From: Philippe Antoine <contact@catenacyber.fr>
Date: Fri, 10 Jul 2020 07:40:49 +0000 (+0200)
Subject: ssh: fix incomplete return for ssh kex
X-Git-Tag: suricata-6.0.0-beta1~215
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ece29c4210312b20ea9543488ec3826d8d4bccf0;p=thirdparty%2Fsuricata.git

ssh: fix incomplete return for ssh kex

In the case where we already parsed some records
---

diff --git a/rust/src/ssh/ssh.rs b/rust/src/ssh/ssh.rs
index 4bdfe97afb..11201c8f7c 100644
--- a/rust/src/ssh/ssh.rs
+++ b/rust/src/ssh/ssh.rs
@@ -228,8 +228,8 @@ impl SSHState {
                                         // saving type of incomplete kex message
                                         hdr.record_left_msg = parser::MessageCode::SshMsgKexinit;
                                         return AppLayerResult::incomplete(
-                                            SSH_RECORD_HEADER_LEN as u32,
-                                            hdr.record_left as u32
+                                            (il - rem.len()) as u32,
+                                            (head.pkt_len - 2) as u32
                                         );
                                     }
                                     else {