zeek/testing/btest/Baseline/scripts.base.protocols.ssh.pre-banner
Johanna Amann 6023c8b906 SSH: make banner parsing more robust
This change revamps SSH banner parsing.  The previous behavior was both
a bit too strict in some regards, and too permissive in other.

Specifically, clients are now required to send a line starting with
"SSH-" as the first line.  This is in line with the RFC, as well with
observed behavior. This also prevents the creation of `ssh.log` for
non-SSH traffic on port 22.

For the server side, we now accept text before the SSH banner. This
previously led to a protocol violation but is allowed by the spec.

New tests are added to cover these cases.
2025-03-18 16:19:33 +00:00
..
.stdout SSH: make banner parsing more robust 2025-03-18 16:19:33 +00:00
conn.log SSH: make banner parsing more robust 2025-03-18 16:19:33 +00:00
ssh.log SSH: make banner parsing more robust 2025-03-18 16:19:33 +00:00