mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
4f084b0b9a
In half-duplex setups (or when client/server coalesce the SSH version
line with the KEX packet, get_version() would return UNK as version,
causing a protocol violation. Make this slightly more robust by using
and setting the version which either side had set to continue parsing.
For the special case of SSH-1.99, select SSH-2.0. We could try to peak
into the payload following the packet length field and check for
a KEX_INIT type byte to select SSH2 as a heuristic, but not sure how
to accomplish this.
Slight regression fix for 3769ed6c66
which started to require visibility for client and server version
rather than just the client's version.
23 lines
1.9 KiB
Text
23 lines
1.9 KiB
Text
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
|
|
#separator \x09
|
|
#set_separator ,
|
|
#empty_field (empty)
|
|
#unset_field -
|
|
#path weird
|
|
#open XXXX-XX-XX-XX-XX-XX
|
|
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p name addl notice peer source
|
|
#types time string addr port addr port string string bool string string
|
|
XXXXXXXXXX.XXXXXX ClEkJM2Vm5giqnMf4h 192.168.2.1 57189 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX C4J4Th3PJpwUYZZ6gc 192.168.2.1 57191 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX CtPZjS20MLrsMUOJi2 192.168.2.1 56594 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX CUM0KZ3MLUfNB0cl11 192.168.2.1 56821 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX CmES5u32sYpV7JYN 192.168.2.1 56837 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX CP5puj4I8PtEU4qzYg 192.168.2.1 56845 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX C37jN32gN3y3AZzyf6 192.168.2.1 56875 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX C3eiCBGOLw3VtHfOj 192.168.2.1 56878 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX CwjjYJ2WqgTbAqiHl6 192.168.2.1 56940 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX C0LAHyvtKSQHyJxIl 192.168.2.1 57831 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX CFLRIC3zaTU1loLGxh 192.168.2.1 59246 192.168.2.158 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX C9rXSW3KSpTYvPrlI1 192.168.1.32 41164 128.2.10.238 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
XXXXXXXXXX.XXXXXX C9mvWx3ezztgzcexV7 192.168.1.32 41268 128.2.10.238 22 half_duplex_ssh_with_version_199 - F zeek SSH
|
|
#close XXXX-XX-XX-XX-XX-XX
|