Skip to content

Ssh add first frames 5734 v1#11340

Closed
catenacyber wants to merge 3 commits intoOISF:masterfrom
catenacyber:ssh-frames-5734-v1
Closed

Ssh add first frames 5734 v1#11340
catenacyber wants to merge 3 commits intoOISF:masterfrom
catenacyber:ssh-frames-5734-v1

Conversation

@catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5734

Describe changes:

  • ssh: add frames support (for clear-text records after banner)
  • detect: run frames detection on packet disabling app-layer because next packets are encrypted

SV_BRANCH=OISF/suricata-verify#1932

Ticket: 5734
for SSH packets that mark the end of plaintext
flow,
stream_slice,
input,
(head.pkt_len + 4) as i64,
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this right Victor ?
Setting the frame length that gets over the available data so far...

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if final length is unknown, it should set -1 and update the frame's len when the final length is available

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Final length is known but we do not have the full data yet. You just told me it is ok

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 21159

@suricata-qa
Copy link

Information: QA ran without warnings.

Pipeline 21174

@victorjulien victorjulien marked this pull request as draft June 22, 2024 09:13
@catenacyber catenacyber mentioned this pull request Jun 27, 2024
@catenacyber
Copy link
Contributor Author

Clean in #11372

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants