mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
166841e93f
banner_wait_eol only recorded that a banner line of 256 bytes or more had arrived without EOL; it was not an active phase. The direction kept reparsing the open line in place, so a rule or firewall policy pointing at the state acted on a parked, not an active, direction. Move the condition to the event channel it already had (the one-shot ssh.long_banner event) and key the continuation off an explicit banner_published latch (set at the banner publish sites): a direction with an open line stays in the banner state, the line is consumed greedily until the EOL arrives, and the line completion takes the normal banner-to-kex transition. The state scale becomes dense: banner(0) kex(1) session(2), completion done(3). request_banner_wait_eol / response_banner_wait_eol no longer load: aliasing them to banner would silently turn a long-banner rule into an any-banner rule. Firewall rules that acted at the removed state must move to the ssh.long_banner event or the banner state; and since the progress gap between banner and kex is gone, the default-policy sweep no longer drops a clean flow at the server banner. Ticket: #9046. |
3 weeks ago | |
|---|---|---|
| .. | ||
| .cargo | 2 years ago | |
| derive | 6 months ago | |
| ffi | 2 months ago | |
| htp | 4 weeks ago | |
| src | 3 weeks ago | |
| suricatactl | 7 months ago | |
| suricatasc | 4 months ago | |
| sys | 2 months ago | |
| .gitignore | 2 years ago | |
| Cargo.lock.in | 1 month ago | |
| Cargo.toml.in | 1 month ago | |
| Makefile.am | 1 month ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | 3 years ago | |