suricata-verify#1894

#11333 just rebased after QA analysis
It is good to have less ftp txs that should be really IRC txs/flows...
This PR does not add IRC detection, but brings improvements nevertheless

Copy link

codecov bot commented Jul 14, 2024

Codecov Report

Attention: Patch coverage is 86.74699% with 11 lines in your changes missing coverage. Please review.

Project coverage is 82.61%. Comparing base (223a419) to head (4736267).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #11493      +/-   ##
==========================================
+ Coverage   82.56%   82.61%   +0.05%     
==========================================
  Files         938      938              
  Lines      248247   248311      +64     
==========================================
+ Hits       204961   205153     +192     
+ Misses      43286    43158     -128     
Flag Coverage Δ
fuzzcorpus 60.79% <84.05%> (+0.12%) ⬆️
livemode 18.69% <11.59%> (-0.01%) ⬇️
pcap 43.82% <81.15%> (+0.16%) ⬆️
suricata-verify 61.56% <81.15%> (+<0.01%) ⬆️
unittests 59.43% <46.98%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

WARNING:

field baseline test %
SURI_TLPW1_stats_chk
.app_layer.error.smtp.parser 409 42 10.27%
SURI_TLPR1_stats_chk
.uptime 642 663 103.27%
.app_layer.flow.smtp 335817 347574 103.5%
.app_layer.flow.failed_tcp 178240 167211 93.81%
.app_layer.tx.ftp 101030 95373 94.4%
.app_layer.error.smtp.parser 527 144 27.32%
.ftp.memuse 10637 2878 27.06%

Pipeline 21537

@victorjulien victorjulien added this to the 8.0 milestone Jul 17, 2024
@victorjulien
Copy link
Member

Merged in #11515, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs baseline update QA will need a new base line
Development

Successfully merging this pull request may close these issues.

3 participants