From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Fri, 24 Jun 2016 13:00:52 +0000 (-0400)
Subject: Merge pull request #543 in SNORT/snort3 from appid_ws2_plugins6 to master
X-Git-Tag: 3.0.0-233~348
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=04ca8d7d26aaacb8a56043ace631e6cef87d0bd0;p=thirdparty%2Fsnort3.git

Merge pull request #543 in SNORT/snort3 from appid_ws2_plugins6 to master

Squashed commit of the following:

commit 1b10f4b032bd73cac3921906eeaf6a04507054a3
Author: Steve Chew <stechew@cisco.com>
Date:   Tue Jun 21 10:24:48 2016 -0400

    Added appid flow count for SSH.
---

diff --git a/src/network_inspectors/appid/appid_module.cc b/src/network_inspectors/appid/appid_module.cc
index 08c21fc08..2e3a30e9d 100644
--- a/src/network_inspectors/appid/appid_module.cc
+++ b/src/network_inspectors/appid/appid_module.cc
@@ -43,6 +43,7 @@ const PegInfo appid_pegs[] =
     { "ftps_flows", "count of ftps flows discovered by appid" },
     { "smtp_flows", "count of smtp flows discovered by appid" },
     { "smtps_flows", "count of smtps flows discovered by appid" },
+    { "ssh_flows", "count of ssh flows discovered by appid" },
     { "ssl_flows", "count of ssl flows discovered by appid" },
     { "telnet_flows", "count of telnet flows discovered by appid" },
     { nullptr, nullptr }
diff --git a/src/network_inspectors/appid/appid_module.h b/src/network_inspectors/appid/appid_module.h
index 0f332497f..3c1f64427 100644
--- a/src/network_inspectors/appid/appid_module.h
+++ b/src/network_inspectors/appid/appid_module.h
@@ -44,6 +44,7 @@ struct AppIdStats
     PegCount ftps_flows;
     PegCount smtp_flows;
     PegCount smtps_flows;
+    PegCount ssh_flows;
     PegCount ssl_flows;
     PegCount telnet_flows;
 };
diff --git a/src/network_inspectors/appid/service_plugins/service_base.cc b/src/network_inspectors/appid/service_plugins/service_base.cc
index 70f3b112d..e0725e7ae 100644
--- a/src/network_inspectors/appid/service_plugins/service_base.cc
+++ b/src/network_inspectors/appid/service_plugins/service_base.cc
@@ -198,8 +198,8 @@ static RNAServiceValidationModule* static_service_list[] =
     &smtp_service_mod,
 #ifdef REMOVED_WHILE_NOT_IN_USE
     &snmp_service_mod,
-    &ssh_service_mod,
 #endif
+    &ssh_service_mod,
     &ssl_service_mod,
     &telnet_service_mod,
 #ifdef REMOVED_WHILE_NOT_IN_USE
diff --git a/src/network_inspectors/appid/service_plugins/service_ssh.cc b/src/network_inspectors/appid/service_plugins/service_ssh.cc
index 34ae66d23..04c99f85a 100644
--- a/src/network_inspectors/appid/service_plugins/service_ssh.cc
+++ b/src/network_inspectors/appid/service_plugins/service_ssh.cc
@@ -25,6 +25,7 @@
 #include "application_ids.h"
 
 #include "utils/util.h"
+#include "appid_module.h"
 
 #define SSH_PORT    22
 
@@ -567,6 +568,7 @@ inprocess:
     case SERVICE_SUCCESS:
         ssh_service_mod.api->add_service(flowp, args->pkt, args->dir, &svc_element,
             APP_ID_SSH, ss->vendor, ss->version, nullptr);
+        appid_stats.ssh_flows++;
         return SERVICE_SUCCESS;
 
     case SERVICE_NOMATCH: