Merge pull request #543 in SNORT/snort3 from appid_ws2_plugins6 to master

Squashed commit of the following:

commit 1b10f4b032bd73cac3921906eeaf6a04507054a3
Author: Steve Chew <stechew@cisco.com>
Date:   Tue Jun 21 10:24:48 2016 -0400

    Added appid flow count for SSH.

diff --git a/src/network_inspectors/appid/appid_module.cc b/src/network_inspectors/appid/appid_module.cc
index 08c21fc085a5d5156589ab408a002ae8688dd804..2e3a30e9d7676831d6b3162a1554c773fd305738 100644 (file)
--- a/src/network_inspectors/appid/appid_module.cc
+++ b/src/network_inspectors/appid/appid_module.cc
@@ -43,6 +43,7 @@ const PegInfo appid_pegs[] =
     { "ftps_flows", "count of ftps flows discovered by appid" },
     { "smtp_flows", "count of smtp flows discovered by appid" },
     { "smtps_flows", "count of smtps flows discovered by appid" },
+    { "ssh_flows", "count of ssh flows discovered by appid" },
     { "ssl_flows", "count of ssl flows discovered by appid" },
     { "telnet_flows", "count of telnet flows discovered by appid" },
     { nullptr, nullptr }

diff --git a/src/network_inspectors/appid/appid_module.h b/src/network_inspectors/appid/appid_module.h
index 0f332497f5dc6e3fd7bf20290b8a716bd09d6a03..3c1f64427ecb0bcd6c276d58b35b3a44e254b821 100644 (file)
--- a/src/network_inspectors/appid/appid_module.h
+++ b/src/network_inspectors/appid/appid_module.h
@@ -44,6 +44,7 @@ struct AppIdStats
     PegCount ftps_flows;
     PegCount smtp_flows;
     PegCount smtps_flows;
+    PegCount ssh_flows;
     PegCount ssl_flows;
     PegCount telnet_flows;
 };

diff --git a/src/network_inspectors/appid/service_plugins/service_base.cc b/src/network_inspectors/appid/service_plugins/service_base.cc
index 70f3b112d76a5862b52c6d8f0628377c8b452e58..e0725e7aed1edfc00fc4fcdfadce7fe944d1b071 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_base.cc
+++ b/src/network_inspectors/appid/service_plugins/service_base.cc
@@ -198,8 +198,8 @@ static RNAServiceValidationModule* static_service_list[] =
     &smtp_service_mod,
 #ifdef REMOVED_WHILE_NOT_IN_USE
     &snmp_service_mod,
-    &ssh_service_mod,
 #endif
+    &ssh_service_mod,
     &ssl_service_mod,
     &telnet_service_mod,
 #ifdef REMOVED_WHILE_NOT_IN_USE

diff --git a/src/network_inspectors/appid/service_plugins/service_ssh.cc b/src/network_inspectors/appid/service_plugins/service_ssh.cc
index 34ae66d233b5725cb29ff36a1168370f225b904e..04c99f85a3261b7be370cb7aac9e306f755cb5cc 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_ssh.cc
+++ b/src/network_inspectors/appid/service_plugins/service_ssh.cc
@@ -25,6 +25,7 @@
 #include "application_ids.h"
 
 #include "utils/util.h"
+#include "appid_module.h"
 
 #define SSH_PORT    22
 
@@ -567,6 +568,7 @@ inprocess:
     case SERVICE_SUCCESS:
         ssh_service_mod.api->add_service(flowp, args->pkt, args->dir, &svc_element,
             APP_ID_SSH, ss->vendor, ss->version, nullptr);
+        appid_stats.ssh_flows++;
         return SERVICE_SUCCESS;
 
     case SERVICE_NOMATCH: