Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Logic fix for ssh/main.bro when the auth status is indeterminate, and fix a test. Addresses BIT-1641.

Browse source
This commit is contained in:
Vlad Grigorescu 2016-10-13 16:33:48 -05:00
parent 7caf2d0356
commit 70aaffbaac
2 changed files with 24 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/base/protocols/ssh/main.bro
View file

@ -248,22 +248,36 @@ event ssh_capabilities(c: connection, cookie: string, capabilities: Capabilities
server_caps$server_host_key_algorithms); server_caps$server_host_key_algorithms);
} }
event connection_state_remove(c: connection) &priority=-5 event connection_state_remove(c: connection)
{ {
if ( c?$ssh && !c$ssh$logged && c$ssh?$client && c$ssh?$server && c$ssh?$auth_success ) if ( c?$ssh && !c$ssh$logged )
{
# Do we have enough information to make a determination about auth success?
if ( c$ssh?$client && c$ssh?$server && c$ssh?$auth_success )
{ {
# Success get logged immediately. To protect against a race condition, we'll double check: # Success get logged immediately. To protect against a race condition, we'll double check:
if ( c$ssh$auth_success ) if ( c$ssh$auth_success )
return; return;
# Now that we know it's a failure, we'll set the field, raise the event, and log it. # Now that we know it's a failure, we'll set the field, and raise the event.
c$ssh$auth_success = F; c$ssh$auth_success = F;
event SSH::ssh_auth_failed(c); event SSH::ssh_auth_failed(c);
}
# If not, we'll just log what we have
else
{
c$ssh$logged = T; c$ssh$logged = T;
Log::write(SSH::LOG, c$ssh); Log::write(SSH::LOG, c$ssh);
} }
} }
}
event ssh_auth_failed(c: connection) &priority=-5
{
c$ssh$logged = T;
Log::write(SSH::LOG, c$ssh);
}
function generate_fingerprint(c: connection, key: string) function generate_fingerprint(c: connection, key: string)
{ {

2
testing/btest/scripts/base/protocols/ssh/one-auth-fail-only.test
View file

@ -1,7 +1,7 @@
# @TEST-EXEC: bro -C -r $TRACES/ssh/sshguess.pcap %INPUT | sort >output # @TEST-EXEC: bro -C -r $TRACES/ssh/sshguess.pcap %INPUT | sort >output
# @TEST-EXEC: btest-diff output # @TEST-EXEC: btest-diff output
event ssh_auth_failed(c: connection) event SSH::ssh_auth_failed(c: connection)
{ {
print c$uid; print c$uid;
} }