void tls_process_client(MolochSession_t *session, const unsigned char *data, int len) { BSB sslbsb; BSB_INIT(sslbsb, data, len); if (BSB_REMAINING(sslbsb) > 5) { unsigned char *ssldata = BSB_WORK_PTR(sslbsb); int ssllen = MIN(BSB_REMAINING(sslbsb) - 5, ssldata[3] << 8 | ssldata[4]); BSB pbsb; BSB_INIT(pbsb, ssldata+5, ssllen); if (BSB_REMAINING(pbsb) > 7) { unsigned char *pdata = BSB_WORK_PTR(pbsb); int plen = MIN(BSB_REMAINING(pbsb) - 4, pdata[2] << 8 | pdata[3]); BSB cbsb; BSB_INIT(cbsb, pdata+6, plen-2); // The - 4 for plen is done above, confusing if(BSB_REMAINING(cbsb) > 32) { BSB_IMPORT_skip(cbsb, 32); // Random int skiplen = 0; BSB_IMPORT_u08(cbsb, skiplen); // Session Id Length BSB_IMPORT_skip(cbsb, skiplen); // Session Id BSB_IMPORT_u16(cbsb, skiplen); // Ciper Suites Length BSB_IMPORT_skip(cbsb, skiplen); // Ciper Suites BSB_IMPORT_u08(cbsb, skiplen); // Compression Length BSB_IMPORT_skip(cbsb, skiplen); // Compressions if (BSB_REMAINING(cbsb) > 2) { int etotlen = 0; BSB_IMPORT_u16(cbsb, etotlen); // Extensions Length etotlen = MIN(etotlen, BSB_REMAINING(cbsb)); BSB ebsb; BSB_INIT(ebsb, BSB_WORK_PTR(cbsb), etotlen); while (BSB_REMAINING(ebsb) > 0) { int etype = 0, elen = 0; BSB_IMPORT_u16 (ebsb, etype); BSB_IMPORT_u16 (ebsb, elen); if (etype != 0) { BSB_IMPORT_skip (ebsb, elen); continue; } if (elen > BSB_REMAINING(ebsb)) break; BSB snibsb; BSB_INIT(snibsb, BSB_WORK_PTR(ebsb), elen); BSB_IMPORT_skip (ebsb, elen); int sni = 0; BSB_IMPORT_u16(snibsb, sni); // list len if (sni != BSB_REMAINING(snibsb)) continue; BSB_IMPORT_u08(snibsb, sni); // type if (sni != 0) continue; BSB_IMPORT_u16(snibsb, sni); // len if (sni != BSB_REMAINING(snibsb)) continue; moloch_field_string_add(hostField, session, (char *)BSB_WORK_PTR(snibsb), sni, TRUE); } } } } BSB_IMPORT_skip(sslbsb, ssllen + 5); } }
void tls_process_server_certificate(MolochSession_t *session, const unsigned char *data, int len) { BSB cbsb; BSB_INIT(cbsb, data, len); BSB_IMPORT_skip(cbsb, 3); // Length again while(BSB_REMAINING(cbsb) > 3) { int badreason = 0; unsigned char *cdata = BSB_WORK_PTR(cbsb); int clen = MIN(BSB_REMAINING(cbsb) - 3, (cdata[0] << 16 | cdata[1] << 8 | cdata[2])); MolochCertsInfo_t *certs = MOLOCH_TYPE_ALLOC0(MolochCertsInfo_t); DLL_INIT(s_, &certs->alt); DLL_INIT(s_, &certs->subject.commonName); DLL_INIT(s_, &certs->issuer.commonName); int atag, alen, apc; unsigned char *value; BSB bsb; BSB_INIT(bsb, cdata + 3, clen); /* Certificate */ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 1; goto bad_cert;} BSB_INIT(bsb, value, alen); /* signedCertificate */ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 2; goto bad_cert;} BSB_INIT(bsb, value, alen); /* serialNumber or version*/ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 3; goto bad_cert;} if (apc) { if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 4; goto bad_cert;} } certs->serialNumberLen = alen; certs->serialNumber = malloc(alen); memcpy(certs->serialNumber, value, alen); /* signature */ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 5; goto bad_cert;} /* issuer */ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 6; goto bad_cert;} BSB tbsb; BSB_INIT(tbsb, value, alen); tls_certinfo_process(&certs->issuer, &tbsb); /* validity */ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 7; goto bad_cert;} /* subject */ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 8; goto bad_cert;} BSB_INIT(tbsb, value, alen); tls_certinfo_process(&certs->subject, &tbsb); /* subjectPublicKeyInfo */ if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 9; goto bad_cert;} /* extensions */ if (BSB_REMAINING(bsb)) { if (!(value = moloch_parsers_asn_get_tlv(&bsb, &apc, &atag, &alen))) {badreason = 10; goto bad_cert;} BSB tbsb; BSB_INIT(tbsb, value, alen); char lastOid[100]; lastOid[0] = 0; tls_alt_names(certs, &tbsb, lastOid); } if (!moloch_field_certsinfo_add(certsField, session, certs, clen*2)) { moloch_field_certsinfo_free(certs); } BSB_IMPORT_skip(cbsb, clen + 3); continue; bad_cert: if (config.debug) LOG("bad cert %d - %d", badreason, clen); moloch_field_certsinfo_free(certs); break; } }
int radius_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which)) { BSB bsb; BSB_INIT(bsb, data, len); BSB_IMPORT_skip(bsb, 20); unsigned char type = 0, length = 0; unsigned char *value; char str[256]; struct in_addr in; int i; while (BSB_REMAINING(bsb) > 2) { BSB_IMPORT_u08(bsb, type); BSB_IMPORT_u08(bsb, length); length -= 2; // length includes the type/length BSB_IMPORT_ptr(bsb, value, length); if (BSB_IS_ERROR(bsb)) { break; } switch (type) { case 1: moloch_field_string_add(userField, session, (char *)value, length, TRUE); break; /* case 4: LOG("NAS-IP-Address: %d %d %u.%u.%u.%u", type, length, value[0], value[1], value[2], value[3]); break;*/ case 8: memcpy(&in.s_addr, value, 4); moloch_field_int_add(framedIpField, session, in.s_addr); break; case 31: if (length == 12) { snprintf(str, sizeof(str), "%c%c:%c%c:%c%c:%c%c:%c%c:%c%c", value[0], value[1], value[2], value[3], value[4], value[5], value[6], value[7], value[8], value[9], value[10], value[11]); for (i = 0; i < 17; i++) { if (isupper (str[i])) str[i] = tolower (str[i]); } moloch_field_string_add(macField, session, str, 17, TRUE); } break; case 66: memcpy(str, value, length); str[length] = 0; inet_aton(str, &in); moloch_field_int_add(endpointIpField, session, in.s_addr); break; /* default: LOG("%d %d %.*s", type, length, length, value);*/ } } return 0; }
void dns_parser(MolochSession_t *session, const unsigned char *data, int len) { if (len < 18) return; int qr = (data[2] >> 7) & 0x1; int opcode = (data[2] >> 3) & 0xf; if (opcode != 0) return; int qdcount = (data[4] << 8) | data[5]; int ancount = (data[6] << 8) | data[7]; if (qdcount > 10 || qdcount <= 0) return; BSB bsb; BSB_INIT(bsb, data + 12, len - 12); /* QD Section */ int i; for (i = 0; BSB_NOT_ERROR(bsb) && i < qdcount; i++) { int namelen; unsigned char *name = dns_name(data, len, &bsb, &namelen); if (BSB_IS_ERROR(bsb)) break; if (!namelen) { name = (unsigned char*)"<root>"; namelen = 6; } unsigned short qtype = 0 , qclass = 0 ; BSB_IMPORT_u16(bsb, qtype); BSB_IMPORT_u16(bsb, qclass); char *lower = g_ascii_strdown((char*)name, namelen); if (qclass <= 255 && qclasses[qclass]) { moloch_field_string_add(queryClassField, session, qclasses[qclass], -1, TRUE); } if (qtype <= 255 && qtypes[qtype]) { moloch_field_string_add(queryTypeField, session, qtypes[qtype], -1, TRUE); } if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) { g_free(lower); } } moloch_nids_add_protocol(session, "dns"); if (qr == 0) return; int rcode = data[3] & 0xf; moloch_field_string_add(statusField, session, statuses[rcode], -1, TRUE); for (i = 0; BSB_NOT_ERROR(bsb) && i < ancount; i++) { int namelen; dns_name(data, len, &bsb, &namelen); if (BSB_IS_ERROR(bsb)) break; uint16_t antype = 0; BSB_IMPORT_u16 (bsb, antype); uint16_t anclass = 0; BSB_IMPORT_u16 (bsb, anclass); BSB_IMPORT_skip(bsb, 4); // ttl uint16_t rdlength = 0; BSB_IMPORT_u16 (bsb, rdlength); if (BSB_REMAINING(bsb) < rdlength) { break; } if (anclass != 1) { BSB_IMPORT_skip(bsb, rdlength); continue; } switch (antype) { case 1: { if (rdlength != 4) break; struct in_addr in; unsigned char *ptr = BSB_WORK_PTR(bsb); in.s_addr = ptr[3] << 24 | ptr[2] << 16 | ptr[1] << 8 | ptr[0]; moloch_field_int_add(ipField, session, in.s_addr); break; } case 5: { BSB rdbsb; BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength); int namelen; unsigned char *name = dns_name(data, len, &rdbsb, &namelen); if (!namelen || BSB_IS_ERROR(rdbsb)) continue; char *lower = g_ascii_strdown((char*)name, namelen); if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) { g_free(lower); } break; } case 15: { BSB rdbsb; BSB_INIT(rdbsb, BSB_WORK_PTR(bsb), rdlength); BSB_IMPORT_skip(rdbsb, 2); // preference int namelen; unsigned char *name = dns_name(data, len, &rdbsb, &namelen); if (!namelen || BSB_IS_ERROR(rdbsb)) continue; char *lower = g_ascii_strdown((char*)name, namelen); if (lower && !moloch_field_string_add(hostField, session, lower, namelen, FALSE)) { g_free(lower); } } } /* switch */ BSB_IMPORT_skip(bsb, rdlength); } }
LOCAL int quic_udp_parser(MolochSession_t *session, void *UNUSED(uw), const unsigned char *data, int len, int UNUSED(which)) { int version = -1; int offset = 1; // PUBLIC_FLAG_RESET if (data[0] & 0x02) { return 0; } // CID if (data[0] & 0x08) { offset += 8; } // Get version if (data[0] & 0x01 && data[offset] == 'Q') { version = (data[offset+1] - '0') * 100 + (data[offset+2] - '0') * 10 + (data[offset+3] - '0'); offset += 4; } // Unsupported version if (version < 24) { moloch_parsers_unregister(session, uw); return 0; } // Diversification only is from server to client, so we can ignore // Packet number size if ((data[0] & 0x30) == 0) { offset++; } else { offset += ((data[0] & 0x30) >> 4) * 2; } // Hash offset += 12; // Private Flags if (version < 34) offset++; if (offset > len) return 0; BSB bsb; BSB_INIT(bsb, data+offset, len-offset); while (!BSB_IS_ERROR(bsb) && BSB_REMAINING(bsb)) { uint8_t type = 0; BSB_LIMPORT_u08(bsb, type); //1fdooossB if ((type & 0x80) == 0) { return 0; } int offsetLen = 0; if (type & 0x1C) { offsetLen = ((type & 0x1C) >> 2) + 1; } int streamLen = (type & 0x03) + 1; BSB_LIMPORT_skip(bsb, streamLen + offsetLen); int dataLen = BSB_REMAINING(bsb); if (type & 0x20) { BSB_LIMPORT_u16(bsb, dataLen); } if (BSB_IS_ERROR(bsb)) return 0; BSB dbsb; BSB_INIT(dbsb, BSB_WORK_PTR(bsb), MIN(dataLen, BSB_REMAINING(bsb))); BSB_IMPORT_skip(bsb, dataLen); quic_chlo_parser(session,dbsb); moloch_parsers_unregister(session, uw); return 0; }