Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

next/442/20240516/v1 #11095

Merged
merged 8 commits into from
May 20, 2024
Merged

next/442/20240516/v1 #11095

merged 8 commits into from
May 20, 2024

Conversation

victorjulien
Copy link
Member

catenacyber and others added 8 commits May 16, 2024 19:58
@catenacyber @victorjulien
http: configures libhtp to allow spaces in uri
7582b18 
Ticket: OISF#2881
@catenacyber @victorjulien
detect: checks for space in http.protcol keyword
dfdf2e2
@catenacyber @victorjulien
smtp: exit data mode if data command was rejected
ed895c0 
And the server was advertising pipelining.

Ticket: 6906
@catenacyber @victorjulien
pop3: protocol detection
2c305ba 
Ticket: OISF#6366
@catenacyber @victorjulien
ftp: protocol detection avoiding FP on POP3
f2c39fc
@jasonish @victorjulien
detect/lua: don't treat a crashed script as no match
224f55b 
If a rule script crashed, the return value was treated as a no
match. This would make a negation of the rule match and alert.

Instead cleanup and exit early if the rule script crashed and don't
run negation logic.

A stat, detect.lua.errors has been added to count how many times a
script crashes.

Also consolidates the running of the Lua script and return value
handling to a common function.

Bug: OISF#6940
@jasonish @victorjulien
detect-lua: small cleanups
6d2d8c2 
- remove unused headers
- cleanup/rename flags
@jasonish @victorjulien
rust: rename .cargo/config to .cargo/config.toml
8560564 
Addresses this warning from the Rust compiler:

warning: `../rust/.cargo/config` is deprecated in favor of `config.toml`
note: if you need to support cargo 1.38 or earlier, you can symlink `config` to `config.toml`
@codecov Codecov
Copy link

codecov bot commented May 16, 2024 •
edited

Codecov Report

Attention: Patch coverage is 77.77778% with 8 lines in your changes are missing coverage. Please review.

Project coverage is 84.09%. Comparing base (b728916) to head (8560564).

Additional details and impacted files 
@@           Coverage Diff           @@
##           master   #11095   +/-   ##
=======================================
  Coverage   84.08%   84.09%           
=======================================
  Files         925      925           
  Lines      250562   250594   +32     
=======================================
+ Hits       210687   210733   +46     
+ Misses      39875    39861   -14
Flag Coverage Δ
fuzzcorpus 64.21% <75.00%> (+<0.01%) ⬆️
livemode 19.57% <33.33%> (+<0.01%) ⬆️
pcap 46.51% <72.22%> (+0.07%) ⬆️
suricata-verify 62.79% <72.22%> (+<0.01%) ⬆️
unittests 62.21% <33.33%> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

@suricata-qa
Copy link

Information:

ERROR: QA failed on SURI_TLPW1_files_sha256.

ERROR: QA failed on SURI_TLPR1_alerts_cmp.

ERROR: QA failed on IPS_AFP_drop_chk.

field baseline test %
SURI_TLPW1_stats_chk
.app_layer.flow.ftp 52 43 82.69%
.app_layer.tx.ftp 819 188 22.95%
.app_layer.error.ftp.gap 2 0 -
.app_layer.error.ftp.parser 2 0 -
.ftp.memuse 348 3 0.86%
SURI_TLPR1_stats_chk
.ftp.memuse 11385 10637 93.43%
IPS_AFP_stats_chk
.ips.blocked 1395360 747360 53.56%
.ips.drop_reason.flow_drop 1296000 680400 52.5%
.ips.drop_reason.applayer_error 32400 0 -
.flow.end.state.established 583199 550799 94.44%
.flow.end.state.closed 1016272 1048672 103.19%
.flow.end.tcp_state.established 201960 169560 83.96%
.flow.end.tcp_state.closed 1016272 1048672 103.19%
.app_layer.error.exception_policy.drop_flow 32400 0 -
.app_layer.error.ftp.parser 32400 0 -
.app_layer.flow.ftp 33480 1080 3.23%
.app_layer.tx.ftp 131760 2160 1.64%
TREX_GENERIC_stats_chk
.app_layer.flow.ftp 14871 0 -
.app_layer.tx.ftp 59484 0 -
.app_layer.error.ftp.parser 14871 0 -

Pipeline 20659

@victorjulien
Copy link
Member Author

@ct0br0 can this get a run against the updated baseline requested here #11021 (comment) ? Thanks!

@OISF OISF deleted a comment from suricata-qa May 17, 2024
@ct0br0
Copy link

ct0br0 commented May 17, 2024 •
edited

Have a QA run going to verify it's good. Should be fine considering we already tested against the child PR #11021 a week or so ago.

@victorjulien victorjulien merged commit 8560564 into OISF:master May 20, 2024
52 checks passed
This was referenced May 20, 2024
Closed
Closed
Closed
@victorjulien victorjulien deleted the next/442/20240516/v1 branch May 20, 2024 17:59
This was referenced May 20, 2024
Closed
Closed
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jasonish jasonish jasonish approved these changes

@jufajardini jufajardini Awaiting requested review from jufajardini jufajardini is a code owner

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
5 participants
@victorjulien @suricata-qa @ct0br0 @jasonish @catenacyber