mirror of
https://github.com/zeek/zeek.git
synced 2025-10-05 08:08:19 +00:00
ssh: Fallback to client or server selected version for parsing
In half-duplex setups (or when client/server coalesce the SSH version
line with the KEX packet, get_version() would return UNK as version,
causing a protocol violation. Make this slightly more robust by using
and setting the version which either side had set to continue parsing.
For the special case of SSH-1.99, select SSH-2.0. We could try to peak
into the payload following the packet length field and check for
a KEX_INIT type byte to select SSH2 as a heuristic, but not sure how
to accomplish this.
Slight regression fix for 3769ed6c66
which started to require visibility for client and server version
rather than just the client's version.
This commit is contained in:
parent
a0e0b7161f
commit
4f084b0b9a
11 changed files with 252 additions and 261 deletions
|
@ -5,4 +5,4 @@
|
|||
# @TEST-EXEC: btest-diff analyzer.log
|
||||
# @TEST-EXEC: btest-diff ssh.log
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
|
|
@ -5,4 +5,4 @@
|
|||
# @TEST-EXEC: btest-diff analyzer.log
|
||||
# @TEST-EXEC: btest-diff ssh.log
|
||||
# @TEST-EXEC: btest-diff conn.log
|
||||
# @TEST-EXEC: btest-diff .stdout
|
||||
# @TEST-EXEC: btest-diff weird.log
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue