aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

enable toclient alproto detection. Detection all current alproto toclient PMP patterns

Browse Source
remotes/origin/master-1.2.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent 9c8d404db1
commit 78e6a7f713
7 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File

2
src/app-layer-dcerpc-udp.c
Unescape Escape View File

@ -712,7 +712,7 @@ static void DCERPCUDPStateFree(void *s) {
void RegisterDCERPCUDPParsers(void) {
/** DCERPC */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_UDP, ALPROTO_DCERPC_UDP, "|04 00|", 2, 0, STREAM_TOCLIENT);
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_UDP, ALPROTO_DCERPC_UDP, "|04 00|", 2, 0, STREAM_TOCLIENT);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_UDP, ALPROTO_DCERPC_UDP, "|04 00|", 2, 0, STREAM_TOSERVER);
AppLayerRegisterProto("dcerpcudp", ALPROTO_DCERPC_UDP, STREAM_TOSERVER,

2
src/app-layer-dcerpc.c
Unescape Escape View File

@ -1825,7 +1825,7 @@ void DCERPCUpdateTransactionId(void *state, uint16_t *id) {
void RegisterDCERPCParsers(void) {
/** DCERPC */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_DCERPC, "|05 00|", 2, 0, STREAM_TOCLIENT);
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_DCERPC, "|05 00|", 2, 0, STREAM_TOCLIENT);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_DCERPC, "|05 00|", 2, 0, STREAM_TOSERVER);
AppLayerRegisterProto("dcerpc", ALPROTO_DCERPC, STREAM_TOSERVER,

2
src/app-layer-ftp.c
Unescape Escape View File

@ -265,7 +265,7 @@ void RegisterFTPParsers(void) {
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_FTP, "USER ", 5, 0, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_FTP, "PASS ", 5, 0, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_FTP, "PORT ", 5, 0, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_FTP, "AUTH SSL", 8, 0, STREAM_TOCLIENT);
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_FTP, "AUTH SSL", 8, 0, STREAM_TOCLIENT);
AppLayerRegisterProto("ftp", ALPROTO_FTP, STREAM_TOSERVER,
FTPParseRequest);

4
src/app-layer-smb.c
Unescape Escape View File

@ -1371,11 +1371,11 @@ static uint16_t SMBProbingParser(uint8_t *input, uint32_t ilen)
void RegisterSMBParsers(void) {
/** SMB */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOCLIENT);
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOCLIENT);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SMB, "|ff|SMB", 8, 4, STREAM_TOSERVER);
/** SMB2 */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOCLIENT);
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOCLIENT);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SMB2, "|fe|SMB", 8, 4, STREAM_TOSERVER);
AppLayerRegisterProto("smb", ALPROTO_SMB, STREAM_TOSERVER, SMBParse);

2
src/app-layer-ssh.c
Unescape Escape View File

@ -747,7 +747,7 @@ static void SSHStateFree(void *state)
void RegisterSSHParsers(void)
{
/** SSH */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SSH, "SSH-", 4, 0, STREAM_TOCLIENT);
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SSH, "SSH-", 4, 0, STREAM_TOCLIENT);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_SSH, "SSH-", 4, 0, STREAM_TOSERVER);
AppLayerRegisterProto("ssh", ALPROTO_SSH, STREAM_TOCLIENT,

10
src/app-layer-ssl.c
Unescape Escape View File

@ -868,24 +868,24 @@ void RegisterSSLParsers(void)
/* Updated by Anoop Saldanha. Disabled it for now. We'll get back to it
* after some tests */
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|01 03 00|", 5, 2, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|00 02|", 7, 5, STREAM_TOCLIENT);
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|00 02|", 7, 5, STREAM_TOCLIENT);
/** SSLv3 */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|01 03 00|", 3, 0, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 00|", 3, 0, STREAM_TOSERVER); /* client hello */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 00|", 3, 0, STREAM_TOCLIENT); /* server hello */
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 00|", 3, 0, STREAM_TOCLIENT); /* server hello */
/** TLSv1 */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|01 03 01|", 3, 0, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 01|", 3, 0, STREAM_TOSERVER); /* client hello */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 01|", 3, 0, STREAM_TOCLIENT); /* server hello */
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 01|", 3, 0, STREAM_TOCLIENT); /* server hello */
/** TLSv1.1 */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|01 03 02|", 3, 0, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 02|", 3, 0, STREAM_TOSERVER); /* client hello */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 02|", 3, 0, STREAM_TOCLIENT); /* server hello */
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 02|", 3, 0, STREAM_TOCLIENT); /* server hello */
/** TLSv1.2 */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|01 03 03|", 3, 0, STREAM_TOSERVER);
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 03|", 3, 0, STREAM_TOSERVER); /* client hello */
AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 03|", 3, 0, STREAM_TOCLIENT); /* server hello */
//AlpProtoAdd(&alp_proto_ctx, IPPROTO_TCP, ALPROTO_TLS, "|16 03 03|", 3, 0, STREAM_TOCLIENT); /* server hello */
AppLayerRegisterProto("tls", ALPROTO_TLS, STREAM_TOSERVER,
SSLParseClientRecord);

24
src/stream-tcp-reassemble.c
Unescape Escape View File

@ -2601,13 +2601,13 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
uint8_t flags = 0;
/* check if toserver reassembly has started before reassembling toclient. */
if (PKT_IS_TOSERVER(p) &&
!(ssn->flags & STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED))
{
SCLogDebug("toserver reassembling is not done yet, so "
"skipping reassembling at the moment for to_client");
SCReturnInt(0);
}
//if (PKT_IS_TOSERVER(p) &&
// !(ssn->flags & STREAMTCP_FLAG_TOSERVER_REASSEMBLY_STARTED))
//{
// SCLogDebug("toserver reassembling is not done yet, so "
// "skipping reassembling at the moment for to_client");
// SCReturnInt(0);
//}
SCLogDebug("stream->seg_list %p", stream->seg_list);
#ifdef DEBUG
@ -2666,11 +2666,11 @@ static int StreamTcpReassembleAppLayer (TcpReassemblyThreadCtx *ra_ctx,
/* Do not perform reassembling of data from server, until the app layer
proto has been detected and we have sent atleast one smsg from client
data to app layer */
if (PKT_IS_TOSERVER(p)) {
SCLogDebug("we didn't detected the app layer protocol till "
"yet, so not doing toclient reassembling");
SCReturnInt(0);
}
//if (PKT_IS_TOSERVER(p)) {
// SCLogDebug("we didn't detected the app layer protocol till "
// "yet, so not doing toclient reassembling");
// SCReturnInt(0);
//}
/* initialize the tmp_ra_base_seq for each new run */
stream->tmp_ra_app_base_seq = stream->ra_app_base_seq;
ra_base_seq = stream->tmp_ra_app_base_seq;

Write Preview
Loading…
Cancel
Save