Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ssh add first frames 5734 v1 #11340

Closed
wants to merge 3 commits into from

Conversation

catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5734

Describe changes:

  • ssh: add frames support (for clear-text records after banner)
  • detect: run frames detection on packet disabling app-layer because next packets are encrypted

SV_BRANCH=OISF/suricata-verify#1932

Ticket: 5734
for SSH packets that mark the end of plaintext
flow,
stream_slice,
input,
(head.pkt_len + 4) as i64,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this right Victor ?
Setting the frame length that gets over the available data so far...

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if final length is unknown, it should set -1 and update the frame's len when the final length is available

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Final length is known but we do not have the full data yet. You just told me it is ok

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 21159

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 21174

@victorjulien victorjulien marked this pull request as draft June 22, 2024 09:13
@catenacyber catenacyber mentioned this pull request Jun 27, 2024
@catenacyber
Copy link
Contributor Author

Clean in #11372

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants