aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tls: introduce per direction progress tracking

Browse Source 
Per direction track progress to be able to have more fine grained
control over where the detection engines and logging hooks in.
pull/12979/head
Victor Julien 10 months ago committed by Victor Julien
parent b5bc00382d
commit 780aeee55c
14 changed files with 122 additions and 80 deletions
Show Stats Download Patch File Download Diff File

97
src/app-layer-ssl.c
Unescape Escape View File

@ -292,30 +292,36 @@ static uint64_t SSLGetTxCnt(void *state)
return 1; return 1;
} }
static int SSLGetAlstateProgress(void *tx, uint8_t direction) static void UpdateClientState(SSLState *ssl_state, enum TlsStateClient s)
{ {
SSLState *ssl_state = (SSLState *)tx; #ifdef DEBUG
enum TlsStateClient old = ssl_state->client_state;
/* we don't care about direction, only that app-layer parser is done #endif
and have sent an EOF */ ssl_state->client_state = s;
if (ssl_state->flags & SSL_AL_FLAG_STATE_FINISHED) { #ifdef DEBUG
return TLS_STATE_FINISHED; SCLogDebug("toserver: state updated to %u from %u", s, old);
} #endif
}
/* we want the logger to log when the handshake is done, even if the static void UpdateServerState(SSLState *ssl_state, enum TlsStateServer s)
state is not finished */ {
if (ssl_state->flags & SSL_AL_FLAG_HANDSHAKE_DONE) { #ifdef DEBUG
return TLS_HANDSHAKE_DONE; enum TlsStateServer old = ssl_state->server_state;
} #endif
ssl_state->server_state = s;
#ifdef DEBUG
SCLogDebug("toclient: state updated to %u from %u", s, old);
#endif
}
if (direction == STREAM_TOSERVER && static int SSLGetAlstateProgress(void *tx, uint8_t direction)
(ssl_state->server_connp.cert0_subject != NULL || {
ssl_state->server_connp.cert0_issuerdn != NULL)) SSLState *ssl_state = (SSLState *)tx;
{ if (direction & STREAM_TOCLIENT) {
return TLS_STATE_CERT_READY; return ssl_state->server_state;
} else {
return ssl_state->client_state;
} }
return TLS_STATE_IN_PROGRESS;
} }
static AppLayerTxData *SSLGetTxData(void *vtx) static AppLayerTxData *SSLGetTxData(void *vtx)
@ -1610,6 +1616,11 @@ static int TLSDecodeHandshakeHello(SSLState *ssl_state,
ssl_state->curr_connp->ja3_hash = Ja3GenerateHash(ssl_state->curr_connp->ja3_str); ssl_state->curr_connp->ja3_hash = Ja3GenerateHash(ssl_state->curr_connp->ja3_str);
} }
if (ssl_state->curr_connp == &ssl_state->client_connp) {
UpdateClientState(ssl_state, TLS_STATE_CLIENT_HELLO_DONE);
} else {
UpdateServerState(ssl_state, TLS_STATE_SERVER_HELLO);
}
end: end:
return 0; return 0;
} }
@ -1636,6 +1647,11 @@ static inline int SSLv3ParseHandshakeTypeCertificate(SSLState *ssl_state, SSLSta
SSLParserHSReset(connp); SSLParserHSReset(connp);
/* fall through to still consume the cert bytes */ /* fall through to still consume the cert bytes */
} }
if (connp == &ssl_state->client_connp) {
UpdateClientState(ssl_state, TLS_STATE_CLIENT_CERT_DONE);
} else {
UpdateServerState(ssl_state, TLS_STATE_SERVER_CERT_DONE);
}
return input_len; return input_len;
} }
@ -1704,7 +1720,6 @@ static int SSLv3ParseHandshakeType(SSLState *ssl_state, const uint8_t *input,
break; break;
case SSLV3_HS_CERTIFICATE: case SSLV3_HS_CERTIFICATE:
rc = SSLv3ParseHandshakeTypeCertificate(ssl_state, rc = SSLv3ParseHandshakeTypeCertificate(ssl_state,
direction ? &ssl_state->server_connp : &ssl_state->client_connp, initial_input, direction ? &ssl_state->server_connp : &ssl_state->client_connp, initial_input,
input_len); input_len);
@ -1728,6 +1743,9 @@ static int SSLv3ParseHandshakeType(SSLState *ssl_state, const uint8_t *input,
SCLogDebug("new session ticket"); SCLogDebug("new session ticket");
break; break;
case SSLV3_HS_SERVER_HELLO_DONE: case SSLV3_HS_SERVER_HELLO_DONE:
if (direction) {
UpdateServerState(ssl_state, TLS_STATE_SERVER_HELLO_DONE);
}
break; break;
default: default:
SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD); SSLSetEvent(ssl_state, TLS_DECODER_EVENT_INVALID_SSL_RECORD);
@ -1940,7 +1958,8 @@ static int SSLv3ParseAlertProtocol(
/* if level Fatal, we consider the tx finished */ /* if level Fatal, we consider the tx finished */
if (level == 2) { if (level == 2) {
ssl_state->flags |= SSL_AL_FLAG_STATE_FINISHED; UpdateClientState(ssl_state, TLS_STATE_CLIENT_FINISHED);
UpdateServerState(ssl_state, TLS_STATE_SERVER_FINISHED);
} }
} }
return 0; return 0;
@ -2323,6 +2342,7 @@ static struct SSLDecoderResult SSLv2Decode(uint8_t direction, SSLState *ssl_stat
ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO; ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO;
ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_HS; ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_HS;
UpdateClientState(ssl_state, TLS_STATE_CLIENT_HELLO_DONE);
const uint16_t version = (uint16_t)(input[0] << 8) | input[1]; const uint16_t version = (uint16_t)(input[0] << 8) | input[1];
SCLogDebug("SSLv2: version %04x", version); SCLogDebug("SSLv2: version %04x", version);
@ -2352,6 +2372,7 @@ static struct SSLDecoderResult SSLv2Decode(uint8_t direction, SSLState *ssl_stat
} else { } else {
ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX; ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX;
} }
UpdateServerState(ssl_state, TLS_STATE_SERVER_CERT_DONE);
/* fall through */ /* fall through */
case SSLV2_MT_SERVER_VERIFY: case SSLV2_MT_SERVER_VERIFY:
@ -2404,6 +2425,7 @@ static struct SSLDecoderResult SSLv2Decode(uint8_t direction, SSLState *ssl_stat
case SSLV2_MT_SERVER_HELLO: case SSLV2_MT_SERVER_HELLO:
ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO; ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO;
ssl_state->current_flags |= SSL_AL_FLAG_SSL_SERVER_HS; ssl_state->current_flags |= SSL_AL_FLAG_SSL_SERVER_HS;
UpdateServerState(ssl_state, TLS_STATE_SERVER_HELLO);
break; break;
} }
@ -2570,6 +2592,9 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat
ssl_state->flags |= SSL_AL_FLAG_SERVER_CHANGE_CIPHER_SPEC; ssl_state->flags |= SSL_AL_FLAG_SERVER_CHANGE_CIPHER_SPEC;
} else { } else {
ssl_state->flags |= SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC; ssl_state->flags |= SSL_AL_FLAG_CLIENT_CHANGE_CIPHER_SPEC;
// TODO TLS 1.3
UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE);
} }
break; break;
@ -2595,7 +2620,11 @@ static struct SSLDecoderResult SSLv3Decode(uint8_t direction, SSLState *ssl_stat
/* if we see (encrypted) application data, then this means the /* if we see (encrypted) application data, then this means the
handshake must be done */ handshake must be done */
ssl_state->flags |= SSL_AL_FLAG_HANDSHAKE_DONE; if (ssl_state->curr_connp == &ssl_state->client_connp) {
UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE);
} else {
UpdateServerState(ssl_state, TLS_STATE_SERVER_HANDSHAKE_DONE);
}
if (ssl_config.encrypt_mode != SSL_CNF_ENC_HANDLE_FULL) { if (ssl_config.encrypt_mode != SSL_CNF_ENC_HANDLE_FULL) {
SCLogDebug("setting APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD"); SCLogDebug("setting APP_LAYER_PARSER_NO_INSPECTION_PAYLOAD");
@ -2723,7 +2752,10 @@ static AppLayerResult SSLDecode(Flow *f, uint8_t direction, void *alstate,
(direction == 1 && (direction == 1 &&
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)))) { AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)))) {
/* flag session as finished if APP_LAYER_PARSER_EOF is set */ /* flag session as finished if APP_LAYER_PARSER_EOF is set */
ssl_state->flags |= SSL_AL_FLAG_STATE_FINISHED; if (direction == 0)
UpdateClientState(ssl_state, TLS_STATE_CLIENT_FINISHED);
else
UpdateServerState(ssl_state, TLS_STATE_SERVER_FINISHED);
SCReturnStruct(APP_LAYER_OK); SCReturnStruct(APP_LAYER_OK);
} else if (input == NULL || input_len == 0) { } else if (input == NULL || input_len == 0) {
SCReturnStruct(APP_LAYER_ERROR); SCReturnStruct(APP_LAYER_ERROR);
@ -2831,19 +2863,22 @@ static AppLayerResult SSLDecode(Flow *f, uint8_t direction, void *alstate,
/* mark handshake as done if we have subject and issuer */ /* mark handshake as done if we have subject and issuer */
if ((ssl_state->flags & SSL_AL_FLAG_NEED_CLIENT_CERT) && if ((ssl_state->flags & SSL_AL_FLAG_NEED_CLIENT_CERT) &&
ssl_state->client_connp.cert0_subject && ssl_state->client_connp.cert0_issuerdn) { ssl_state->client_connp.cert0_subject && ssl_state->client_connp.cert0_issuerdn) {
SCLogDebug("SSL_AL_FLAG_HANDSHAKE_DONE"); /* update both sides to keep existing behavior */
ssl_state->flags |= SSL_AL_FLAG_HANDSHAKE_DONE; UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE);
UpdateServerState(ssl_state, TLS_STATE_SERVER_HANDSHAKE_DONE);
} else if ((ssl_state->flags & SSL_AL_FLAG_NEED_CLIENT_CERT) == 0 && } else if ((ssl_state->flags & SSL_AL_FLAG_NEED_CLIENT_CERT) == 0 &&
ssl_state->server_connp.cert0_subject && ssl_state->server_connp.cert0_issuerdn) { ssl_state->server_connp.cert0_subject && ssl_state->server_connp.cert0_issuerdn) {
SCLogDebug("SSL_AL_FLAG_HANDSHAKE_DONE"); /* update both sides to keep existing behavior */
ssl_state->flags |= SSL_AL_FLAG_HANDSHAKE_DONE; UpdateClientState(ssl_state, TLS_STATE_CLIENT_HANDSHAKE_DONE);
UpdateServerState(ssl_state, TLS_STATE_SERVER_HANDSHAKE_DONE);
} }
/* flag session as finished if APP_LAYER_PARSER_EOF is set */ /* flag session as finished if APP_LAYER_PARSER_EOF is set */
if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) && if (AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TS) &&
AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)) { AppLayerParserStateIssetFlag(pstate, APP_LAYER_PARSER_EOF_TC)) {
SCLogDebug("SSL_AL_FLAG_STATE_FINISHED"); /* update both sides to keep existing behavior */
ssl_state->flags |= SSL_AL_FLAG_STATE_FINISHED; UpdateClientState(ssl_state, TLS_STATE_CLIENT_FINISHED);
UpdateServerState(ssl_state, TLS_STATE_SERVER_FINISHED);
} }
return APP_LAYER_OK; return APP_LAYER_OK;
@ -3307,7 +3342,7 @@ void RegisterSSLParsers(void)
AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_TLS, SSLGetAlstateProgress); AppLayerParserRegisterGetStateProgressFunc(IPPROTO_TCP, ALPROTO_TLS, SSLGetAlstateProgress);
AppLayerParserRegisterStateProgressCompletionStatus( AppLayerParserRegisterStateProgressCompletionStatus(
ALPROTO_TLS, TLS_STATE_FINISHED, TLS_STATE_FINISHED); ALPROTO_TLS, TLS_STATE_CLIENT_FINISHED, TLS_STATE_SERVER_FINISHED);
SCConfNode *enc_handle = SCConfGetNode("app-layer.protocols.tls.encryption-handling"); SCConfNode *enc_handle = SCConfGetNode("app-layer.protocols.tls.encryption-handling");
if (enc_handle != NULL && enc_handle->val != NULL) { if (enc_handle != NULL && enc_handle->val != NULL) {

29
src/app-layer-ssl.h
Unescape Escape View File

@ -74,11 +74,21 @@ enum {
TLS_DECODER_EVENT_INVALID_SSL_RECORD, TLS_DECODER_EVENT_INVALID_SSL_RECORD,
}; };
enum { enum TlsStateClient {
TLS_STATE_IN_PROGRESS = 0, TLS_STATE_CLIENT_IN_PROGRESS = 0,
TLS_STATE_CERT_READY = 1, TLS_STATE_CLIENT_HELLO_DONE,
TLS_HANDSHAKE_DONE = 2, TLS_STATE_CLIENT_CERT_DONE,
TLS_STATE_FINISHED = 3 TLS_STATE_CLIENT_HANDSHAKE_DONE,
TLS_STATE_CLIENT_FINISHED,
};
enum TlsStateServer {
TLS_STATE_SERVER_IN_PROGRESS = 0,
TLS_STATE_SERVER_HELLO,
TLS_STATE_SERVER_CERT_DONE,
TLS_STATE_SERVER_HELLO_DONE,
TLS_STATE_SERVER_HANDSHAKE_DONE,
TLS_STATE_SERVER_FINISHED,
}; };
/* Flag to indicate that server will now on send encrypted msgs */ /* Flag to indicate that server will now on send encrypted msgs */
@ -102,17 +112,11 @@ enum {
#define SSL_AL_FLAG_STATE_SERVER_KEYX BIT_U32(12) #define SSL_AL_FLAG_STATE_SERVER_KEYX BIT_U32(12)
#define SSL_AL_FLAG_STATE_UNKNOWN BIT_U32(13) #define SSL_AL_FLAG_STATE_UNKNOWN BIT_U32(13)
/* flag to indicate that session is finished */
#define SSL_AL_FLAG_STATE_FINISHED BIT_U32(14)
/* flags specific to HeartBeat state */ /* flags specific to HeartBeat state */
#define SSL_AL_FLAG_HB_INFLIGHT BIT_U32(15) #define SSL_AL_FLAG_HB_INFLIGHT BIT_U32(15)
#define SSL_AL_FLAG_HB_CLIENT_INIT BIT_U32(16) #define SSL_AL_FLAG_HB_CLIENT_INIT BIT_U32(16)
#define SSL_AL_FLAG_HB_SERVER_INIT BIT_U32(17) #define SSL_AL_FLAG_HB_SERVER_INIT BIT_U32(17)
/* flag to indicate that handshake is done */
#define SSL_AL_FLAG_HANDSHAKE_DONE BIT_U32(18)
/* Session resumed without a full handshake */ /* Session resumed without a full handshake */
#define SSL_AL_FLAG_SESSION_RESUMED BIT_U32(20) #define SSL_AL_FLAG_SESSION_RESUMED BIT_U32(20)
@ -312,6 +316,9 @@ typedef struct SSLState_ {
SSLStateConnp *curr_connp; SSLStateConnp *curr_connp;
enum TlsStateClient client_state;
enum TlsStateServer server_state;
SSLStateConnp client_connp; SSLStateConnp client_connp;
SSLStateConnp server_connp; SSLStateConnp server_connp;
} SSLState; } SSLState;

8
src/detect-tls-alpn.c
Unescape Escape View File

@ -70,10 +70,10 @@ void DetectTlsAlpnRegister(void)
sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_ALPN].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER, 0, TlsAlpnGetData, 2, DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TLS_STATE_IN_PROGRESS); TLS_STATE_CLIENT_HELLO_DONE, TlsAlpnGetData, 2, TLS_STATE_CLIENT_HELLO_DONE);
DetectAppLayerMultiRegister( DetectAppLayerMultiRegister("tls.alpn", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_SERVER_HELLO,
"tls.alpn", ALPROTO_TLS, SIG_FLAG_TOCLIENT, 0, TlsAlpnGetData, 2, TLS_STATE_CERT_READY); TlsAlpnGetData, 2, TLS_STATE_SERVER_HELLO);
DetectBufferTypeSetDescriptionByName("tls.alpn", "TLS APLN"); DetectBufferTypeSetDescriptionByName("tls.alpn", "TLS APLN");

8
src/detect-tls-cert-fingerprint.c
Unescape Escape View File

@ -85,16 +85,16 @@ void DetectTlsFingerprintRegister(void)
sigmatch_table[DETECT_TLS_CERT_FINGERPRINT].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_CERT_FINGERPRINT].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister("tls.cert_fingerprint", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectAppLayerInspectEngineRegister("tls.cert_fingerprint", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_fingerprint", SIG_FLAG_TOCLIENT, 2, DetectAppLayerMpmRegister("tls.cert_fingerprint", SIG_FLAG_TOCLIENT, 2,
PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_SERVER_CERT_DONE);
DetectAppLayerInspectEngineRegister("tls.cert_fingerprint", ALPROTO_TLS, SIG_FLAG_TOSERVER, DetectAppLayerInspectEngineRegister("tls.cert_fingerprint", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_fingerprint", SIG_FLAG_TOSERVER, 2, DetectAppLayerMpmRegister("tls.cert_fingerprint", SIG_FLAG_TOSERVER, 2,
PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE);
DetectBufferTypeSetDescriptionByName("tls.cert_fingerprint", DetectBufferTypeSetDescriptionByName("tls.cert_fingerprint",
"TLS certificate fingerprint"); "TLS certificate fingerprint");

8
src/detect-tls-cert-issuer.c
Unescape Escape View File

@ -80,16 +80,16 @@ void DetectTlsIssuerRegister(void)
sigmatch_table[DETECT_TLS_CERT_ISSUER].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_CERT_ISSUER].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister("tls.cert_issuer", ALPROTO_TLS, SIG_FLAG_TOSERVER, DetectAppLayerInspectEngineRegister("tls.cert_issuer", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_issuer", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, DetectAppLayerMpmRegister("tls.cert_issuer", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE);
DetectAppLayerInspectEngineRegister("tls.cert_issuer", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectAppLayerInspectEngineRegister("tls.cert_issuer", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_issuer", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, DetectAppLayerMpmRegister("tls.cert_issuer", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); GetData, ALPROTO_TLS, TLS_STATE_SERVER_CERT_DONE);
DetectBufferTypeSetDescriptionByName("tls.cert_issuer", DetectBufferTypeSetDescriptionByName("tls.cert_issuer",
"TLS certificate issuer"); "TLS certificate issuer");

8
src/detect-tls-cert-serial.c
Unescape Escape View File

@ -84,16 +84,16 @@ void DetectTlsSerialRegister(void)
sigmatch_table[DETECT_TLS_CERT_SERIAL].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_CERT_SERIAL].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister("tls.cert_serial", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectAppLayerInspectEngineRegister("tls.cert_serial", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_serial", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, DetectAppLayerMpmRegister("tls.cert_serial", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); GetData, ALPROTO_TLS, TLS_STATE_SERVER_CERT_DONE);
DetectAppLayerInspectEngineRegister("tls.cert_serial", ALPROTO_TLS, SIG_FLAG_TOSERVER, DetectAppLayerInspectEngineRegister("tls.cert_serial", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_serial", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, DetectAppLayerMpmRegister("tls.cert_serial", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE);
DetectBufferTypeSetDescriptionByName("tls.cert_serial", DetectBufferTypeSetDescriptionByName("tls.cert_serial",
"TLS certificate serial number"); "TLS certificate serial number");

8
src/detect-tls-cert-subject.c
Unescape Escape View File

@ -80,16 +80,16 @@ void DetectTlsSubjectRegister(void)
sigmatch_table[DETECT_TLS_CERT_SUBJECT].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_CERT_SUBJECT].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister("tls.cert_subject", ALPROTO_TLS, SIG_FLAG_TOSERVER, DetectAppLayerInspectEngineRegister("tls.cert_subject", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_subject", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, DetectAppLayerMpmRegister("tls.cert_subject", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); GetData, ALPROTO_TLS, TLS_STATE_CLIENT_CERT_DONE);
DetectAppLayerInspectEngineRegister("tls.cert_subject", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectAppLayerInspectEngineRegister("tls.cert_subject", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_CERT_READY, DetectEngineInspectBufferGeneric, GetData); TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister("tls.cert_subject", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister, DetectAppLayerMpmRegister("tls.cert_subject", SIG_FLAG_TOCLIENT, 2, PrefilterGenericMpmRegister,
GetData, ALPROTO_TLS, TLS_STATE_CERT_READY); GetData, ALPROTO_TLS, TLS_STATE_SERVER_CERT_DONE);
DetectBufferTypeSupportsMultiInstance("tls.cert_subject"); DetectBufferTypeSupportsMultiInstance("tls.cert_subject");

10
src/detect-tls-certs.c
Unescape Escape View File

@ -122,10 +122,10 @@ void DetectTlsCertsRegister(void)
sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_CERTS].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOCLIENT, TLS_STATE_CERT_READY, DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TlsCertsGetData, 2, 1); TLS_STATE_SERVER_CERT_DONE, TlsCertsGetData, 2, 1);
DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOSERVER, TLS_STATE_CERT_READY, DetectAppLayerMultiRegister("tls.certs", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TlsCertsGetData, 2, 1); TLS_STATE_CLIENT_CERT_DONE, TlsCertsGetData, 2, 1);
DetectBufferTypeSetDescriptionByName("tls.certs", "TLS certificate"); DetectBufferTypeSetDescriptionByName("tls.certs", "TLS certificate");
@ -253,7 +253,7 @@ void DetectTlsCertChainLenRegister(void)
sigmatch_table[KEYWORD_ID].Free = DetectTLSCertChainLenFree; sigmatch_table[KEYWORD_ID].Free = DetectTLSCertChainLenFree;
DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectAppLayerInspectEngineRegister(BUFFER_NAME, ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_CERT_READY, DetectEngineInspectGenericList, NULL); TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectGenericList, NULL);
g_tls_cert_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME); g_tls_cert_buffer_id = DetectBufferTypeGetByName(BUFFER_NAME);
} }

8
src/detect-tls-sni.c
Unescape Escape View File

@ -73,11 +73,11 @@ void DetectTlsSniRegister(void)
sigmatch_table[DETECT_TLS_SNI].flags |= SIGMATCH_NOOPT; sigmatch_table[DETECT_TLS_SNI].flags |= SIGMATCH_NOOPT;
sigmatch_table[DETECT_TLS_SNI].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_SNI].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerInspectEngineRegister("tls.sni", ALPROTO_TLS, SIG_FLAG_TOSERVER, 0, DetectAppLayerInspectEngineRegister("tls.sni", ALPROTO_TLS, SIG_FLAG_TOSERVER,
DetectEngineInspectBufferGeneric, GetData); TLS_STATE_CLIENT_HELLO_DONE, DetectEngineInspectBufferGeneric, GetData);
DetectAppLayerMpmRegister( DetectAppLayerMpmRegister("tls.sni", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData,
"tls.sni", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_TLS, 0); ALPROTO_TLS, TLS_STATE_CLIENT_HELLO_DONE);
DetectBufferTypeSetDescriptionByName("tls.sni", DetectBufferTypeSetDescriptionByName("tls.sni",
"TLS Server Name Indication (SNI) extension"); "TLS Server Name Indication (SNI) extension");

2
src/detect-tls-subjectaltname.c
Unescape Escape View File

@ -72,7 +72,7 @@ void DetectTlsSubjectAltNameRegister(void)
sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_INFO_STICKY_BUFFER; sigmatch_table[DETECT_TLS_SUBJECTALTNAME].flags |= SIGMATCH_INFO_STICKY_BUFFER;
DetectAppLayerMultiRegister("tls.subjectaltname", ALPROTO_TLS, SIG_FLAG_TOCLIENT, 0, DetectAppLayerMultiRegister("tls.subjectaltname", ALPROTO_TLS, SIG_FLAG_TOCLIENT, 0,
TlsSubjectAltNameGetData, 2, TLS_STATE_CERT_READY); TlsSubjectAltNameGetData, 2, TLS_STATE_SERVER_CERT_DONE);
DetectBufferTypeSetDescriptionByName("tls.subjectaltname", "TLS Subject Alternative Name"); DetectBufferTypeSetDescriptionByName("tls.subjectaltname", "TLS Subject Alternative Name");

4
src/detect-tls.c
Unescape Escape View File

@ -144,10 +144,10 @@ void DetectTlsRegister (void)
g_tls_cert_fingerprint_list_id = DetectBufferTypeRegister("tls.cert_fingerprint"); g_tls_cert_fingerprint_list_id = DetectBufferTypeRegister("tls.cert_fingerprint");
DetectAppLayerInspectEngineRegister("tls_cert", ALPROTO_TLS, SIG_FLAG_TOCLIENT, DetectAppLayerInspectEngineRegister("tls_cert", ALPROTO_TLS, SIG_FLAG_TOCLIENT,
TLS_STATE_CERT_READY, DetectEngineInspectGenericList, NULL); TLS_STATE_SERVER_CERT_DONE, DetectEngineInspectGenericList, NULL);
DetectAppLayerInspectEngineRegister("tls_cert", ALPROTO_TLS, SIG_FLAG_TOSERVER, DetectAppLayerInspectEngineRegister("tls_cert", ALPROTO_TLS, SIG_FLAG_TOSERVER,
TLS_STATE_CERT_READY, DetectEngineInspectGenericList, NULL); TLS_STATE_CLIENT_CERT_DONE, DetectEngineInspectGenericList, NULL);
} }
/** /**

4
src/log-tlslog.c
Unescape Escape View File

@ -499,6 +499,6 @@ static int LogTlsLogger(ThreadVars *tv, void *thread_data, const Packet *p,
void LogTlsLogRegister(void) void LogTlsLogRegister(void)
{ {
OutputRegisterTxModuleWithProgress(LOGGER_TLS, MODULE_NAME, "tls-log", LogTlsLogInitCtx, OutputRegisterTxModuleWithProgress(LOGGER_TLS, MODULE_NAME, "tls-log", LogTlsLogInitCtx,
ALPROTO_TLS, LogTlsLogger, TLS_HANDSHAKE_DONE, TLS_HANDSHAKE_DONE, LogTlsLogThreadInit, ALPROTO_TLS, LogTlsLogger, TLS_STATE_CLIENT_HANDSHAKE_DONE,
LogTlsLogThreadDeinit); TLS_STATE_SERVER_HANDSHAKE_DONE, LogTlsLogThreadInit, LogTlsLogThreadDeinit);
} }

4
src/output-json-tls.c
Unescape Escape View File

@ -659,6 +659,6 @@ void JsonTlsLogRegister (void)
{ {
/* register as child of eve-log */ /* register as child of eve-log */
OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", "JsonTlsLog", "eve-log.tls", OutputRegisterTxSubModuleWithProgress(LOGGER_JSON_TX, "eve-log", "JsonTlsLog", "eve-log.tls",
OutputTlsLogInitSub, ALPROTO_TLS, JsonTlsLogger, TLS_HANDSHAKE_DONE, TLS_HANDSHAKE_DONE, OutputTlsLogInitSub, ALPROTO_TLS, JsonTlsLogger, TLS_STATE_SERVER_HANDSHAKE_DONE,
JsonTlsLogThreadInit, JsonTlsLogThreadDeinit); TLS_STATE_CLIENT_HANDSHAKE_DONE, JsonTlsLogThreadInit, JsonTlsLogThreadDeinit);
} }

4
src/output-lua.c
Unescape Escape View File

@ -777,8 +777,8 @@ static OutputInitResult OutputLuaLogInit(SCConfNode *conf)
} else if (opts.alproto == ALPROTO_TLS) { } else if (opts.alproto == ALPROTO_TLS) {
om->TxLogFunc = LuaTxLogger; om->TxLogFunc = LuaTxLogger;
om->alproto = ALPROTO_TLS; om->alproto = ALPROTO_TLS;
om->tc_log_progress = TLS_HANDSHAKE_DONE; om->tc_log_progress = TLS_STATE_SERVER_HANDSHAKE_DONE;
om->ts_log_progress = TLS_HANDSHAKE_DONE; om->ts_log_progress = TLS_STATE_CLIENT_HANDSHAKE_DONE;
AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TLS); AppLayerParserRegisterLogger(IPPROTO_TCP, ALPROTO_TLS);
} else if (opts.alproto == ALPROTO_DNS) { } else if (opts.alproto == ALPROTO_DNS) {
om->TxLogFunc = LuaTxLogger; om->TxLogFunc = LuaTxLogger;

Write Preview
Loading…
Cancel
Save