1 files changed, 29 insertions, 6 deletions

diff --git a/src/lib/protocols/ssh.c b/src/lib/protocols/ssh.c
index 20b8b5fe9..bfd1c387e 100644
--- a/src/lib/protocols/ssh.c
+++ b/src/lib/protocols/ssh.c
@@ -22,39 +22,62 @@
  * 
  */
 
+#include "ndpi_protocol_ids.h"
 
-#include "ndpi_protocols.h"
 #ifdef NDPI_PROTOCOL_SSH
 
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SSH
+
+#include "ndpi_api.h"
+
 static void ndpi_int_ssh_add_connection(struct ndpi_detection_module_struct
 					*ndpi_struct, struct ndpi_flow_struct *flow){
   ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSH, NDPI_PROTOCOL_UNKNOWN);
 }
 
+static void ndpi_ssh_zap_cr(char *str, int len) {
+  len--;
+
+  while(len > 0) {
+    if((str[len] == '\n') || (str[len] == '\r')) {
+      str[len] = '\0';
+      len--;
+    } else
+      break;
+  }
+}
+
 void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;	
-  //      struct ndpi_id_struct         *src=ndpi_struct->src;
-  //      struct ndpi_id_struct         *dst=ndpi_struct->dst;
 
   if (flow->l4.tcp.ssh_stage == 0) {
     if (packet->payload_packet_len > 7 && packet->payload_packet_len < 100
 	&& memcmp(packet->payload, "SSH-", 4) == 0) {
-      NDPI_LOG(NDPI_PROTOCOL_SSH, ndpi_struct, NDPI_LOG_DEBUG, "ssh stage 0 passed\n");
+      int len = ndpi_min(sizeof(flow->protos.ssh.client_signature)-1, packet->payload_packet_len);
+      strncpy(flow->protos.ssh.client_signature, (const char *)packet->payload, len);
+      flow->protos.ssh.client_signature[len] = '\0';
+      ndpi_ssh_zap_cr(flow->protos.ssh.client_signature, len);
+      NDPI_LOG_DBG2(ndpi_struct, "ssh stage 0 passed\n");
       flow->l4.tcp.ssh_stage = 1 + packet->packet_direction;
       return;
     }
   } else if (flow->l4.tcp.ssh_stage == (2 - packet->packet_direction)) {
     if (packet->payload_packet_len > 7 && packet->payload_packet_len < 100
 	&& memcmp(packet->payload, "SSH-", 4) == 0) {
-      NDPI_LOG(NDPI_PROTOCOL_SSH, ndpi_struct, NDPI_LOG_DEBUG, "found ssh\n");
+      int len = ndpi_min(sizeof(flow->protos.ssh.server_signature)-1, packet->payload_packet_len);
+      strncpy(flow->protos.ssh.server_signature, (const char *)packet->payload, len);
+      flow->protos.ssh.server_signature[len] = '\0';
+      ndpi_ssh_zap_cr(flow->protos.ssh.server_signature, len);
+      NDPI_LOG_INFO(ndpi_struct, "found ssh\n");
+      
       ndpi_int_ssh_add_connection(ndpi_struct, flow);
       return;
 
     }
   }
 
-  NDPI_LOG(NDPI_PROTOCOL_SSH, ndpi_struct, NDPI_LOG_DEBUG, "excluding ssh at stage %d\n", flow->l4.tcp.ssh_stage);
+  NDPI_LOG_DBG(ndpi_struct, "excluding ssh at stage %d\n", flow->l4.tcp.ssh_stage);
   NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SSH);
 }