suricata
app-layer-ssh.h File Reference
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures

struct  SshHeader_
 
struct  SshState_
 

Macros

#define SSH_FLAG_VERSION_PARSED   0x01
 
#define SSH_FLAG_PARSER_DONE   0x02
 
#define SSH_MSG_NEWKEYS   21
 

Typedefs

typedef struct SshHeader_ SshHeader
 
typedef struct SshState_ SshState
 

Enumerations

enum  { SSH_STATE_IN_PROGRESS, SSH_STATE_BANNER_DONE, SSH_STATE_FINISHED }
 

Functions

void RegisterSSHParsers (void)
 Function to register the SSH protocol parsers and other functions. More...
 
void SSHParserRegisterTests (void)
 

Detailed Description

Macro Definition Documentation

#define SSH_FLAG_PARSER_DONE   0x02

Definition at line 33 of file app-layer-ssh.h.

Referenced by RegisterSSHParsers().

#define SSH_FLAG_VERSION_PARSED   0x01
#define SSH_MSG_NEWKEYS   21

Definition at line 36 of file app-layer-ssh.h.

Typedef Documentation

typedef struct SshHeader_ SshHeader

From SSH-TRANSP rfc

SSH Bunary packet structure: uint32 packet_length byte padding_length byte[n1] payload; n1 = packet_length - padding_length - 1 byte[n2] random padding; n2 = padding_length byte[m] mac (Message Authentication Code - MAC); m = mac_length

So we are going to do a header struct to store the lenghts and msg_code (inside payload, if any)

typedef struct SshState_ SshState

structure to store the SSH state values

Enumeration Type Documentation

anonymous enum
Enumerator
SSH_STATE_IN_PROGRESS 
SSH_STATE_BANNER_DONE 
SSH_STATE_FINISHED 

Definition at line 65 of file app-layer-ssh.h.

Function Documentation

void RegisterSSHParsers ( void  )

Function to register the SSH protocol parsers and other functions.

Definition at line 623 of file app-layer-ssh.c.

References Flow_::alparser, Flow_::alproto, ALPROTO_SSH, Flow_::alstate, APP_LAYER_PARSER_NO_INSPECTION, AppLayerParserConfParserEnabled(), AppLayerParserParse(), AppLayerParserRegisterDetectFlagsFuncs(), AppLayerParserRegisterDetectStateFuncs(), AppLayerParserRegisterGetStateProgressCompletionStatus(), AppLayerParserRegisterGetStateProgressFunc(), AppLayerParserRegisterGetTx(), AppLayerParserRegisterGetTxCnt(), AppLayerParserRegisterLoggerFuncs(), AppLayerParserRegisterParser(), AppLayerParserRegisterParserAcceptableDataDirection(), AppLayerParserRegisterProtocolUnittests(), AppLayerParserRegisterStateFuncs(), AppLayerParserRegisterTxFreeFunc(), AppLayerParserStateIssetFlag(), AppLayerParserThreadCtxAlloc(), AppLayerParserThreadCtxFree(), AppLayerProtoDetectConfProtoDetectionEnabled(), AppLayerProtoDetectRegisterProtocol(), SshState_::cli_hdr, FAIL_IF, FAIL_IF_NOT, FAIL_IF_NULL, SshHeader_::flags, FLOW_DESTROY, FLOW_INITIALIZE, PASS, SshHeader_::proto_version, Flow_::protoctx, SCCalloc, SCLogDebug, SshHeader_::software_version, SshState_::srv_hdr, SSH_FLAG_PARSER_DONE, SSH_FLAG_VERSION_PARSED, SSHParserRegisterTests(), STREAM_EOF, STREAM_TOCLIENT, STREAM_TOSERVER, StreamTcpFreeConfig(), StreamTcpInitConfig(), strlcpy(), and TRUE.

Referenced by AppLayerParserRegisterProtocolParsers(), and RegisterAllModules().

Here is the call graph for this function:

Here is the caller graph for this function:

void SSHParserRegisterTests ( void  )

Definition at line 2651 of file app-layer-ssh.c.

References UtRegisterTest().

Referenced by RegisterSSHParsers().

Here is the call graph for this function:

Here is the caller graph for this function: