Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 05:58:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

GH-566: fix cases where ssh_encrypted_packet event wasn't raised

Browse source 
When encrypted data was bundled within the same segment as the NewKeys
message, it wasn't not reported via a ssh_encrypted_package event as
it should have been.
This commit is contained in:
Jon Siwek 2019-09-03 17:34:24 -07:00
parent d773b6986b
commit 30da2f83d0
8 changed files with 147 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/analyzer/protocol/ssh/SSH.h
View file

@ -31,12 +31,14 @@ namespace analyzer {
binpac::SSH::SSH_Conn* interp;
void ProcessEncrypted(int len, bool orig);
void ProcessEncryptedSegment(int len, bool orig);
bool had_gap;
// Packet analysis stuff
bool auth_decision_made;
bool skipped_banner;
bool saw_encrypted_client_data;
int service_accept_size;
int userauth_failure_size;