mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
6023c8b906
This change revamps SSH banner parsing. The previous behavior was both a bit too strict in some regards, and too permissive in other. Specifically, clients are now required to send a line starting with "SSH-" as the first line. This is in line with the RFC, as well with observed behavior. This also prevents the creation of `ssh.log` for non-SSH traffic on port 22. For the server side, we now accept text before the SSH banner. This previously led to a protocol violation but is allowed by the spec. New tests are added to cover these cases.
7 lines
374 B
Text
7 lines
374 B
Text
# Validate that a text-based protocol pn port 22 does not generate a ssh logfile.
|
|
|
|
# @TEST-EXEC: zeek -r $TRACES/http/http-single-conn-22.pcap %INPUT
|
|
# @TEST-EXEC: test ! -f ssh.log
|
|
# @TEST-EXEC: btest-diff http.log
|
|
# @TEST-EXEC: btest-diff conn.log
|
|
# @TEST-EXEC: TEST_DIFF_CANONIFIER="$SCRIPTS/diff-remove-abspath | $SCRIPTS/diff-remove-timestamps" btest-diff analyzer.log
|