mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
166841e93f
banner_wait_eol only recorded that a banner line of 256 bytes or more had arrived without EOL; it was not an active phase. The direction kept reparsing the open line in place, so a rule or firewall policy pointing at the state acted on a parked, not an active, direction. Move the condition to the event channel it already had (the one-shot ssh.long_banner event) and key the continuation off an explicit banner_published latch (set at the banner publish sites): a direction with an open line stays in the banner state, the line is consumed greedily until the EOL arrives, and the line completion takes the normal banner-to-kex transition. The state scale becomes dense: banner(0) kex(1) session(2), completion done(3). request_banner_wait_eol / response_banner_wait_eol no longer load: aliasing them to banner would silently turn a long-banner rule into an any-banner rule. Firewall rules that acted at the removed state must move to the ssh.long_banner event or the banner state; and since the progress gap between banner and kex is gone, the default-policy sweep no longer drops a clean flow at the server banner. Ticket: #9046. |
3 weeks ago | |
|---|---|---|
| .. | ||
| applayertemplate | 5 months ago | |
| asn1 | 5 months ago | |
| bittorrent_dht | 5 months ago | |
| dcerpc | 3 months ago | |
| detect | 4 weeks ago | |
| dhcp | 2 months ago | |
| dnp3 | ||
| dns | 2 months ago | |
| enip | 2 months ago | |
| ffi | 5 months ago | |
| ftp | 4 weeks ago | |
| http2 | 4 weeks ago | |
| ike | 2 months ago | |
| krb | 4 months ago | |
| ldap | 4 weeks ago | |
| llmnr | 5 months ago | |
| mdns | ||
| mime | 4 months ago | |
| modbus | 3 months ago | |
| mqtt | 2 months ago | |
| nfs | 4 weeks ago | |
| ntp | 5 months ago | |
| pgsql | 1 month ago | |
| pop3 | ||
| quic | 5 months ago | |
| rdp | 2 months ago | |
| rfb | 2 months ago | |
| sctp | 5 months ago | |
| sdp | 4 months ago | |
| sip | 4 months ago | |
| smb | 4 weeks ago | |
| snmp | 4 months ago | |
| ssh | 3 weeks ago | |
| telnet | 5 months ago | |
| tftp | 5 months ago | |
| utils | 5 months ago | |
| websocket | 5 months ago | |
| x509 | 2 months ago | |
| applayer.rs | 4 months ago | |
| common.rs | 4 months ago | |
| conf.rs | 4 months ago | |
| core.rs | 4 months ago | |
| debug.rs | 4 months ago | |
| encryption.rs | 4 months ago | |
| feature.rs | 4 months ago | |
| filecontainer.rs | ||
| filetracker.rs | 2 months ago | |
| flow.rs | ||
| frames.rs | 4 months ago | |
| handshake.rs | 4 months ago | |
| ja4.rs | ||
| jsonbuilder.rs | 2 months ago | |
| kerberos.rs | 4 months ago | |
| lib.rs | 2 months ago | |
| lua.rs | 4 months ago | |
| lzma.rs | 2 months ago | |
| tls_version.rs | ||
| util.rs | 4 months ago | |