Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-11 11:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

ssh: Revert half-duplex robustness

Browse source 
This reverts part of commit a0888b7e36 due
to inhibiting analyzer violations when parsing non SSH traffic when
the &restofdata path is entered.

@J-Gras reported the analyzer not being disabled when sending HTTP
traffic on port 22.

This adds the verbose analyzer.log baselines such that future improvements
of these scenarios become visible.
This commit is contained in:
Arne Welzel 2024-06-12 14:23:44 +02:00
parent a7f10df4f7
commit 5dfff4492c
5 changed files with 254 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/scripts/base/protocols/ssh/half-duplex-client.zeek
View file

@ -2,7 +2,7 @@
# analyzer.log output.
# @TEST-EXEC: zeek -r $TRACES/ssh/ssh.client-side-half-duplex.pcap %INPUT
# @TEST-EXEC: test ! -e analyzer.log
# @TEST-EXEC: btest-diff analyzer.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout

2
testing/btest/scripts/base/protocols/ssh/half-duplex-server.zeek
View file

@ -2,7 +2,7 @@
# analyzer.log output.
# @TEST-EXEC: zeek -r $TRACES/ssh/ssh.server-side-half-duplex.pcap %INPUT
# @TEST-EXEC: test ! -e analyzer.log
# @TEST-EXEC: btest-diff analyzer.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout