Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-13 12:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

ssh: Revert half-duplex robustness

Browse source 
This reverts part of commit a0888b7e36 due
to inhibiting analyzer violations when parsing non SSH traffic when
the &restofdata path is entered.

@J-Gras reported the analyzer not being disabled when sending HTTP
traffic on port 22.

This adds the verbose analyzer.log baselines such that future improvements
of these scenarios become visible.
This commit is contained in:
Arne Welzel 2024-06-12 14:23:44 +02:00
parent 345fc31dcc
commit a0e0b7161f
5 changed files with 254 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/scripts/base/protocols/ssh/half-duplex-client.zeek
View file

@ -2,7 +2,7 @@
# analyzer.log output.
# @TEST-EXEC: zeek -r $TRACES/ssh/ssh.client-side-half-duplex.pcap %INPUT
# @TEST-EXEC: test ! -e analyzer.log
# @TEST-EXEC: btest-diff analyzer.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout

2
testing/btest/scripts/base/protocols/ssh/half-duplex-server.zeek
View file

@ -2,7 +2,7 @@
# analyzer.log output.
# @TEST-EXEC: zeek -r $TRACES/ssh/ssh.server-side-half-duplex.pcap %INPUT
# @TEST-EXEC: test ! -e analyzer.log
# @TEST-EXEC: btest-diff analyzer.log
# @TEST-EXEC: btest-diff ssh.log
# @TEST-EXEC: btest-diff conn.log
# @TEST-EXEC: btest-diff .stdout