Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 01:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Change SSH.cc to use ssh_auth_attempted instead of ssh_auth_failed. Addresses BIT-1641.

Browse source
This commit is contained in:
Vlad Grigorescu 2016-10-07 16:47:52 -05:00
parent b1c3f1cd9b
commit 20aef04dc7
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/analyzer/protocol/ssh/SSH.cc
View file

@ -131,8 +131,8 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
// another packet of the same size. // another packet of the same size.
if ( len == userauth_failure_size ) if ( len == userauth_failure_size )
{ {
if ( ssh_auth_failed ) if ( ssh_auth_attempted )
BifEvent::generate_ssh_auth_failed(interp->bro_analyzer(), interp->bro_analyzer()->Conn()); BifEvent::generate_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false);
return; return;
} }
@ -140,6 +140,8 @@ void SSH_Analyzer::ProcessEncrypted(int len, bool orig)
if ( len - service_accept_size == -16 ) if ( len - service_accept_size == -16 )
{ {
auth_decision_made = true; auth_decision_made = true;
if ( ssh_auth_attempted )
BifEvent::generate_ssh_auth_attempted(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), true);
if ( ssh_auth_successful ) if ( ssh_auth_successful )
BifEvent::generate_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false); BifEvent::generate_ssh_auth_successful(interp->bro_analyzer(), interp->bro_analyzer()->Conn(), false);
return; return;