Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 02:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Merge remote-tracking branch 'origin/topic/awelzel/ssh-analyzer-id-existence'

Browse source 
* origin/topic/awelzel/ssh-analyzer-id-existence:
  ssh: Test for c$ssh$analyzer_id existence
This commit is contained in:
Tim Wojtulewicz 2022-11-16 14:50:58 -07:00
commit 5b57d5efd5
3 changed files with 6 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,3 +1,7 @@
5.2.0-dev.320 | 2022-11-16 14:50:58 -0700
* ssh: Test for c$ssh$analyzer_id existence (Arne Welzel, Corelight)
5.2.0-dev.317 | 2022-11-15 11:34:47 -0700
* init-bare: Fix zeek:see after bif renaming (Arne Welzel, Corelight)

2
VERSION
View file

@ -1 +1 @@
5.2.0-dev.317
5.2.0-dev.320

2
scripts/base/protocols/ssh/main.zeek
View file

@ -249,7 +249,7 @@ event ssh_auth_attempted(c: connection, authenticated: bool) &priority=5
c$ssh$auth_success = authenticated;
c$ssh$auth_attempts += 1;
if ( authenticated && disable_analyzer_after_detection )
if ( authenticated && disable_analyzer_after_detection && c$ssh?$analyzer_id )
disable_analyzer(c$id, c$ssh$analyzer_id);
}