ssh: allow for space characters in the software version

Previously the software version would only contain up to the first
space.

E.g. in SSH-2.0-OpenSSH_4.7p1 Debian-8ubuntu3

It would contain "OpenSSH_4.7p1".

This patch changes the behavior to:

"OpenSSH_4.7p1 Debian-8ubuntu3"

diff --git a/src/app-layer-ssh.c b/src/app-layer-ssh.c
index 291543236fbc1f4b4d506bbf01cf716cf9995cf1..8205c4709ae7a15307e487f348c2c8bf7cf6289c 100644 (file)
--- a/src/app-layer-ssh.c
+++ b/src/app-layer-ssh.c
@@ -104,9 +104,9 @@ static int SSHParseBanner(SshState *state, SshHeader *header, const uint8_t *inp
         SCReturnInt(0);
     }
 
-    const uint8_t *sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)" ", 1);
+    const uint8_t *sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\r", 1);
     if (sw_end == NULL) {
-        sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\r", 1);
+        sw_end = BasicSearch(line_ptr, line_len, (uint8_t*)"\n", 1);
         if (sw_end == NULL) {
             sw_end = line_ptr + line_len;
         }