SSH Capabilities Bug: Fix for 2.6?

Development
1

During BroCon, someone brought a bug in the SSH analyzer to my attention.

The SSH Capabilities record has the following field, which is being set incorrectly:

Are these the capabilities of the server?

is_server: bool;

result->Assign(6, new Val(${msg.is_orig}, TYPE_BOOL));

Obviously, I’d like to fix this. I’m curious to hear thoughts about getting this into 2.6. I know that the hassh package currently works around the broken logic.

–Vlad

2

Yes, that seems like a bug fix that can be included in 2.6. Do you
want to make a PR for that and verify/update any unit test baselines
that change?

- Jon

3

Sure, I’ll do that.

4

Just for anyone who wanted some closure on this, I’ve submitted the PR: https://github.com/bro/bro/pull/191