Actions
Task #3485
closedResearch: check SSH parsing end of banner
Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:
Description
Follows conversation on https://github.com/OISF/suricata/pull/4546#discussion_r378704002
I am not sure that SSH parser should accept single CR as end of banner, but that is what is being done by the C parser.
This is enforced by the unit tests :
https://github.com/OISF/suricata/blob/master/src/app-layer-ssh.c#L2222
This is something to test against real implementations.
OpenSSH does not accept CR as end of banner :
https://github.com/openssh/openssh-portable/blob/master/ssh_api.c#L345
It only accepts LF and CRLF
Updated by Victor Julien over 4 years ago
- Tracker changed from Bug to Task
- Subject changed from Check SSH parsing end of banner to Research: check SSH parsing end of banner
Updated by Philippe Antoine over 4 years ago
Wa can also test for 0 or 1-length SSH records (not containing message code) cf https://github.com/OISF/suricata/pull/4546#discussion_r378704320
Updated by Victor Julien over 4 years ago
- Related to Feature #3445: Convert SSH parser to Rust added
Updated by Philippe Antoine about 3 years ago
- Status changed from New to Closed
Closing until a user wants this...
Actions