Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-12 03:28:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

SSH: Fix some edge-cases which created BinPAC exceptions

Browse source
This commit is contained in:
Vlad Grigorescu 2015-03-19 21:43:07 -04:00
parent 29f78cf90f
commit f33e26242c
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/analyzer/protocol/ssh/ssh-protocol.pac
View file

@ -6,17 +6,17 @@
# We have 3 basic types of messages: # We have 3 basic types of messages:
# #
# - SSH_Version messages just have a string with the banner string of the client or server # - SSH_Version messages just have a string with the banner string of the client or server
# - Encrypted messages have no usable data, but those never get passed in by SSH.cc # - Encrypted messages have no usable data, so we'll just ignore them as best we can.
# - Finally, key exchange messages have a common format. # - Finally, key exchange messages have a common format.
type SSH_PDU(is_orig: bool) = case $context.connection.get_state(is_orig) of { type SSH_PDU(is_orig: bool) = case $context.connection.get_state(is_orig) of {
VERSION_EXCHANGE -> version : SSH_Version(is_orig); VERSION_EXCHANGE -> version : SSH_Version(is_orig);
ENCRYPTED -> encrypted : bytestring &length=1 &transient;
default -> kex : SSH_Key_Exchange(is_orig); default -> kex : SSH_Key_Exchange(is_orig);
} &byteorder=bigendian; } &byteorder=bigendian;
type SSH_Version(is_orig: bool) = record { type SSH_Version(is_orig: bool) = record {
version : bytestring &oneline; version : bytestring &oneline;
pad : bytestring &length=0 &transient;
} &let { } &let {
update_state : bool = $context.connection.update_state(KEX_INIT, is_orig); update_state : bool = $context.connection.update_state(KEX_INIT, is_orig);
update_version : bool = $context.connection.update_version(version, is_orig); update_version : bool = $context.connection.update_version(version, is_orig);