Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-16 05:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

BinPAC SSH analyzer basic functionality.

Browse source
This commit is contained in:
Vlad Grigorescu 2014-04-02 23:03:24 -04:00
parent 9d6c8769ea
commit 78b5f6b94b
12 changed files with 465 additions and 301 deletions
Download patch file Download diff file Expand all files Collapse all files

25
src/analyzer/protocol/ssh/ssh-analyzer.pac Normal file
View file

@ -0,0 +1,25 @@
# Generated by binpac_quickstart
refine flow SSH_Flow += {
function proc_ssh_version(msg: SSH_Version): bool
%{
BifEvent::generate_ssh_version(connection()->bro_analyzer(), connection()->bro_analyzer()->Conn(), ${msg.is_orig},
bytestring_to_val(${msg.version}));
return true;
%}
function proc_newkeys(): bool
%{
connection()->bro_analyzer()->ProtocolConfirmation();
return true;
%}
};
refine typeattr SSH_Version += &let {
proc: bool = $context.flow.proc_ssh_version(this);
};
refine typeattr SSH_Message += &let {
proc_newkeys: bool = $context.flow.proc_newkeys() &if(msg_type == SSH_MSG_NEWKEYS);
};