void
tls_process_client(MolochSession_t *session, const unsigned char *data, int len)
{
BSB sslbsb;
BSB_INIT(sslbsb, data, len);
if (BSB_REMAINING(sslbsb) > 5) {
unsigned char *ssldata = BSB_WORK_PTR(sslbsb);
int ssllen = MIN(BSB_REMAINING(sslbsb) - 5, ssldata[3] << 8 | ssldata[4]);
BSB pbsb;
BSB_INIT(pbsb, ssldata+5, ssllen);
if (BSB_REMAINING(pbsb) > 7) {
unsigned char *pdata = BSB_WORK_PTR(pbsb);
int plen = MIN(BSB_REMAINING(pbsb) - 4, pdata[2] << 8 | pdata[3]);
BSB cbsb;
BSB_INIT(cbsb, pdata+6, plen-2); // The - 4 for plen is done above, confusing
if(BSB_REMAINING(cbsb) > 32) {
BSB_IMPORT_skip(cbsb, 32); // Random
int skiplen = 0;
BSB_IMPORT_u08(cbsb, skiplen); // Session Id Length
BSB_IMPORT_skip(cbsb, skiplen); // Session Id
BSB_IMPORT_u16(cbsb, skiplen); // Ciper Suites Length
BSB_IMPORT_skip(cbsb, skiplen); // Ciper Suites
BSB_IMPORT_u08(cbsb, skiplen); // Compression Length
BSB_IMPORT_skip(cbsb, skiplen); // Compressions
if (BSB_REMAINING(cbsb) > 2) {
int etotlen = 0;
BSB_IMPORT_u16(cbsb, etotlen); // Extensions Length
etotlen = MIN(etotlen, BSB_REMAINING(cbsb));
BSB ebsb;
BSB_INIT(ebsb, BSB_WORK_PTR(cbsb), etotlen);
while (BSB_REMAINING(ebsb) > 0) {
int etype = 0, elen = 0;
BSB_IMPORT_u16 (ebsb, etype);
BSB_IMPORT_u16 (ebsb, elen);
if (etype != 0) {
BSB_IMPORT_skip (ebsb, elen);
continue;
}
if (elen > BSB_REMAINING(ebsb))
break;
BSB snibsb;
BSB_INIT(snibsb, BSB_WORK_PTR(ebsb), elen);
BSB_IMPORT_skip (ebsb, elen);
int sni = 0;
BSB_IMPORT_u16(snibsb, sni); // list len
if (sni != BSB_REMAINING(snibsb))
continue;
BSB_IMPORT_u08(snibsb, sni); // type
if (sni != 0)
continue;
BSB_IMPORT_u16(snibsb, sni); // len
if (sni != BSB_REMAINING(snibsb))
continue;
moloch_field_string_add(hostField, session, (char *)BSB_WORK_PTR(snibsb), sni, TRUE);
}
}
}
}
BSB_IMPORT_skip(sslbsb, ssllen + 5);
}
}
void tls_process_server_certificate(MolochSession_t *session, const unsigned char *data, int len)
{
BSB cbsb;
BSB_INIT(cbsb, data, len);
BSB_IMPORT_skip(cbsb, 3); // Length again
while(BSB_REMAINING(cbsb) > 3) {
int badreason = 0;
unsigned char *cdata = BSB_WORK_PTR(cbsb);
int clen = MIN(BSB_REMAINING(cbsb) - 3, (cdata[0] << 16 | cdata[1] << 8 | cdata[2]));
MolochCertsInfo_t *certs = MOLOCH_TYPE_ALLOC0(MolochCertsInfo_t);
DLL_INIT(s_, &certs->alt);
DLL_INIT(s_, &certs->subject.commonName);
DLL_INIT(s_, &certs->issuer.commonName);
int atag, alen, apc;
unsigned char *value;
BSB bsb;
BSB_INIT(bsb, cdata + 3, clen);
/* Certificate */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 1; goto bad_cert;}
BSB_INIT(bsb, value, alen);
/* signedCertificate */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 2; goto bad_cert;}
BSB_INIT(bsb, value, alen);
/* serialNumber or version*/
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 3; goto bad_cert;}
if (apc) {
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 4; goto bad_cert;}
}
certs->serialNumberLen = alen;
certs->serialNumber = malloc(alen);
memcpy(certs->serialNumber, value, alen);
/* signature */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 5; goto bad_cert;}
/* issuer */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 6; goto bad_cert;}
BSB tbsb;
BSB_INIT(tbsb, value, alen);
tls_certinfo_process(&certs->issuer, &tbsb);
/* validity */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 7; goto bad_cert;}
/* subject */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 8; goto bad_cert;}
BSB_INIT(tbsb, value, alen);
tls_certinfo_process(&certs->subject, &tbsb);
/* subjectPublicKeyInfo */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 9; goto bad_cert;}
/* extensions */
if (BSB_REMAINING(bsb)) {
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 10; goto bad_cert;}
BSB tbsb;
BSB_INIT(tbsb, value, alen);
char lastOid[100];
lastOid[0] = 0;
tls_alt_names(certs, &tbsb, lastOid);
}
if (!moloch_field_certsinfo_add(certsField, session, certs, clen*2)) {
moloch_field_certsinfo_free(certs);
}
BSB_IMPORT_skip(cbsb, clen + 3);
continue;
bad_cert:
if (config.debug)
LOG("bad cert %d - %d", badreason, clen);
moloch_field_certsinfo_free(certs);
break;
}
}
int radius_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which))
{
BSB bsb;
BSB_INIT(bsb, data, len);
BSB_IMPORT_skip(bsb, 20);
unsigned char type = 0, length = 0;
unsigned char *value;
char str[256];
struct in_addr in;
int i;
while (BSB_REMAINING(bsb) > 2) {
BSB_IMPORT_u08(bsb, type);
BSB_IMPORT_u08(bsb, length);
length -= 2; // length includes the type/length
BSB_IMPORT_ptr(bsb, value, length);
if (BSB_IS_ERROR(bsb)) {
break;
}
switch (type) {
case 1:
moloch_field_string_add(userField, session, (char *)value, length, TRUE);
break;
/* case 4:
LOG("NAS-IP-Address: %d %d %u.%u.%u.%u", type, length, value[0], value[1], value[2], value[3]);
break;*/
case 8:
memcpy(&in.s_addr, value, 4);
moloch_field_int_add(framedIpField, session, in.s_addr);
break;
case 31:
if (length == 12) {
snprintf(str, sizeof(str), "%c%c:%c%c:%c%c:%c%c:%c%c:%c%c",
value[0], value[1],
value[2], value[3],
value[4], value[5],
value[6], value[7],
value[8], value[9],
value[10], value[11]);
for (i = 0; i < 17; i++) {
if (isupper (str[i]))
str[i] = tolower (str[i]);
}
moloch_field_string_add(macField, session, str, 17, TRUE);
}
break;
case 66:
memcpy(str, value, length);
str[length] = 0;
inet_aton(str, &in);
moloch_field_int_add(endpointIpField, session, in.s_addr);
break;
/* default:
LOG("%d %d %.*s", type, length, length, value);*/
}
}
return 0;
}
void dns_parser(MolochSession_t *session, const unsigned char *data, int len)
{
if (len < 18)
return;
int qr = (data[2] >> 7) & 0x1;
int opcode = (data[2] >> 3) & 0xf;
if (opcode != 0)
return;
int qdcount = (data[4] << 8) | data[5];
int ancount = (data[6] << 8) | data[7];
if (qdcount > 10 || qdcount <= 0)
return;
BSB bsb;
BSB_INIT(bsb, data + 12, len - 12);
/* QD Section */
int i;
for (i = 0; BSB_NOT_ERROR(bsb) && i < qdcount; i++) {
int namelen;
unsigned char *name = dns_name(data, len, &bsb, &namelen);
if (BSB_IS_ERROR(bsb))
break;
if (!namelen) {
name = (unsigned char*)"<root>";
namelen = 6;
}
unsigned short qtype = 0 , qclass = 0 ;
BSB_IMPORT_u16(bsb, qtype);
BSB_IMPORT_u16(bsb, qclass);
char *lower = g_ascii_strdown((char*)name, namelen);
if (qclass <= 255 && qclasses[qclass]) {
moloch_field_string_add(queryClassField, session, qclasses[qclass], -1, TRUE);
}
if (qtype <= 255 && qtypes[qtype]) {
moloch_field_string_add(queryTypeField, session, qtypes[qtype], -1, TRUE);
}
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
}
moloch_nids_add_protocol(session, "dns");
if (qr == 0)
return;
int rcode = data[3] & 0xf;
moloch_field_string_add(statusField, session, statuses[rcode], -1, TRUE);
for (i = 0; BSB_NOT_ERROR(bsb) && i < ancount; i++) {
int namelen;
dns_name(data, len, &bsb, &namelen);
if (BSB_IS_ERROR(bsb))
break;
uint16_t antype = 0;
BSB_IMPORT_u16 (bsb, antype);
uint16_t anclass = 0;
BSB_IMPORT_u16 (bsb, anclass);
BSB_IMPORT_skip(bsb, 4); // ttl
uint16_t rdlength = 0;
BSB_IMPORT_u16 (bsb, rdlength);
if (BSB_REMAINING(bsb) < rdlength) {
break;
}
if (anclass != 1) {
BSB_IMPORT_skip(bsb, rdlength);
continue;
}
switch (antype) {
case 1: {
if (rdlength != 4)
break;
struct in_addr in;
unsigned char *ptr = BSB_WORK_PTR(bsb);
in.s_addr = ptr[3] << 24 | ptr[2] << 16 | ptr[1] << 8 | ptr[0];
moloch_field_int_add(ipField, session, in.s_addr);
break;
}
case 5: {
BSB rdbsb;
BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength);
int namelen;
unsigned char *name = dns_name(data, len, &rdbsb, &namelen);
if (!namelen || BSB_IS_ERROR(rdbsb))
continue;
char *lower = g_ascii_strdown((char*)name, namelen);
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
break;
}
case 15: {
BSB rdbsb;
BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength);
BSB_IMPORT_skip(rdbsb, 2); // preference
int namelen;
unsigned char *name = dns_name(data, len, &rdbsb, &namelen);
if (!namelen || BSB_IS_ERROR(rdbsb))
continue;
char *lower = g_ascii_strdown((char*)name, namelen);
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
}
} /* switch */
BSB_IMPORT_skip(bsb, rdlength);
}
}
LOCAL int quic_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which))
{
int version = -1;
int offset = 1;
// PUBLIC_FLAG_RESET
if (data[0] & 0x02) {
return 0;
}
// CID
if (data[0] & 0x08) {
offset += 8;
}
// Get version
if (data[0] & 0x01 && data[offset] == 'Q') {
version = (data[offset+1] - '0') * 100 +
(data[offset+2] - '0') * 10 +
(data[offset+3] - '0');
offset += 4;
}
// Unsupported version
if (version < 24) {
moloch_parsers_unregister(session, uw);
return 0;
}
// Diversification only is from server to client, so we can ignore
// Packet number size
if ((data[0] & 0x30) == 0) {
offset++;
} else {
offset += ((data[0] & 0x30) >> 4) * 2;
}
// Hash
offset += 12;
// Private Flags
if (version < 34)
offset++;
if (offset > len)
return 0;
BSB bsb;
BSB_INIT(bsb, data+offset, len-offset);
while (!BSB_IS_ERROR(bsb) && BSB_REMAINING(bsb)) {
uint8_t type = 0;
BSB_LIMPORT_u08(bsb, type);
//1fdooossB
if ((type & 0x80) == 0) {
return 0;
}
int offsetLen = 0;
if (type & 0x1C) {
offsetLen = ((type & 0x1C) >> 2) + 1;
}
int streamLen = (type & 0x03) + 1;
BSB_LIMPORT_skip(bsb, streamLen + offsetLen);
int dataLen = BSB_REMAINING(bsb);
if (type & 0x20) {
BSB_LIMPORT_u16(bsb, dataLen);
}
if (BSB_IS_ERROR(bsb))
return 0;
BSB dbsb;
BSB_INIT(dbsb, BSB_WORK_PTR(bsb), MIN(dataLen, BSB_REMAINING(bsb)));
BSB_IMPORT_skip(bsb, dataLen);
quic_chlo_parser(session,dbsb);
moloch_parsers_unregister(session, uw);
return 0;
}
