Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add host key support for SSH1.

Browse source
This commit is contained in:
Vlad Grigorescu 2015-01-06 21:23:18 -06:00
parent 5e206ed108
commit 245bd07af7
3 changed files with 36 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/analyzer/protocol/ssh/ssh-analyzer.pac
View file

@ -47,6 +47,18 @@ refine flow SSH_Flow += {
return true;
%}
function proc_ssh1_server_host_key(p: bytestring, e: bytestring): bool
%{
if ( ssh_server_host_key )
{
BifEvent::generate_ssh1_server_host_key(connection()->bro_analyzer(),
connection()->bro_analyzer()->Conn(),
bytestring_to_val(${p}),
bytestring_to_val(${e}));
}
return true;
%}
function proc_newkeys(): bool
%{
connection()->bro_analyzer()->ProtocolConfirmation();
@ -73,4 +85,8 @@ refine typeattr SSH1_Message += &let {
refine typeattr SSH2_Message += &let {
proc_newkeys: bool = $context.flow.proc_newkeys() &if(msg_type == MSG_NEWKEYS);
};
refine typeattr SSH1_PUBLIC_KEY += &let {
proc: bool = $context.flow.proc_ssh1_server_host_key(host_key_p.val, host_key_e.val);
};