]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect: add (mpm) hassh keywords
authorVadym Malakhatko <v.malakhatko@sirinsoftware.com>
Tue, 30 Jun 2020 10:20:52 +0000 (13:20 +0300)
committerVadym Malakhatko <v.malakhatko@sirinsoftware.com>
Tue, 7 Jul 2020 14:04:51 +0000 (17:04 +0300)
commit216a75c52233432b97b9dc424cbf62c98a335e87
treec95b4149b967380d701c3f23cde9e3cff66e4af3
parent536cee3ba98aa71d9e4a5ee4c56c960c7e71df49
detect: add (mpm) hassh keywords

Match on Hassh using ssh.hassh, ssh.hassh.server, ssh.hassh.string, ssh.hassh.server.string keywords, e.g:

alert ssh any any -> any any (msg:"match SSH hash"; ssh.hassh; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000010;)
alert ssh any any -> any any (msg:"match SSH hash-server"; ssh.hassh.server; content:"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"; sid:1000020;)
alert ssh any any -> any any (msg:"match SSH hash-string"; ssh.hassh.string; content:"none,zlib@openssh.com,zlib"; sid:1000030;)
alert ssh any any -> any any (msg:"match SSH hash-server-string"; ssh.hassh.server.string; content:"umac-64-etm@openssh.com,umac-128-etm@openssh.com,"; sid:1000040;)
13 files changed:
src/Makefile.am
src/detect-engine-register.c
src/detect-engine-register.h
src/detect-ssh-hassh-server-string.c [new file with mode: 0644]
src/detect-ssh-hassh-server-string.h [new file with mode: 0644]
src/detect-ssh-hassh-server.c [new file with mode: 0644]
src/detect-ssh-hassh-server.h [new file with mode: 0644]
src/detect-ssh-hassh-string.c [new file with mode: 0644]
src/detect-ssh-hassh-string.h [new file with mode: 0644]
src/detect-ssh-hassh.c [new file with mode: 0644]
src/detect-ssh-hassh.h [new file with mode: 0644]
src/util-error.c
src/util-error.h