From: Mike Stepanek (mstepane) <mstepane@cisco.com>
Date: Fri, 2 Jul 2021 10:19:42 +0000 (+0000)
Subject: Merge pull request #2937 in SNORT/snort3 from ~BRASTULT/snort3:ssh_spell_fix to master
X-Git-Tag: 3.1.8.0~14
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d7c455209a55526eb62b7c7f6f1fac64b48f562a;p=thirdparty%2Fsnort3.git

Merge pull request #2937 in SNORT/snort3 from ~BRASTULT/snort3:ssh_spell_fix to master

Squashed commit of the following:

commit 675c5d0d624e2b559f504d6b1b9cb982a1e091d2
Author: Brandon Stultz <brastult@cisco.com>
Date:   Thu Jun 10 12:23:31 2021 -0400

    wizard: make SSH spell more specific
---

diff --git a/lua/snort_defaults.lua b/lua/snort_defaults.lua
index d95926bf0..31790ac6c 100644
--- a/lua/snort_defaults.lua
+++ b/lua/snort_defaults.lua
@@ -388,7 +388,7 @@ default_wizard =
           to_client = { '220*SMTP', '220*MAIL' } },
 
         { service = 'ssh', proto = 'tcp', client_first = true,
-          to_server = { '*SSH' }, to_client = { '*SSH' } },
+          to_server = { 'SSH-' }, to_client = { 'SSH-' } },
 
         { service = 'dce_http_server', proto = 'tcp', client_first = false,
           to_client = { 'ncacn_http' } },