|
|
|
@ -66,7 +66,7 @@ impl SshHeader {
|
|
|
|
pub fn new() -> SshHeader {
|
|
|
|
pub fn new() -> SshHeader {
|
|
|
|
SshHeader {
|
|
|
|
SshHeader {
|
|
|
|
record_left: 0,
|
|
|
|
record_left: 0,
|
|
|
|
record_left_msg: parser::MessageCode::SshMsgUndefined(0),
|
|
|
|
record_left_msg: parser::MessageCode::Undefined(0),
|
|
|
|
|
|
|
|
|
|
|
|
flags: SSHConnectionState::SshStateInProgress,
|
|
|
|
flags: SSHConnectionState::SshStateInProgress,
|
|
|
|
protover: Vec::new(),
|
|
|
|
protover: Vec::new(),
|
|
|
|
@ -132,7 +132,7 @@ impl SSHState {
|
|
|
|
let start = hdr.record_left as usize;
|
|
|
|
let start = hdr.record_left as usize;
|
|
|
|
match hdr.record_left_msg {
|
|
|
|
match hdr.record_left_msg {
|
|
|
|
// parse reassembled tcp segments
|
|
|
|
// parse reassembled tcp segments
|
|
|
|
parser::MessageCode::SshMsgKexinit if hassh_is_enabled() => {
|
|
|
|
parser::MessageCode::Kexinit if hassh_is_enabled() => {
|
|
|
|
if let Ok((_rem, key_exchange)) =
|
|
|
|
if let Ok((_rem, key_exchange)) =
|
|
|
|
parser::ssh_parse_key_exchange(&input[..start])
|
|
|
|
parser::ssh_parse_key_exchange(&input[..start])
|
|
|
|
{
|
|
|
|
{
|
|
|
|
@ -142,7 +142,7 @@ impl SSHState {
|
|
|
|
&resp,
|
|
|
|
&resp,
|
|
|
|
);
|
|
|
|
);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
hdr.record_left_msg = parser::MessageCode::SshMsgUndefined(0);
|
|
|
|
hdr.record_left_msg = parser::MessageCode::Undefined(0);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
_ => {}
|
|
|
|
_ => {}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
@ -156,14 +156,14 @@ impl SSHState {
|
|
|
|
Ok((rem, head)) => {
|
|
|
|
Ok((rem, head)) => {
|
|
|
|
SCLogDebug!("SSH valid record {}", head);
|
|
|
|
SCLogDebug!("SSH valid record {}", head);
|
|
|
|
match head.msg_code {
|
|
|
|
match head.msg_code {
|
|
|
|
parser::MessageCode::SshMsgKexinit if hassh_is_enabled() => {
|
|
|
|
parser::MessageCode::Kexinit if hassh_is_enabled() => {
|
|
|
|
//let endkex = SSH_RECORD_HEADER_LEN + head.pkt_len - 2;
|
|
|
|
//let endkex = SSH_RECORD_HEADER_LEN + head.pkt_len - 2;
|
|
|
|
let endkex = input.len() - rem.len();
|
|
|
|
let endkex = input.len() - rem.len();
|
|
|
|
if let Ok((_, key_exchange)) = parser::ssh_parse_key_exchange(&input[SSH_RECORD_HEADER_LEN..endkex]) {
|
|
|
|
if let Ok((_, key_exchange)) = parser::ssh_parse_key_exchange(&input[SSH_RECORD_HEADER_LEN..endkex]) {
|
|
|
|
key_exchange.generate_hassh(&mut hdr.hassh_string, &mut hdr.hassh, &resp);
|
|
|
|
key_exchange.generate_hassh(&mut hdr.hassh_string, &mut hdr.hassh, &resp);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
parser::MessageCode::SshMsgNewKeys => {
|
|
|
|
parser::MessageCode::NewKeys => {
|
|
|
|
hdr.flags = SSHConnectionState::SshStateFinished;
|
|
|
|
hdr.flags = SSHConnectionState::SshStateFinished;
|
|
|
|
if ohdr.flags >= SSHConnectionState::SshStateFinished {
|
|
|
|
if ohdr.flags >= SSHConnectionState::SshStateFinished {
|
|
|
|
unsafe {
|
|
|
|
unsafe {
|
|
|
|
@ -190,15 +190,15 @@ impl SSHState {
|
|
|
|
hdr.record_left = head.pkt_len - 2 - remlen;
|
|
|
|
hdr.record_left = head.pkt_len - 2 - remlen;
|
|
|
|
//header with rem as incomplete data
|
|
|
|
//header with rem as incomplete data
|
|
|
|
match head.msg_code {
|
|
|
|
match head.msg_code {
|
|
|
|
parser::MessageCode::SshMsgNewKeys => {
|
|
|
|
parser::MessageCode::NewKeys => {
|
|
|
|
hdr.flags = SSHConnectionState::SshStateFinished;
|
|
|
|
hdr.flags = SSHConnectionState::SshStateFinished;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
parser::MessageCode::SshMsgKexinit if hassh_is_enabled() => {
|
|
|
|
parser::MessageCode::Kexinit if hassh_is_enabled() => {
|
|
|
|
// check if buffer is bigger than maximum reassembled packet size
|
|
|
|
// check if buffer is bigger than maximum reassembled packet size
|
|
|
|
hdr.record_left = head.pkt_len - 2;
|
|
|
|
hdr.record_left = head.pkt_len - 2;
|
|
|
|
if hdr.record_left < SSH_MAX_REASSEMBLED_RECORD_LEN as u32 {
|
|
|
|
if hdr.record_left < SSH_MAX_REASSEMBLED_RECORD_LEN as u32 {
|
|
|
|
// saving type of incomplete kex message
|
|
|
|
// saving type of incomplete kex message
|
|
|
|
hdr.record_left_msg = parser::MessageCode::SshMsgKexinit;
|
|
|
|
hdr.record_left_msg = parser::MessageCode::Kexinit;
|
|
|
|
return AppLayerResult::incomplete(
|
|
|
|
return AppLayerResult::incomplete(
|
|
|
|
(il - rem.len()) as u32,
|
|
|
|
(il - rem.len()) as u32,
|
|
|
|
(head.pkt_len - 2) as u32
|
|
|
|
(head.pkt_len - 2) as u32
|
|
|
|
|