From fbedc55d5aa861c381701c9f913b34ee7ab57ec4 Mon Sep 17 00:00:00 2001
From: srdusr <99972264+srdusr@users.noreply.github.com>
Date: Tue, 21 May 2024 22:24:00 +0200
Subject: Add GUI parity for -c/-a, mDNS/SSH dissectors, and two new fuzz
 harnesses

GUI parity: checksum_status()/reassembled_http_status() moved out of
main.cpp into a shared wireframe/packet_diagnostics.hpp so the GUI can
show the same -c/-a diagnostics for the selected packet without
duplicating the Ethernet/IPv4/TCP walk. Visually verified under Xvfb
with the same split-segment scenario used to verify -a on the CLI.

Two new L7 dissectors: mDNS (reuses parse_dns outright - RFC 6762
keeps DNS's wire format, just a different port) and SSH's cleartext
identification banner. Live-verified against this machine's real
sshd and a real DNS-wire-format packet sent to port 5353.

Two new fuzz harnesses (fuzz_checksum, fuzz_tcp_reassembly) covering
code added here that the original nine harnesses never
touched. All 12 run clean across ~90M executions with no crashes.

NAMES.md and PLAN.md updated with this round's decisions and naming
candidates.
---
 tests/test_ssh.cpp | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 tests/test_ssh.cpp

(limited to 'tests/test_ssh.cpp')

diff --git a/tests/test_ssh.cpp b/tests/test_ssh.cpp
new file mode 100644
index 0000000..7c4e339
--- /dev/null
+++ b/tests/test_ssh.cpp
@@ -0,0 +1,62 @@
+#include <doctest/doctest.h>
+
+#include <vector>
+
+#include "wireframe/l7/ssh.hpp"
+
+using namespace wireframe::net;
+
+namespace {
+
+std::vector<unsigned char> to_bytes(const std::string& s) {
+    return std::vector<unsigned char>(s.begin(), s.end());
+}
+
+}  // namespace
+
+TEST_CASE("parse_ssh_banner decodes a CRLF-terminated banner with a comment") {
+    auto banner = parse_ssh_banner(to_bytes("SSH-2.0-OpenSSH_9.6 FreeBSD-20240101\r\n"));
+    REQUIRE(banner.has_value());
+    CHECK(banner->proto_version == "2.0");
+    CHECK(banner->software_version == "OpenSSH_9.6");
+}
+
+TEST_CASE("parse_ssh_banner decodes a banner with no comment") {
+    auto banner = parse_ssh_banner(to_bytes("SSH-2.0-libssh_0.10.6\r\n"));
+    REQUIRE(banner.has_value());
+    CHECK(banner->proto_version == "2.0");
+    CHECK(banner->software_version == "libssh_0.10.6");
+}
+
+TEST_CASE("parse_ssh_banner tolerates a bare LF terminator") {
+    auto banner = parse_ssh_banner(to_bytes("SSH-1.99-OpenSSH_3.9\n"));
+    REQUIRE(banner.has_value());
+    CHECK(banner->proto_version == "1.99");
+    CHECK(banner->software_version == "OpenSSH_3.9");
+}
+
+TEST_CASE("parse_ssh_banner rejects payloads without the SSH- prefix") {
+    CHECK_FALSE(parse_ssh_banner(to_bytes("not an ssh banner\r\n")).has_value());
+}
+
+TEST_CASE("parse_ssh_banner rejects a banner missing the version separator") {
+    CHECK_FALSE(parse_ssh_banner(to_bytes("SSH-nodash\r\n")).has_value());
+}
+
+TEST_CASE("parse_ssh_banner rejects an unterminated line") {
+    CHECK_FALSE(parse_ssh_banner(to_bytes("SSH-2.0-OpenSSH_9.6")).has_value());
+}
+
+TEST_CASE("SshDissector claims port 22 and its summary matches parse_ssh_banner") {
+    SshDissector dissector;
+    CHECK(dissector.port() == kSshPort);
+
+    auto summary = dissector.summarize(to_bytes("SSH-2.0-OpenSSH_9.6\r\n"));
+    REQUIRE(summary.has_value());
+    CHECK(*summary == "SSH 2.0 OpenSSH_9.6");
+}
+
+TEST_CASE("SshDissector::summarize returns nullopt for non-SSH payload") {
+    SshDissector dissector;
+    CHECK_FALSE(dissector.summarize(to_bytes("GET / HTTP/1.1\r\n")).has_value());
+}
-- 
cgit v1.2.3