Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Change SSH version field to be &optional.

Browse source 
In 3769ed6c66 we added handling for SSH version 1.99 which unsed a SSH
version of 0 to indicate weird cases where no version could be
determined.

This patch is a fixup for that patch. Instead of using a magic version
of 0 we now use an `&optional` version value. If no SSH version can be
extracted the version will be unset; additionally a `conn_weird` event
will be raised.

Closes #1590.
This commit is contained in:
Benjamin Bannier 2021-06-16 09:01:19 +02:00
parent e6e30240ec
commit daa9537f92
3 changed files with 162 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
testing/btest/Baseline/scripts.base.protocols.ssh.set_version/output Normal file
View file

@ -0,0 +1,16 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
SSH1 vs SSH1, 1
SSH199 vs SSH1, 1
SSH2 vs SSH2, 2
SSH199 vs SSH2, 2
unset vs unset, F
client unset, F
server unset, F
incomplete server version, F
incomplete client version, F
SSH1 vs SSH2, F
SSH2 vs SSH1, F
conn_weird:, cannot determine SSH protocol version used, [orig_h=127.0.0.1, orig_p=40/tcp, resp_h=127.0.0.1, resp_p=40/tcp], SSH vs SSH-1.5-OpenSSH_6.2,
conn_weird:, cannot determine SSH protocol version used, [orig_h=127.0.0.1, orig_p=40/tcp, resp_h=127.0.0.1, resp_p=40/tcp], SSH-1.5-OpenSSH_6.2 vs SSH,
conn_weird:, SSH protocol version mismatch, [orig_h=127.0.0.1, orig_p=40/tcp, resp_h=127.0.0.1, resp_p=40/tcp], SSH-1.5-OpenSSH_6.2 vs SSH-2.0-OpenSSH_5.9,
conn_weird:, SSH protocol version mismatch, [orig_h=127.0.0.1, orig_p=40/tcp, resp_h=127.0.0.1, resp_p=40/tcp], SSH-2.0-OpenSSH_5.9 vs SSH-1.5-OpenSSH_6.2,