diff --git a/rust/src/ssh/ssh.rs b/rust/src/ssh/ssh.rs index eba07c63c6..1f8601ecf8 100644 --- a/rust/src/ssh/ssh.rs +++ b/rust/src/ssh/ssh.rs @@ -224,7 +224,16 @@ impl SSHState { if hdr.flags == SSHConnectionState::SshStateBannerWaitEol { match parser::ssh_parse_line(input) { Ok((rem, _)) => { - return self.parse_record(rem, resp, pstate); + let r = self.parse_record(rem, resp, pstate); + if r.status == 1 { + //adds bytes consumed by banner to incomplete result + return AppLayerResult::incomplete( + r.consumed + (input.len() - rem.len()) as u32, + r.needed, + ); + } else { + return r; + } } Err(nom::Err::Incomplete(_)) => { return AppLayerResult::incomplete(0 as u32, (input.len() + 1) as u32); @@ -257,7 +266,16 @@ impl SSHState { ); self.set_event(SSHEvent::LongBanner); } - return self.parse_record(rem, resp, pstate); + let r = self.parse_record(rem, resp, pstate); + if r.status == 1 { + //adds bytes consumed by banner to incomplete result + return AppLayerResult::incomplete( + r.consumed + (input.len() - rem.len()) as u32, + r.needed, + ); + } else { + return r; + } } Err(nom::Err::Incomplete(_)) => { if input.len() < SSH_MAX_BANNER_LEN {