# SSH Capabilities Bug: Fix for 2.6?

**URL:** https://community.zeek.org/t/ssh-capabilities-bug-fix-for-2-6/5494
**Category:** Development
**Tags:** development
**Created:** [October 15, 2018, 8:26pm UTC](https://community.zeek.org/t/ssh-capabilities-bug-fix-for-2-6/5494 "2018-10-15T20:26:15Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Vlad\_Grigorescu](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vlad\_Grigorescu](https://community.zeek.org/u/Vlad_Grigorescu)
#### Post date: [October 15, 2018, 8:26pm UTC](https://community.zeek.org/t/ssh-capabilities-bug-fix-for-2-6/5494/1 "2018-10-15T20:26:15Z")

</div>

During BroCon, someone brought a bug in the SSH analyzer to my attention.

The SSH Capabilities record has the following field, which is being set incorrectly:

> ## Are these the capabilities of the server?
> 
> is\_server: bool;

> result-\>Assign(6, new Val(${msg.is\_orig}, TYPE\_BOOL));

Obviously, I’d like to fix this. I’m curious to hear thoughts about getting this into 2.6. I know that the hassh package currently works around the broken logic.

–Vlad

---

<div class="post-metadata">

### Author: ![Jon\_Siwek](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jon\_Siwek](https://community.zeek.org/u/Jon_Siwek)
#### Post date: [October 15, 2018, 9:19pm UTC](https://community.zeek.org/t/ssh-capabilities-bug-fix-for-2-6/5494/2 "2018-10-15T21:19:23Z")

</div>

Yes, that seems like a bug fix that can be included in 2.6. Do you  
want to make a PR for that and verify/update any unit test baselines  
that change?

- Jon

---

<div class="post-metadata">

### Author: ![Vlad\_Grigorescu](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vlad\_Grigorescu](https://community.zeek.org/u/Vlad_Grigorescu)
#### Post date: [October 15, 2018, 10:21pm UTC](https://community.zeek.org/t/ssh-capabilities-bug-fix-for-2-6/5494/3 "2018-10-15T22:21:34Z")

</div>

Sure, I’ll do that.

---

<div class="post-metadata">

### Author: ![Vlad\_Grigorescu](https://avatars.discourse-cdn.com/v4/letter/v/a3d4f5/32.png) [@Vlad\_Grigorescu](https://community.zeek.org/u/Vlad_Grigorescu)
#### Post date: [October 16, 2018, 3:37pm UTC](https://community.zeek.org/t/ssh-capabilities-bug-fix-for-2-6/5494/4 "2018-10-16T15:37:49Z")

</div>

Just for anyone who wanted some closure on this, I’ve submitted the PR: [https://github.com/bro/bro/pull/191](https://github.com/bro/bro/pull/191)

---

<div class="post-metadata">

### Author: ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)
#### Post date: [May 6, 2022, 3:46pm UTC](https://community.zeek.org/t/ssh-capabilities-bug-fix-for-2-6/5494/5 "2022-05-06T15:46:07Z")

</div>


