void wise_load_fields()
{
char key[500];
int key_len;
memset(fieldsMap, -1, sizeof(fieldsMap));
key_len = snprintf(key, sizeof(key), "/fields");
size_t data_len;
unsigned char *data = moloch_http_send_sync(wiseService, "GET", key, key_len, NULL, 0, NULL, &data_len);;
BSB bsb;
BSB_INIT(bsb, data, data_len);
int ver, cnt = 0;
BSB_IMPORT_u32(bsb, fieldsTS);
BSB_IMPORT_u32(bsb, ver);
BSB_IMPORT_u08(bsb, cnt);
int i;
for (i = 0; i < cnt; i++) {
int len = 0;
BSB_IMPORT_u16(bsb, len); // len includes NULL terminated
fieldsMap[i] = moloch_field_define_text((char*)BSB_WORK_PTR(bsb), NULL);
if (fieldsMap[i] == -1)
fieldsTS = 0;
if (config.debug)
LOG("%d %d %s", i, fieldsMap[i], BSB_WORK_PTR(bsb));
BSB_IMPORT_skip(bsb, len);
}
}
/* @data the data inside the record layer
* @len the length of data inside record layer
*/
int
tls_process_server_handshake_record(MolochSession_t *session, const unsigned char *data, int len)
{
BSB rbsb;
BSB_INIT(rbsb, data, len);
while (BSB_REMAINING(rbsb) >= 4) {
unsigned char *hdata = BSB_WORK_PTR(rbsb);
int hlen = MIN(BSB_REMAINING(rbsb), (hdata[1] << 16 | hdata[2] << 8 | hdata[3]) + 4);
switch(hdata[0]) {
case 2:
tls_process_server_hello(session, hdata+4, hlen-4);
break;
case 11:
tls_process_server_certificate(session, hdata + 4, hlen - 4);
break;
case 14:
return 1;
}
BSB_IMPORT_skip(rbsb, hlen);
}
return 0;
}
// SSH Parsing currently assumes the parts we want from a SSH Packet will be
// in a single TCP packet. Kind of sucks.
int ssh_parser(MolochSession_t *session, void *uw, const unsigned char *data, int remaining, int which)
{
SSHInfo_t *ssh = uw;
if (memcmp("SSH", data, 3) == 0) {
unsigned char *n = memchr(data, 0x0a, remaining);
if (n && *(n-1) == 0x0d)
n--;
if (n) {
int len = (n - data);
char *str = g_ascii_strdown((char *)data, len);
if (!moloch_field_string_add(verField, session, str, len, FALSE)) {
g_free(str);
}
}
return 0;
}
if (which != 1)
return 0;
BSB bsb;
BSB_INIT(bsb, data, remaining);
while (BSB_REMAINING(bsb) > 6) {
uint32_t loopRemaining = BSB_REMAINING(bsb);
// If 0 looking for a ssh packet, otherwise in the middle of ssh packet
if (ssh->sshLen == 0) {
BSB_IMPORT_u32(bsb, ssh->sshLen);
// Can't have a ssh packet > 35000 bytes.
if (ssh->sshLen >= 35000) {
moloch_parsers_unregister(session, uw);
return 0;
}
ssh->sshLen += 4;
uint8_t sshCode = 0;
BSB_IMPORT_skip(bsb, 1); // padding length
BSB_IMPORT_u08(bsb, sshCode);
if (sshCode == 33) {
moloch_parsers_unregister(session, uw);
uint32_t keyLen = 0;
BSB_IMPORT_u32(bsb, keyLen);
if (!BSB_IS_ERROR(bsb) && BSB_REMAINING(bsb) >= keyLen) {
char *str = g_base64_encode(BSB_WORK_PTR(bsb), keyLen);
if (!moloch_field_string_add(keyField, session, str, (keyLen/3+1)*4, FALSE)) {
g_free(str);
}
}
break;
}
}
if (loopRemaining > ssh->sshLen) {
// Processed all, looking for another packet
BSB_IMPORT_skip(bsb, loopRemaining);
ssh->sshLen = 0;
continue;
} else {
// Waiting on more data then in this callback
ssh->sshLen -= loopRemaining;
break;
}
}
return 0;
}
void
tls_process_client(MolochSession_t *session, const unsigned char *data, int len)
{
BSB sslbsb;
BSB_INIT(sslbsb, data, len);
if (BSB_REMAINING(sslbsb) > 5) {
unsigned char *ssldata = BSB_WORK_PTR(sslbsb);
int ssllen = MIN(BSB_REMAINING(sslbsb) - 5, ssldata[3] << 8 | ssldata[4]);
BSB pbsb;
BSB_INIT(pbsb, ssldata+5, ssllen);
if (BSB_REMAINING(pbsb) > 7) {
unsigned char *pdata = BSB_WORK_PTR(pbsb);
int plen = MIN(BSB_REMAINING(pbsb) - 4, pdata[2] << 8 | pdata[3]);
BSB cbsb;
BSB_INIT(cbsb, pdata+6, plen-2); // The - 4 for plen is done above, confusing
if(BSB_REMAINING(cbsb) > 32) {
BSB_IMPORT_skip(cbsb, 32); // Random
int skiplen = 0;
BSB_IMPORT_u08(cbsb, skiplen); // Session Id Length
BSB_IMPORT_skip(cbsb, skiplen); // Session Id
BSB_IMPORT_u16(cbsb, skiplen); // Ciper Suites Length
BSB_IMPORT_skip(cbsb, skiplen); // Ciper Suites
BSB_IMPORT_u08(cbsb, skiplen); // Compression Length
BSB_IMPORT_skip(cbsb, skiplen); // Compressions
if (BSB_REMAINING(cbsb) > 2) {
int etotlen = 0;
BSB_IMPORT_u16(cbsb, etotlen); // Extensions Length
etotlen = MIN(etotlen, BSB_REMAINING(cbsb));
BSB ebsb;
BSB_INIT(ebsb, BSB_WORK_PTR(cbsb), etotlen);
while (BSB_REMAINING(ebsb) > 0) {
int etype = 0, elen = 0;
BSB_IMPORT_u16 (ebsb, etype);
BSB_IMPORT_u16 (ebsb, elen);
if (etype != 0) {
BSB_IMPORT_skip (ebsb, elen);
continue;
}
if (elen > BSB_REMAINING(ebsb))
break;
BSB snibsb;
BSB_INIT(snibsb, BSB_WORK_PTR(ebsb), elen);
BSB_IMPORT_skip (ebsb, elen);
int sni = 0;
BSB_IMPORT_u16(snibsb, sni); // list len
if (sni != BSB_REMAINING(snibsb))
continue;
BSB_IMPORT_u08(snibsb, sni); // type
if (sni != 0)
continue;
BSB_IMPORT_u16(snibsb, sni); // len
if (sni != BSB_REMAINING(snibsb))
continue;
moloch_field_string_add(hostField, session, (char *)BSB_WORK_PTR(snibsb), sni, TRUE);
}
}
}
}
BSB_IMPORT_skip(sslbsb, ssllen + 5);
}
}
void tls_process_server_certificate(MolochSession_t *session, const unsigned char *data, int len)
{
BSB cbsb;
BSB_INIT(cbsb, data, len);
BSB_IMPORT_skip(cbsb, 3); // Length again
while(BSB_REMAINING(cbsb) > 3) {
int badreason = 0;
unsigned char *cdata = BSB_WORK_PTR(cbsb);
int clen = MIN(BSB_REMAINING(cbsb) - 3, (cdata[0] << 16 | cdata[1] << 8 | cdata[2]));
MolochCertsInfo_t *certs = MOLOCH_TYPE_ALLOC0(MolochCertsInfo_t);
DLL_INIT(s_, &certs->alt);
DLL_INIT(s_, &certs->subject.commonName);
DLL_INIT(s_, &certs->issuer.commonName);
int atag, alen, apc;
unsigned char *value;
BSB bsb;
BSB_INIT(bsb, cdata + 3, clen);
/* Certificate */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 1; goto bad_cert;}
BSB_INIT(bsb, value, alen);
/* signedCertificate */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 2; goto bad_cert;}
BSB_INIT(bsb, value, alen);
/* serialNumber or version*/
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 3; goto bad_cert;}
if (apc) {
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 4; goto bad_cert;}
}
certs->serialNumberLen = alen;
certs->serialNumber = malloc(alen);
memcpy(certs->serialNumber, value, alen);
/* signature */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 5; goto bad_cert;}
/* issuer */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 6; goto bad_cert;}
BSB tbsb;
BSB_INIT(tbsb, value, alen);
tls_certinfo_process(&certs->issuer, &tbsb);
/* validity */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 7; goto bad_cert;}
/* subject */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 8; goto bad_cert;}
BSB_INIT(tbsb, value, alen);
tls_certinfo_process(&certs->subject, &tbsb);
/* subjectPublicKeyInfo */
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 9; goto bad_cert;}
/* extensions */
if (BSB_REMAINING(bsb)) {
if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen)))
{badreason = 10; goto bad_cert;}
BSB tbsb;
BSB_INIT(tbsb, value, alen);
char lastOid[100];
lastOid[0] = 0;
tls_alt_names(certs, &tbsb, lastOid);
}
if (!moloch_field_certsinfo_add(certsField, session, certs, clen*2)) {
moloch_field_certsinfo_free(certs);
}
BSB_IMPORT_skip(cbsb, clen + 3);
continue;
bad_cert:
if (config.debug)
LOG("bad cert %d - %d", badreason, clen);
moloch_field_certsinfo_free(certs);
break;
}
}
void wise_cb(unsigned char *data, int data_len, gpointer uw)
{
BSB bsb;
WiseRequest_t *request = uw;
int i;
inflight -= request->numItems;
BSB_INIT(bsb, data, data_len);
uint32_t fts = 0, ver = 0;
BSB_IMPORT_u32(bsb, fts);
BSB_IMPORT_u32(bsb, ver);
if (BSB_IS_ERROR(bsb) || ver != 0) {
for (i = 0; i < request->numItems; i++) {
wise_free_item(request->items[i]);
}
MOLOCH_TYPE_FREE(WiseRequest_t, request);
return;
}
if (fts != fieldsTS)
wise_load_fields();
struct timeval currentTime;
gettimeofday(¤tTime, NULL);
for (i = 0; i < request->numItems; i++) {
WiseItem_t *wi = request->items[i];
BSB_IMPORT_u08(bsb, wi->numOps);
if (wi->numOps > 0) {
wi->ops = malloc(wi->numOps * sizeof(WiseOp_t));
int i;
for (i = 0; i < wi->numOps; i++) {
WiseOp_t *op = &(wi->ops[i]);
int rfield = 0;
BSB_IMPORT_u08(bsb, rfield);
op->fieldPos = fieldsMap[rfield];
int len = 0;
BSB_IMPORT_u08(bsb, len);
char *str = (char*)BSB_WORK_PTR(bsb);
BSB_IMPORT_skip(bsb, len);
switch (config.fields[op->fieldPos]->type) {
case MOLOCH_FIELD_TYPE_INT_HASH:
if (op->fieldPos == tagsField) {
moloch_db_get_tag(NULL, tagsField, str, NULL); // Preload the tagname -> tag mapping
op->str = g_strdup(str);
op->strLenOrInt = len - 1;
continue;
}
// Fall thru
case MOLOCH_FIELD_TYPE_INT:
case MOLOCH_FIELD_TYPE_INT_ARRAY:
op->str = 0;
op->strLenOrInt = atoi(str);
break;
case MOLOCH_FIELD_TYPE_STR:
case MOLOCH_FIELD_TYPE_STR_ARRAY:
case MOLOCH_FIELD_TYPE_STR_HASH:
op->str = g_strdup(str);
op->strLenOrInt = len - 1;
break;
case MOLOCH_FIELD_TYPE_IP:
case MOLOCH_FIELD_TYPE_IP_HASH:
op->str = 0;
op->strLenOrInt = inet_addr(str);
break;
default:
LOG("WARNING - Unsupported expression type for %s", str);
continue;
}
}
}
wi->loadTime = currentTime.tv_sec;
int s;
for (s = 0; s < wi->numSessions; s++) {
wise_process_ops(wi->sessions[s], wi);
moloch_nids_decr_outstanding(wi->sessions[s]);
}
g_free(wi->sessions);
wi->sessions = 0;
wi->numSessions = 0;
DLL_PUSH_HEAD(wil_, &itemList[(int)wi->type], wi);
// Cache needs to be reduced
if (itemList[(int)wi->type].wil_count > maxCache) {
DLL_POP_TAIL(wil_, &itemList[(int)wi->type], wi);
wise_free_item(wi);
}
}
MOLOCH_TYPE_FREE(WiseRequest_t, request);
}
void dns_parser(MolochSession_t *session, const unsigned char *data, int len)
{
if (len < 18)
return;
int qr = (data[2] >> 7) & 0x1;
int opcode = (data[2] >> 3) & 0xf;
if (opcode != 0)
return;
int qdcount = (data[4] << 8) | data[5];
int ancount = (data[6] << 8) | data[7];
if (qdcount > 10 || qdcount <= 0)
return;
BSB bsb;
BSB_INIT(bsb, data + 12, len - 12);
/* QD Section */
int i;
for (i = 0; BSB_NOT_ERROR(bsb) && i < qdcount; i++) {
int namelen;
unsigned char *name = dns_name(data, len, &bsb, &namelen);
if (BSB_IS_ERROR(bsb))
break;
if (!namelen) {
name = (unsigned char*)"<root>";
namelen = 6;
}
unsigned short qtype = 0 , qclass = 0 ;
BSB_IMPORT_u16(bsb, qtype);
BSB_IMPORT_u16(bsb, qclass);
char *lower = g_ascii_strdown((char*)name, namelen);
if (qclass <= 255 && qclasses[qclass]) {
moloch_field_string_add(queryClassField, session, qclasses[qclass], -1, TRUE);
}
if (qtype <= 255 && qtypes[qtype]) {
moloch_field_string_add(queryTypeField, session, qtypes[qtype], -1, TRUE);
}
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
}
moloch_nids_add_protocol(session, "dns");
if (qr == 0)
return;
int rcode = data[3] & 0xf;
moloch_field_string_add(statusField, session, statuses[rcode], -1, TRUE);
for (i = 0; BSB_NOT_ERROR(bsb) && i < ancount; i++) {
int namelen;
dns_name(data, len, &bsb, &namelen);
if (BSB_IS_ERROR(bsb))
break;
uint16_t antype = 0;
BSB_IMPORT_u16 (bsb, antype);
uint16_t anclass = 0;
BSB_IMPORT_u16 (bsb, anclass);
BSB_IMPORT_skip(bsb, 4); // ttl
uint16_t rdlength = 0;
BSB_IMPORT_u16 (bsb, rdlength);
if (BSB_REMAINING(bsb) < rdlength) {
break;
}
if (anclass != 1) {
BSB_IMPORT_skip(bsb, rdlength);
continue;
}
switch (antype) {
case 1: {
if (rdlength != 4)
break;
struct in_addr in;
unsigned char *ptr = BSB_WORK_PTR(bsb);
in.s_addr = ptr[3] << 24 | ptr[2] << 16 | ptr[1] << 8 | ptr[0];
moloch_field_int_add(ipField, session, in.s_addr);
break;
}
case 5: {
BSB rdbsb;
BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength);
int namelen;
unsigned char *name = dns_name(data, len, &rdbsb, &namelen);
if (!namelen || BSB_IS_ERROR(rdbsb))
continue;
char *lower = g_ascii_strdown((char*)name, namelen);
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
break;
}
case 15: {
BSB rdbsb;
BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength);
BSB_IMPORT_skip(rdbsb, 2); // preference
int namelen;
unsigned char *name = dns_name(data, len, &rdbsb, &namelen);
if (!namelen || BSB_IS_ERROR(rdbsb))
continue;
char *lower = g_ascii_strdown((char*)name, namelen);
if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) {
g_free(lower);
}
}
} /* switch */
BSB_IMPORT_skip(bsb, rdlength);
}
}
LOCAL int quic_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which))
{
int version = -1;
int offset = 1;
// PUBLIC_FLAG_RESET
if (data[0] & 0x02) {
return 0;
}
// CID
if (data[0] & 0x08) {
offset += 8;
}
// Get version
if (data[0] & 0x01 && data[offset] == 'Q') {
version = (data[offset+1] - '0') * 100 +
(data[offset+2] - '0') * 10 +
(data[offset+3] - '0');
offset += 4;
}
// Unsupported version
if (version < 24) {
moloch_parsers_unregister(session, uw);
return 0;
}
// Diversification only is from server to client, so we can ignore
// Packet number size
if ((data[0] & 0x30) == 0) {
offset++;
} else {
offset += ((data[0] & 0x30) >> 4) * 2;
}
// Hash
offset += 12;
// Private Flags
if (version < 34)
offset++;
if (offset > len)
return 0;
BSB bsb;
BSB_INIT(bsb, data+offset, len-offset);
while (!BSB_IS_ERROR(bsb) && BSB_REMAINING(bsb)) {
uint8_t type = 0;
BSB_LIMPORT_u08(bsb, type);
//1fdooossB
if ((type & 0x80) == 0) {
return 0;
}
int offsetLen = 0;
if (type & 0x1C) {
offsetLen = ((type & 0x1C) >> 2) + 1;
}
int streamLen = (type & 0x03) + 1;
BSB_LIMPORT_skip(bsb, streamLen + offsetLen);
int dataLen = BSB_REMAINING(bsb);
if (type & 0x20) {
BSB_LIMPORT_u16(bsb, dataLen);
}
if (BSB_IS_ERROR(bsb))
return 0;
BSB dbsb;
BSB_INIT(dbsb, BSB_WORK_PTR(bsb), MIN(dataLen, BSB_REMAINING(bsb)));
BSB_IMPORT_skip(bsb, dataLen);
quic_chlo_parser(session,dbsb);
moloch_parsers_unregister(session, uw);
return 0;
}
