Shadowserver updates
This PR:
- adds support for the IPv6 variants of the telnet and Poodle feeds from Shadowserver
- makes the
tagattribute of some feeds to theextra.tagfield of the corresponding event if it can contain non-constant data, e.gplexfor the SSDP feed rather thanssdp, or a supplementaryiottag for the FTP and telnet feeds orvpnfor FREAK - adds tests for the v6 variants of the feeds + fixes
test_broken, which was broken by the addition of the new optionalextra.tagfield
Looks good semantically. If someone can verify the correctness and ~donates a changelog line~ (fixed), this is ready for merge.
makes the
tagattribute of some feeds to theextra.tagfield of the corresponding event if it can contain non-constant data, e.gplexfor the SSDP feed rather thanssdp, or a supplementaryiottag for the FTP and telnet feeds orvpnfor FREAK
IIRC all fields which were not mapped explicitly, are saved in extra implicitly. So this changes "just" makes it explicit. https://github.com/certtools/intelmq/blob/7ebb8e16d821c372a44b077dd18a151c07f75807/intelmq/bots/parsers/shadowserver/parser.py#L202-L209
Codecov Report
Merging #2124 (467a36d) into develop (7ebb8e1) will increase coverage by
0.03%. The diff coverage is100.00%.
@@ Coverage Diff @@
## develop #2124 +/- ##
===========================================
+ Coverage 75.94% 75.98% +0.03%
===========================================
Files 440 442 +2
Lines 23624 23662 +38
Branches 3153 3439 +286
===========================================
+ Hits 17941 17979 +38
Misses 4952 4952
Partials 731 731
| Impacted Files | Coverage Δ | |
|---|---|---|
| intelmq/bots/parsers/shadowserver/_config.py | 98.73% <ø> (ø) |
|
| ...lmq/tests/bots/parsers/shadowserver/test_broken.py | 100.00% <100.00%> (ø) |
|
| ...bots/parsers/shadowserver/test_scan6_ssl_poodle.py | 100.00% <100.00%> (ø) |
|
| ...sts/bots/parsers/shadowserver/test_scan6_telnet.py | 100.00% <100.00%> (ø) |
@elsif2 for review
The above changes are superseded by #2143.
@elsif2 Reminder on this PR as well.
Thank you for your contribution. This PR has been obsoleted by recent updates. All Shadowserver reports are now supported in the current develop branch and will be included in the 3.1.0 release.