From: Victor Julien <victor@inliniac.net>
Date: Sat, 1 Mar 2014 17:09:20 +0000 (+0100)
Subject: ssh: allow for space characters in the software version
X-Git-Tag: suricata-2.0rc2~25
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=294ff49f6da9482481f0e71fc7076e50c2f8ae04;p=thirdparty%2Fsuricata.git

ssh: allow for space characters in the software version

Previously the software version would only contain up to the first
space.

E.g. in SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu3

It would contain "OpenSSH_4.7p1".

This patch changes the behavior to:

"OpenSSH_4.7p1 Debian-8ubuntu3"
---

diff --git a/src/app-layer-ssh.c b/src/app-layer-ssh.c
index 291543236f..8205c4709a 100644
--- a/src/app-layer-ssh.c
+++ b/src/app-layer-ssh.c
@@ -104,9 +104,9 @@ static int SSHParseBanner(SshState *state, SshHeader *header, const uint8_t *inp
         SCReturnInt(0);
     }
 
-    const uint8_t *sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)" ", 1);
+    const uint8_t *sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\r", 1);
     if (sw_end == NULL) {
-        sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\r", 1);
+        sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\n", 1);
         if (sw_end == NULL) {
             sw_end = line_ptr + line_len;
         }