Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 12:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

make SSH analyzer robust to half-duplex connections

Browse source
This commit is contained in:
Vern Paxson 2024-05-04 09:47:52 -07:00 • committed by Tim Wojtulewicz
parent 29f5a49baf
commit a0888b7e36
12 changed files with 170 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

8
testing/btest/scripts/base/protocols/ssh/half-duplex-client.zeek Normal file
View file

@ -0,0 +1,8 @@
# Tests processing of half-duplex client-side connections, including no
# analyzer.log output.
# @TEST-EXEC: zeek -r $TRACES/ssh/ssh.client-side-half-duplex.pcap %INPUT
# @TEST-EXEC: test ! -e analyzer.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout

8
testing/btest/scripts/base/protocols/ssh/half-duplex-server.zeek Normal file
View file

@ -0,0 +1,8 @@
# Tests processing of half-duplex server-side connections, including no
# analyzer.log output.
# @TEST-EXEC: zeek -r $TRACES/ssh/ssh.server-side-half-duplex.pcap %INPUT
# @TEST-EXEC: test ! -e analyzer.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout