Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 10:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fixing duplicate SSH authentication failure events.

Browse source 
We now do not raise more than one failure event per connection.

Addresses BIT-1641.
This commit is contained in:
Robin Sommer 2016-08-01 08:42:36 -07:00
parent 420bef58aa
commit 176d9f23be
4 changed files with 31 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/protocol/ssh/SSH.cc
View file

@ -16,7 +16,7 @@ SSH_Analyzer::SSH_Analyzer(Connection* c)
{
interp = new binpac::SSH::SSH_Conn(this);
had_gap = false;
auth_decision_made = false;
auth_decision = AUTH_UNKNOWN;
skipped_banner = false;
service_accept_size = 0;
userauth_failure_size = 0;
@ -60,7 +60,7 @@ void SSH_Analyzer::DeliverStream(int len, const u_char* data, bool orig)
BifEvent::generate_ssh_encrypted_packet(interp->bro_analyzer(), interp->bro_analyzer()->Conn(),
orig, len);
if ( ! auth_decision_made )
if ( auth_decision != AUTH_SUCCESS )
ProcessEncrypted(len, orig);
return;
@ -105,9 +105,10 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
// -16.
if ( ! userauth_failure_size && (len + 16 == service_accept_size) )
{
auth_decision_made = true;
if ( ssh_auth_successful )
BifEvent::generate_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
auth_decision = AUTH_SUCCESS;
return;
}
@ -131,17 +132,20 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
// another packet of the same size.
if ( len == userauth_failure_size )
{
if ( ssh_auth_failed )
if ( ssh_auth_failed && auth_decision != AUTH_FAILURE )
BifEvent::generate_ssh_auth_failed(interp->bro_analyzer(), interp->bro_analyzer()->Conn());
auth_decision = AUTH_FAILURE;
return;
}
// ...or a success packet.
if ( len - service_accept_size == -16 )
{
auth_decision_made = true;
if ( ssh_auth_successful )
BifEvent::generate_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false);
auth_decision = AUTH_SUCCESS;
return;
}
}