-
Notifications
You must be signed in to change notification settings - Fork 302
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
Support Shadowserver Vulnerable SMTP server feed, fix #1984 #2037
Conversation
Codecov Report
@@ Coverage Diff @@
## develop #2037 +/- ##
===========================================
- Coverage 75.98% 75.95% -0.04%
===========================================
Files 423 427 +4
Lines 22812 22973 +161
Branches 3040 3060 +20
===========================================
+ Hits 17334 17448 +114
- Misses 4772 4817 +45
- Partials 706 708 +2
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you please add an entry in docs/user/bots.rst
in the shadowserver feed section? Thanks
otherwise ready for merge
Co-authored-by: Wagner <wagner+github@cert.at>
@@ -2862,8 +2888,9 @@ def scan_exchange_identifier(field): | |||
('Sinkhole-Events-HTTP-Referer IPv6', 'event6_sinkhole_http_referer', event46_sinkhole_http_referer), | |||
('Spam-URL', 'spam_url', spam_url), | |||
('Vulnerable-ISAKMP', 'scan_isakmp', vulnerable_isakmp), | |||
('Vulnerable-HTTP', 'scan_http', accessible_vulnerable_http), | |||
('Vulnerable-HTTP', 'scan_http_vulnerable', accessible_vulnerable_http), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Good catch, thanks!
The suggested improvement reminded me of #1984, so I also fixed that by making Vulnerable-HTTP match by |
yeah, me too - but only after you committed the other fix :)
Thanks! Didn't think that #1984 is based on such a simple mistake. |
This PR adds support for the Shadowserver Vulnerable SMTP Report and fixes #1984 by differentiating between Vulnerable-HTTP and Accessible-HTTP filenames.