int dns_name_element(BSB *nbsb, BSB *bsb) { int nlen = 0; BSB_IMPORT_u08(*bsb, nlen); if (nlen == 0 || nlen > BSB_REMAINING(*bsb)) { return 1; } int j; for (j = 0; j < nlen; j++) { register u_char c = 0; BSB_IMPORT_u08(*bsb, c); if (!isascii(c)) { BSB_EXPORT_u08(*nbsb, 'M'); BSB_EXPORT_u08(*nbsb, '-'); c = toascii(c); } if (!isprint(c)) { BSB_EXPORT_u08(*nbsb, '^'); c ^= 0x40; } BSB_EXPORT_u08(*nbsb, c); } return 0; }
void wise_load_fields() { char key[500]; int key_len; memset(fieldsMap, -1, sizeof(fieldsMap)); key_len = snprintf(key, sizeof(key), "/fields"); size_t data_len; unsigned char *data = moloch_http_send_sync(wiseService, "GET", key, key_len, NULL, 0, NULL, &data_len);; BSB bsb; BSB_INIT(bsb, data, data_len); int ver, cnt = 0; BSB_IMPORT_u32(bsb, fieldsTS); BSB_IMPORT_u32(bsb, ver); BSB_IMPORT_u08(bsb, cnt); int i; for (i = 0; i < cnt; i++) { int len = 0; BSB_IMPORT_u16(bsb, len); // len includes NULL terminated fieldsMap[i] = moloch_field_define_text((char*)BSB_WORK_PTR(bsb), NULL); if (fieldsMap[i] == -1) fieldsTS = 0; if (config.debug) LOG("%d %d %s", i, fieldsMap[i], BSB_WORK_PTR(bsb)); BSB_IMPORT_skip(bsb, len); } }
void tls_process_server_hello(MolochSession_t *session, const unsigned char *data, int len) { BSB bsb; BSB_INIT(bsb, data, len); unsigned char *ver; BSB_IMPORT_ptr(bsb, ver, 2); BSB_IMPORT_skip(bsb, 32); // Random int skiplen = 0; BSB_IMPORT_u08(bsb, skiplen); // Session Id Length BSB_IMPORT_skip(bsb, skiplen); // Session Id unsigned char *cipher; BSB_IMPORT_ptr(bsb, cipher, 2); if (!BSB_IS_ERROR(bsb)) { char str[100]; if (ver[0] == 3) { switch (ver[1]) { case 0: moloch_field_string_add(verField, session, "SSLv3", 5, TRUE); break; case 1: moloch_field_string_add(verField, session, "TLSv1", 5, TRUE); break; case 2: moloch_field_string_add(verField, session, "TLSv1.1", 7, TRUE); break; case 3: moloch_field_string_add(verField, session, "TLSv1.2", 7, TRUE); break; default: snprintf(str, sizeof(str), "0x%02x.%02x", ver[0], ver[1]); moloch_field_string_add(verField, session, str, 6, TRUE); } } else { snprintf(str, sizeof(str), "0x%02x.%02x", ver[0], ver[1]); moloch_field_string_add(verField, session, str, 7, TRUE); } char *cipherStr = ciphers[cipher[0]][cipher[1]]; if (cipherStr) moloch_field_string_add(cipherField, session, cipherStr, -1, TRUE); else { snprintf(str, sizeof(str), "%02X%02X", cipher[0], cipher[1]); moloch_field_string_add(cipherField, session, str, 4, TRUE); } } }
unsigned char *dns_name(const unsigned char *full, int fulllen, BSB *inbsb, int *namelen) { static unsigned char name[8000]; BSB nbsb; int didPointer = 0; BSB tmpbsb; BSB *curbsb; BSB_INIT(nbsb, name, sizeof(name)); curbsb = inbsb; while (BSB_REMAINING(*curbsb)) { unsigned char ch = 0; BSB_IMPORT_u08(*curbsb, ch); if (ch == 0) break; BSB_EXPORT_rewind(*curbsb, 1); if (ch & 0xc0) { if (didPointer > 5) return 0; didPointer++; int tpos = 0; BSB_IMPORT_u16(*curbsb, tpos); tpos &= 0x3fff; BSB_INIT(tmpbsb, full+tpos, fulllen - tpos); curbsb = &tmpbsb; continue; } if (BSB_LENGTH(nbsb)) { BSB_EXPORT_u08(nbsb, '.'); } if (dns_name_element(&nbsb, curbsb) && BSB_LENGTH(nbsb)) BSB_EXPORT_rewind(nbsb, 1); // Remove last . } *namelen = BSB_LENGTH(nbsb); BSB_EXPORT_u08(nbsb, 0); return name; }
// SSH Parsing currently assumes the parts we want from a SSH Packet will be // in a single TCP packet. Kind of sucks. int ssh_parser(MolochSession_t *session, void *uw, const unsigned char *data, int remaining, int which) { SSHInfo_t *ssh = uw; if (memcmp("SSH", data, 3) == 0) { unsigned char *n = memchr(data, 0x0a, remaining); if (n && *(n-1) == 0x0d) n--; if (n) { int len = (n - data); char *str = g_ascii_strdown((char *)data, len); if (!moloch_field_string_add(verField, session, str, len, FALSE)) { g_free(str); } } return 0; } if (which != 1) return 0; BSB bsb; BSB_INIT(bsb, data, remaining); while (BSB_REMAINING(bsb) > 6) { uint32_t loopRemaining = BSB_REMAINING(bsb); // If 0 looking for a ssh packet, otherwise in the middle of ssh packet if (ssh->sshLen == 0) { BSB_IMPORT_u32(bsb, ssh->sshLen); // Can't have a ssh packet > 35000 bytes. if (ssh->sshLen >= 35000) { moloch_parsers_unregister(session, uw); return 0; } ssh->sshLen += 4; uint8_t sshCode = 0; BSB_IMPORT_skip(bsb, 1); // padding length BSB_IMPORT_u08(bsb, sshCode); if (sshCode == 33) { moloch_parsers_unregister(session, uw); uint32_t keyLen = 0; BSB_IMPORT_u32(bsb, keyLen); if (!BSB_IS_ERROR(bsb) && BSB_REMAINING(bsb) >= keyLen) { char *str = g_base64_encode(BSB_WORK_PTR(bsb), keyLen); if (!moloch_field_string_add(keyField, session, str, (keyLen/3+1)*4, FALSE)) { g_free(str); } } break; } } if (loopRemaining > ssh->sshLen) { // Processed all, looking for another packet BSB_IMPORT_skip(bsb, loopRemaining); ssh->sshLen = 0; continue; } else { // Waiting on more data then in this callback ssh->sshLen -= loopRemaining; break; } } return 0; }
void tls_process_client(MolochSession_t *session, const unsigned char *data, int len) { BSB sslbsb; BSB_INIT(sslbsb, data, len); if (BSB_REMAINING(sslbsb) > 5) { unsigned char *ssldata = BSB_WORK_PTR(sslbsb); int ssllen = MIN(BSB_REMAINING(sslbsb) - 5, ssldata[3] << 8 | ssldata[4]); BSB pbsb; BSB_INIT(pbsb, ssldata+5, ssllen); if (BSB_REMAINING(pbsb) > 7) { unsigned char *pdata = BSB_WORK_PTR(pbsb); int plen = MIN(BSB_REMAINING(pbsb) - 4, pdata[2] << 8 | pdata[3]); BSB cbsb; BSB_INIT(cbsb, pdata+6, plen-2); // The - 4 for plen is done above, confusing if(BSB_REMAINING(cbsb) > 32) { BSB_IMPORT_skip(cbsb, 32); // Random int skiplen = 0; BSB_IMPORT_u08(cbsb, skiplen); // Session Id Length BSB_IMPORT_skip(cbsb, skiplen); // Session Id BSB_IMPORT_u16(cbsb, skiplen); // Ciper Suites Length BSB_IMPORT_skip(cbsb, skiplen); // Ciper Suites BSB_IMPORT_u08(cbsb, skiplen); // Compression Length BSB_IMPORT_skip(cbsb, skiplen); // Compressions if (BSB_REMAINING(cbsb) > 2) { int etotlen = 0; BSB_IMPORT_u16(cbsb, etotlen); // Extensions Length etotlen = MIN(etotlen, BSB_REMAINING(cbsb)); BSB ebsb; BSB_INIT(ebsb, BSB_WORK_PTR(cbsb), etotlen); while (BSB_REMAINING(ebsb) > 0) { int etype = 0, elen = 0; BSB_IMPORT_u16 (ebsb, etype); BSB_IMPORT_u16 (ebsb, elen); if (etype != 0) { BSB_IMPORT_skip (ebsb, elen); continue; } if (elen > BSB_REMAINING(ebsb)) break; BSB snibsb; BSB_INIT(snibsb, BSB_WORK_PTR(ebsb), elen); BSB_IMPORT_skip (ebsb, elen); int sni = 0; BSB_IMPORT_u16(snibsb, sni); // list len if (sni != BSB_REMAINING(snibsb)) continue; BSB_IMPORT_u08(snibsb, sni); // type if (sni != 0) continue; BSB_IMPORT_u16(snibsb, sni); // len if (sni != BSB_REMAINING(snibsb)) continue; moloch_field_string_add(hostField, session, (char *)BSB_WORK_PTR(snibsb), sni, TRUE); } } } } BSB_IMPORT_skip(sslbsb, ssllen + 5); } }
void wise_cb(unsigned char *data, int data_len, gpointer uw) { BSB bsb; WiseRequest_t *request = uw; int i; inflight -= request->numItems; BSB_INIT(bsb, data, data_len); uint32_t fts = 0, ver = 0; BSB_IMPORT_u32(bsb, fts); BSB_IMPORT_u32(bsb, ver); if (BSB_IS_ERROR(bsb) || ver != 0) { for (i = 0; i < request->numItems; i++) { wise_free_item(request->items[i]); } MOLOCH_TYPE_FREE(WiseRequest_t, request); return; } if (fts != fieldsTS) wise_load_fields(); struct timeval currentTime; gettimeofday(¤tTime, NULL); for (i = 0; i < request->numItems; i++) { WiseItem_t *wi = request->items[i]; BSB_IMPORT_u08(bsb, wi->numOps); if (wi->numOps > 0) { wi->ops = malloc(wi->numOps * sizeof(WiseOp_t)); int i; for (i = 0; i < wi->numOps; i++) { WiseOp_t *op = &(wi->ops[i]); int rfield = 0; BSB_IMPORT_u08(bsb, rfield); op->fieldPos = fieldsMap[rfield]; int len = 0; BSB_IMPORT_u08(bsb, len); char *str = (char*)BSB_WORK_PTR(bsb); BSB_IMPORT_skip(bsb, len); switch (config.fields[op->fieldPos]->type) { case MOLOCH_FIELD_TYPE_INT_HASH: if (op->fieldPos == tagsField) { moloch_db_get_tag(NULL, tagsField, str, NULL); // Preload the tagname -> tag mapping op->str = g_strdup(str); op->strLenOrInt = len - 1; continue; } // Fall thru case MOLOCH_FIELD_TYPE_INT: case MOLOCH_FIELD_TYPE_INT_ARRAY: op->str = 0; op->strLenOrInt = atoi(str); break; case MOLOCH_FIELD_TYPE_STR: case MOLOCH_FIELD_TYPE_STR_ARRAY: case MOLOCH_FIELD_TYPE_STR_HASH: op->str = g_strdup(str); op->strLenOrInt = len - 1; break; case MOLOCH_FIELD_TYPE_IP: case MOLOCH_FIELD_TYPE_IP_HASH: op->str = 0; op->strLenOrInt = inet_addr(str); break; default: LOG("WARNING - Unsupported expression type for %s", str); continue; } } } wi->loadTime = currentTime.tv_sec; int s; for (s = 0; s < wi->numSessions; s++) { wise_process_ops(wi->sessions[s], wi); moloch_nids_decr_outstanding(wi->sessions[s]); } g_free(wi->sessions); wi->sessions = 0; wi->numSessions = 0; DLL_PUSH_HEAD(wil_, &itemList[(int)wi->type], wi); // Cache needs to be reduced if (itemList[(int)wi->type].wil_count > maxCache) { DLL_POP_TAIL(wil_, &itemList[(int)wi->type], wi); wise_free_item(wi); } } MOLOCH_TYPE_FREE(WiseRequest_t, request); }
int radius_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which)) { BSB bsb; BSB_INIT(bsb, data, len); BSB_IMPORT_skip(bsb, 20); unsigned char type = 0, length = 0; unsigned char *value; char str[256]; struct in_addr in; int i; while (BSB_REMAINING(bsb) > 2) { BSB_IMPORT_u08(bsb, type); BSB_IMPORT_u08(bsb, length); length -= 2; // length includes the type/length BSB_IMPORT_ptr(bsb, value, length); if (BSB_IS_ERROR(bsb)) { break; } switch (type) { case 1: moloch_field_string_add(userField, session, (char *)value, length, TRUE); break; /* case 4: LOG("NAS-IP-Address: %d %d %u.%u.%u.%u", type, length, value[0], value[1], value[2], value[3]); break;*/ case 8: memcpy(&in.s_addr, value, 4); moloch_field_int_add(framedIpField, session, in.s_addr); break; case 31: if (length == 12) { snprintf(str, sizeof(str), "%c%c:%c%c:%c%c:%c%c:%c%c:%c%c", value[0], value[1], value[2], value[3], value[4], value[5], value[6], value[7], value[8], value[9], value[10], value[11]); for (i = 0; i < 17; i++) { if (isupper (str[i])) str[i] = tolower (str[i]); } moloch_field_string_add(macField, session, str, 17, TRUE); } break; case 66: memcpy(str, value, length); str[length] = 0; inet_aton(str, &in); moloch_field_int_add(endpointIpField, session, in.s_addr); break; /* default: LOG("%d %d %.*s", type, length, length, value);*/ } } return 0; }