LOCAL int quic_chlo_parser(MolochSession_t *session, BSB dbsb) {
guchar *tag = 0;
int tagLen = 0;
BSB_LIMPORT_ptr(dbsb, tag, 4);
BSB_LIMPORT_u16(dbsb, tagLen);
BSB_LIMPORT_skip(dbsb, 2);
if (BSB_IS_ERROR(dbsb)) {
return 0;
}
moloch_session_add_protocol(session, "quic");
if (!tag || memcmp(tag, "CHLO", 4) != 0) {
return 0;
}
guchar *tagDataStart = dbsb.buf + tagLen*8 + 8;
uint32_t dlen = BSB_REMAINING(dbsb);
uint32_t start = 0;
while (!BSB_IS_ERROR(dbsb) && BSB_REMAINING(dbsb) && tagLen > 0) {
guchar *subTag = 0;
uint32_t endOffset = 0;
BSB_LIMPORT_ptr(dbsb, subTag, 4);
BSB_LIMPORT_u32(dbsb, endOffset);
if (endOffset > dlen || start > dlen || start > endOffset)
return 1;
if (!subTag)
return 1;
if (memcmp(subTag, "SNI\x00", 4) == 0) {
moloch_field_string_add(hostField, session, (char *)tagDataStart+start, endOffset-start, TRUE);
} else if (memcmp(subTag, "UAID", 4) == 0) {
moloch_field_string_add(uaField, session, (char *)tagDataStart+start, endOffset-start, TRUE);
} else if (memcmp(subTag, "VER\x00", 4) == 0) {
moloch_field_string_add(versionField, session, (char *)tagDataStart+start, endOffset-start, TRUE);
} else {
//LOG("Subtag: %4.4s len: %d %.*s", subTag, endOffset-start, endOffset-start, tagDataStart+start);
}
start = endOffset;
tagLen--;
}
return 1;
}
void tls_process_server_hello(MolochSession_t *session, const unsigned char *data, int len)
{
BSB bsb;
BSB_INIT(bsb, data, len);
unsigned char *ver;
BSB_IMPORT_ptr(bsb, ver, 2);
BSB_IMPORT_skip(bsb, 32); // Random
int skiplen = 0;
BSB_IMPORT_u08(bsb, skiplen); // Session Id Length
BSB_IMPORT_skip(bsb, skiplen); // Session Id
unsigned char *cipher;
BSB_IMPORT_ptr(bsb, cipher, 2);
if (!BSB_IS_ERROR(bsb)) {
char str[100];
if (ver[0] == 3) {
switch (ver[1]) {
case 0:
moloch_field_string_add(verField, session, "SSLv3", 5, TRUE);
break;
case 1:
moloch_field_string_add(verField, session, "TLSv1", 5, TRUE);
break;
case 2:
moloch_field_string_add(verField, session, "TLSv1.1", 7, TRUE);
break;
case 3:
moloch_field_string_add(verField, session, "TLSv1.2", 7, TRUE);
break;
default:
snprintf(str, sizeof(str), "0x%02x.%02x", ver[0], ver[1]);
moloch_field_string_add(verField, session, str, 6, TRUE);
}
} else {
snprintf(str, sizeof(str), "0x%02x.%02x", ver[0], ver[1]);
moloch_field_string_add(verField, session, str, 7, TRUE);
}
char *cipherStr = ciphers[cipher[0]][cipher[1]];
if (cipherStr)
moloch_field_string_add(cipherField, session, cipherStr, -1, TRUE);
else {
snprintf(str, sizeof(str), "%02X%02X", cipher[0], cipher[1]);
moloch_field_string_add(cipherField, session, str, 4, TRUE);
}
}
}
// SSH Parsing currently assumes the parts we want from a SSH Packet will be
// in a single TCP packet. Kind of sucks.
int ssh_parser(MolochSession_t *session, void *uw, const unsigned char *data, int remaining, int which)
{
SSHInfo_t *ssh = uw;
if (memcmp("SSH", data, 3) == 0) {
unsigned char *n = memchr(data, 0x0a, remaining);
if (n && *(n-1) == 0x0d)
n--;
if (n) {
int len = (n - data);
char *str = g_ascii_strdown((char *)data, len);
if (!moloch_field_string_add(verField, session, str, len, FALSE)) {
g_free(str);
}
}
return 0;
}
if (which != 1)
return 0;
BSB bsb;
BSB_INIT(bsb, data, remaining);
while (BSB_REMAINING(bsb) > 6) {
uint32_t loopRemaining = BSB_REMAINING(bsb);
// If 0 looking for a ssh packet, otherwise in the middle of ssh packet
if (ssh->sshLen == 0) {
BSB_IMPORT_u32(bsb, ssh->sshLen);
// Can't have a ssh packet > 35000 bytes.
if (ssh->sshLen >= 35000) {
moloch_parsers_unregister(session, uw);
return 0;
}
ssh->sshLen += 4;
uint8_t sshCode = 0;
BSB_IMPORT_skip(bsb, 1); // padding length
BSB_IMPORT_u08(bsb, sshCode);
if (sshCode == 33) {
moloch_parsers_unregister(session, uw);
uint32_t keyLen = 0;
BSB_IMPORT_u32(bsb, keyLen);
if (!BSB_IS_ERROR(bsb) && BSB_REMAINING(bsb) >= keyLen) {
char *str = g_base64_encode(BSB_WORK_PTR(bsb), keyLen);
if (!moloch_field_string_add(keyField, session, str, (keyLen/3+1)*4, FALSE)) {
g_free(str);
}
}
break;
}
}
if (loopRemaining > ssh->sshLen) {
// Processed all, looking for another packet
BSB_IMPORT_skip(bsb, loopRemaining);
ssh->sshLen = 0;
continue;
} else {
// Waiting on more data then in this callback
ssh->sshLen -= loopRemaining;
break;
}
}
return 0;
}
void wise_cb(unsigned char *data, int data_len, gpointer uw)
{
BSB bsb;
WiseRequest_t *request = uw;
int i;
inflight -= request->numItems;
BSB_INIT(bsb, data, data_len);
uint32_t fts = 0, ver = 0;
BSB_IMPORT_u32(bsb, fts);
BSB_IMPORT_u32(bsb, ver);
if (BSB_IS_ERROR(bsb) || ver != 0) {
for (i = 0; i < request->numItems; i++) {
wise_free_item(request->items[i]);
}
MOLOCH_TYPE_FREE(WiseRequest_t, request);
return;
}
if (fts != fieldsTS)
wise_load_fields();
struct timeval currentTime;
gettimeofday(¤tTime, NULL);
for (i = 0; i < request->numItems; i++) {
WiseItem_t *wi = request->items[i];
BSB_IMPORT_u08(bsb, wi->numOps);
if (wi->numOps > 0) {
wi->ops = malloc(wi->numOps * sizeof(WiseOp_t));
int i;
for (i = 0; i < wi->numOps; i++) {
WiseOp_t *op = &(wi->ops[i]);
int rfield = 0;
BSB_IMPORT_u08(bsb, rfield);
op->fieldPos = fieldsMap[rfield];
int len = 0;
BSB_IMPORT_u08(bsb, len);
char *str = (char*)BSB_WORK_PTR(bsb);
BSB_IMPORT_skip(bsb, len);
switch (config.fields[op->fieldPos]->type) {
case MOLOCH_FIELD_TYPE_INT_HASH:
if (op->fieldPos == tagsField) {
moloch_db_get_tag(NULL, tagsField, str, NULL); // Preload the tagname -> tag mapping
op->str = g_strdup(str);
op->strLenOrInt = len - 1;
continue;
}
// Fall thru
case MOLOCH_FIELD_TYPE_INT:
case MOLOCH_FIELD_TYPE_INT_ARRAY:
op->str = 0;
op->strLenOrInt = atoi(str);
break;
case MOLOCH_FIELD_TYPE_STR:
case MOLOCH_FIELD_TYPE_STR_ARRAY:
case MOLOCH_FIELD_TYPE_STR_HASH:
op->str = g_strdup(str);
op->strLenOrInt = len - 1;
break;
case MOLOCH_FIELD_TYPE_IP:
case MOLOCH_FIELD_TYPE_IP_HASH:
op->str = 0;
op->strLenOrInt = inet_addr(str);
break;
default:
LOG("WARNING - Unsupported expression type for %s", str);
continue;
}
}
}
wi->loadTime = currentTime.tv_sec;
int s;
for (s = 0; s < wi->numSessions; s++) {
wise_process_ops(wi->sessions[s], wi);
moloch_nids_decr_outstanding(wi->sessions[s]);
}
g_free(wi->sessions);
wi->sessions = 0;
wi->numSessions = 0;
DLL_PUSH_HEAD(wil_, &itemList[(int)wi->type], wi);
// Cache needs to be reduced
if (itemList[(int)wi->type].wil_count > maxCache) {
DLL_POP_TAIL(wil_, &itemList[(int)wi->type], wi);
wise_free_item(wi);
}
}
MOLOCH_TYPE_FREE(WiseRequest_t, request);
}
void dns_parser(MolochSession_t *session, const unsigned char *data, int len)
{
if (len < 18)
return;
int qr = (data[2] >> 7) & 0x1;
int opcode = (data[2] >> 3) & 0xf;
if (opcode != 0)
return;
int qdcount = (data[4] << 8) | data[5];
int ancount = (data[6] << 8) | data[7];
if (qdcount > 10 || qdcount <= 0)
return;
BSB bsb;
BSB_INIT(bsb, data + 12, len - 12);
/* QD Section */
int i;
for (i = 0; BSB_NOT_ERROR(bsb) && i < qdcount; i++) {
int namelen;
unsigned char *name = dns_name(data, len, &bsb, &namelen);
if (BSB_IS_ERROR(bsb))
break;
if (!namelen) {
name = (unsigned char*)"<root>";
namelen = 6;
}
unsigned short qtype = 0 , qclass = 0 ;
BSB_IMPORT_u16(bsb, qtype);
BSB_IMPORT_u16(bsb, qclass);
char *lower = g_ascii_strdown((char*)name, namelen);
if (qclass <= 255 && qclasses[qclass]) {
moloch_field_string_add(queryClassField, session, qclasses[qclass], -1, TRUE);
}
if (qtype <= 255 && qtypes[qtype]) {
moloch_field_string_add(queryTypeField, session, qtypes[qtype], -1, TRUE);
}
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
}
moloch_nids_add_protocol(session, "dns");
if (qr == 0)
return;
int rcode = data[3] & 0xf;
moloch_field_string_add(statusField, session, statuses[rcode], -1, TRUE);
for (i = 0; BSB_NOT_ERROR(bsb) && i < ancount; i++) {
int namelen;
dns_name(data, len, &bsb, &namelen);
if (BSB_IS_ERROR(bsb))
break;
uint16_t antype = 0;
BSB_IMPORT_u16 (bsb, antype);
uint16_t anclass = 0;
BSB_IMPORT_u16 (bsb, anclass);
BSB_IMPORT_skip(bsb, 4); // ttl
uint16_t rdlength = 0;
BSB_IMPORT_u16 (bsb, rdlength);
if (BSB_REMAINING(bsb) < rdlength) {
break;
}
if (anclass != 1) {
BSB_IMPORT_skip(bsb, rdlength);
continue;
}
switch (antype) {
case 1: {
if (rdlength != 4)
break;
struct in_addr in;
unsigned char *ptr = BSB_WORK_PTR(bsb);
in.s_addr = ptr[3] << 24 | ptr[2] << 16 | ptr[1] << 8 | ptr[0];
moloch_field_int_add(ipField, session, in.s_addr);
break;
}
case 5: {
BSB rdbsb;
BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength);
int namelen;
unsigned char *name = dns_name(data, len, &rdbsb, &namelen);
if (!namelen || BSB_IS_ERROR(rdbsb))
continue;
char *lower = g_ascii_strdown((char*)name, namelen);
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
break;
}
case 15: {
BSB rdbsb;
BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength);
BSB_IMPORT_skip(rdbsb, 2); // preference
int namelen;
unsigned char *name = dns_name(data, len, &rdbsb, &namelen);
if (!namelen || BSB_IS_ERROR(rdbsb))
continue;
char *lower = g_ascii_strdown((char*)name, namelen);
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
}
} /* switch */
BSB_IMPORT_skip(bsb, rdlength);
}
}
int radius_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which))
{
BSB bsb;
BSB_INIT(bsb, data, len);
BSB_IMPORT_skip(bsb, 20);
unsigned char type = 0, length = 0;
unsigned char *value;
char str[256];
struct in_addr in;
int i;
while (BSB_REMAINING(bsb) > 2) {
BSB_IMPORT_u08(bsb, type);
BSB_IMPORT_u08(bsb, length);
length -= 2; // length includes the type/length
BSB_IMPORT_ptr(bsb, value, length);
if (BSB_IS_ERROR(bsb)) {
break;
}
switch (type) {
case 1:
moloch_field_string_add(userField, session, (char *)value, length, TRUE);
break;
/* case 4:
LOG("NAS-IP-Address: %d %d %u.%u.%u.%u", type, length, value[0], value[1], value[2], value[3]);
break;*/
case 8:
memcpy(&in.s_addr, value, 4);
moloch_field_int_add(framedIpField, session, in.s_addr);
break;
case 31:
if (length == 12) {
snprintf(str, sizeof(str), "%c%c:%c%c:%c%c:%c%c:%c%c:%c%c",
value[0], value[1],
value[2], value[3],
value[4], value[5],
value[6], value[7],
value[8], value[9],
value[10], value[11]);
for (i = 0; i < 17; i++) {
if (isupper (str[i]))
str[i] = tolower (str[i]);
}
moloch_field_string_add(macField, session, str, 17, TRUE);
}
break;
case 66:
memcpy(str, value, length);
str[length] = 0;
inet_aton(str, &in);
moloch_field_int_add(endpointIpField, session, in.s_addr);
break;
/* default:
LOG("%d %d %.*s", type, length, length, value);*/
}
}
return 0;
}
LOCAL int quic_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which))
{
int version = -1;
int offset = 1;
// PUBLIC_FLAG_RESET
if (data[0] & 0x02) {
return 0;
}
// CID
if (data[0] & 0x08) {
offset += 8;
}
// Get version
if (data[0] & 0x01 && data[offset] == 'Q') {
version = (data[offset+1] - '0') * 100 +
(data[offset+2] - '0') * 10 +
(data[offset+3] - '0');
offset += 4;
}
// Unsupported version
if (version < 24) {
moloch_parsers_unregister(session, uw);
return 0;
}
// Diversification only is from server to client, so we can ignore
// Packet number size
if ((data[0] & 0x30) == 0) {
offset++;
} else {
offset += ((data[0] & 0x30) >> 4) * 2;
}
// Hash
offset += 12;
// Private Flags
if (version < 34)
offset++;
if (offset > len)
return 0;
BSB bsb;
BSB_INIT(bsb, data+offset, len-offset);
while (!BSB_IS_ERROR(bsb) && BSB_REMAINING(bsb)) {
uint8_t type = 0;
BSB_LIMPORT_u08(bsb, type);
//1fdooossB
if ((type & 0x80) == 0) {
return 0;
}
int offsetLen = 0;
if (type & 0x1C) {
offsetLen = ((type & 0x1C) >> 2) + 1;
}
int streamLen = (type & 0x03) + 1;
BSB_LIMPORT_skip(bsb, streamLen + offsetLen);
int dataLen = BSB_REMAINING(bsb);
if (type & 0x20) {
BSB_LIMPORT_u16(bsb, dataLen);
}
if (BSB_IS_ERROR(bsb))
return 0;
BSB dbsb;
BSB_INIT(dbsb, BSB_WORK_PTR(bsb), MIN(dataLen, BSB_REMAINING(bsb)));
BSB_IMPORT_skip(bsb, dataLen);
quic_chlo_parser(session,dbsb);
moloch_parsers_unregister(session, uw);
return 0;
}
