Skip to content

Smtp server detection 1125 v2.7#11493

Closed
catenacyber wants to merge 5 commits intoOISF:masterfrom
catenacyber:smtp-server-detection-1125-v2.7
Closed

Smtp server detection 1125 v2.7#11493
catenacyber wants to merge 5 commits intoOISF:masterfrom
catenacyber:smtp-server-detection-1125-v2.7

Conversation

@catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/1125
https://redmine.openinfosecfoundation.org/issues/6821
https://redmine.openinfosecfoundation.org/issues/5491

Describe changes:

  • smtp server detection (ie to_client)
  • ftp server detection (ie to_client)
  • smtp recognize more reply codes

SV_BRANCH=OISF/suricata-verify#1894

#11333 just rebased after QA analysis
It is good to have less ftp txs that should be really IRC txs/flows...
This PR does not add IRC detection, but brings improvements nevertheless

@catenacyber catenacyber added the needs baseline update QA will need a new base line label Jul 14, 2024
@codecov
Copy link

codecov bot commented Jul 14, 2024

Codecov Report

Attention: Patch coverage is 86.74699% with 11 lines in your changes missing coverage. Please review.

Project coverage is 82.61%. Comparing base (223a419) to head (4736267).

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #11493      +/-   ##
==========================================
+ Coverage   82.56%   82.61%   +0.05%     
==========================================
  Files         938      938              
  Lines      248247   248311      +64     
==========================================
+ Hits       204961   205153     +192     
+ Misses      43286    43158     -128     
Flag Coverage Δ
fuzzcorpus 60.79% <84.05%> (+0.12%) ⬆️
livemode 18.69% <11.59%> (-0.01%) ⬇️
pcap 43.82% <81.15%> (+0.16%) ⬆️
suricata-verify 61.56% <81.15%> (+<0.01%) ⬆️
unittests 59.43% <46.98%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

WARNING:

field baseline test %
SURI_TLPW1_stats_chk
.app_layer.error.smtp.parser 409 42 10.27%
SURI_TLPR1_stats_chk
.uptime 642 663 103.27%
.app_layer.flow.smtp 335817 347574 103.5%
.app_layer.flow.failed_tcp 178240 167211 93.81%
.app_layer.tx.ftp 101030 95373 94.4%
.app_layer.error.smtp.parser 527 144 27.32%
.ftp.memuse 10637 2878 27.06%

Pipeline 21537

@victorjulien victorjulien added this to the 8.0 milestone Jul 17, 2024
@victorjulien
Copy link
Member

Merged in #11515, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

needs baseline update QA will need a new base line

Development

Successfully merging this pull request may close these issues.

3 participants