mirror of
https://github.com/zeek/zeek.git
synced 2025-10-06 16:48:19 +00:00
30da2f83d0
When encrypted data was bundled within the same segment as the NewKeys message, it wasn't not reported via a ssh_encrypted_package event as it should have been.
50 lines
1.1 KiB
C++
50 lines
1.1 KiB
C++
// See the file "COPYING" in the main distribution directory for copyright.
|
|
|
|
#ifndef ANALYZER_PROTOCOL_SSH_SSH_H
|
|
#define ANALYZER_PROTOCOL_SSH_SSH_H
|
|
|
|
#include "events.bif.h"
|
|
|
|
#include "analyzer/protocol/tcp/TCP.h"
|
|
#include "ssh_pac.h"
|
|
|
|
namespace analyzer {
|
|
namespace SSH {
|
|
class SSH_Analyzer : public tcp::TCP_ApplicationAnalyzer {
|
|
|
|
public:
|
|
explicit SSH_Analyzer(Connection* conn);
|
|
~SSH_Analyzer() override;
|
|
|
|
// Overriden from Analyzer.
|
|
void Done() override;
|
|
void DeliverStream(int len, const u_char* data, bool orig) override;
|
|
void Undelivered(uint64_t seq, int len, bool orig) override;
|
|
|
|
// Overriden from tcp::TCP_ApplicationAnalyzer.
|
|
void EndpointEOF(bool is_orig) override;
|
|
|
|
static analyzer::Analyzer* Instantiate(Connection* conn)
|
|
{ return new SSH_Analyzer(conn); }
|
|
|
|
protected:
|
|
binpac::SSH::SSH_Conn* interp;
|
|
|
|
void ProcessEncrypted(int len, bool orig);
|
|
void ProcessEncryptedSegment(int len, bool orig);
|
|
|
|
bool had_gap;
|
|
|
|
// Packet analysis stuff
|
|
bool auth_decision_made;
|
|
bool skipped_banner;
|
|
bool saw_encrypted_client_data;
|
|
|
|
int service_accept_size;
|
|
int userauth_failure_size;
|
|
|
|
};
|
|
|
|
}
|
|
}
|
|
#endif
|