Skip to content

8.0.x: smtp back ports - v1 #16043

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
jasonish wants to merge 11 commits into from
+342 −72
Closed

8.0.x: smtp back ports - v1 #16043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
40b6e6d
smtp: add firewall progress states
jasonish Jun 30, 2026
2b3dd68
smtp: complete transactions by progress state
jasonish Jul 3, 2026
02cf380
smtp: handle pipelined replies on owning tx
jasonish Jul 7, 2026
837e9f8
smtp: don't create transaction for trailing quit
jasonish Jul 8, 2026
3487974
smtp: check transaction before to-client completion
jasonish Jul 13, 2026
9f7602a
smtp: move transaction completion helpers
jasonish Jul 13, 2026
3128bc6
smtp: complete BDAT transactions at LAST
jasonish Jul 21, 2026
eb6d84b
smtp: recover from invalid BDAT command syntax
jasonish Jul 21, 2026
78299e1
smtp: assign response frames to owning transaction
jasonish Aug 11, 2026
1fd67c7
smtp: handle mid-session helo/ehlo like rset
jasonish Jul 22, 2026
0cb09e7
smtp: avoid scan-build false-positive null dereference
jasonish Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion rules/smtp-events.rules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,4 +31,6 @@ alert smtp any any -> any any (msg:"SURICATA SMTP duplicate fields"; flow:establ
alert smtp any any -> any any (msg:"SURICATA SMTP unparsable content"; flow:established,to_server; app-layer-event:smtp.unparsable_content; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220019; rev:1;)
alert smtp any any -> any any (msg:"SURICATA SMTP filename truncated"; flow:established,to_server; app-layer-event:smtp.mime_long_filename; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220020; rev:1;)
alert smtp any any -> any any (msg:"SURICATA SMTP failed protocol change"; flow:established,to_client; app-layer-event:smtp.failed_protocol_change; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220021; rev:2;)
# next sid 2220022
alert smtp any any -> any any (msg:"SURICATA SMTP invalid BDAT command"; flow:established,to_server; app-layer-event:smtp.invalid_bdat; flowint:smtp.anomaly.count,+,1; classtype:protocol-command-decode; sid:2220022; rev:1;)

# next sid 2220023
Loading
Loading