aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ssl: store current state separately from cumulative state

Browse Source 
The ssl_state keyword needs the current state, not the cumulative state
in order be compatible with Snort's implementation.
pull/2266/head
Jason Ish 12 years ago committed by Victor Julien
parent 7ce196e3bf
commit afc796a099
2 changed files with 26 additions and 16 deletions
Show Stats Download Patch File Download Diff File

40
src/app-layer-ssl.c
Unescape Escape View File

@ -244,7 +244,7 @@ static int SSLv3ParseHandshakeType(SSLState *ssl_state, uint8_t *input,
switch (ssl_state->curr_connp->handshake_type) {
case SSLV3_HS_CLIENT_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_HELLO;
ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO;
/* skip version */
input += SSLV3_CLIENT_HELLO_VERSION_LEN;
@ -371,15 +371,15 @@ end:
break;
case SSLV3_HS_SERVER_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_SERVER_HELLO;
ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO;
break;
case SSLV3_HS_SERVER_KEY_EXCHANGE:
ssl_state->flags |= SSL_AL_FLAG_STATE_SERVER_KEYX;
ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_KEYX;
break;
case SSLV3_HS_CLIENT_KEY_EXCHANGE:
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_KEYX;
ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX;
break;
case SSLV3_HS_CERTIFICATE:
@ -480,6 +480,8 @@ end:
return -1;
}
ssl_state->flags |= ssl_state->current_flags;
uint32_t write_len = 0;
if ((ssl_state->curr_connp->bytes_processed + input_len) >=
ssl_state->curr_connp->record_length + (SSLV3_RECORD_HDR_LEN)) {
@ -907,8 +909,8 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
break;
case SSLV2_MT_CLIENT_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_HELLO;
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_HS;
ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO;
ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_HS;
if (ssl_state->curr_connp->record_lengths_length == 3) {
switch (ssl_state->curr_connp->bytes_processed) {
@ -920,7 +922,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
input_len -= 6;
ssl_state->curr_connp->bytes_processed += 6;
if (ssl_state->curr_connp->session_id_length == 0) {
ssl_state->flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID;
ssl_state->current_flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID;
}
break;
@ -979,7 +981,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
input_len -= 6;
ssl_state->curr_connp->bytes_processed += 6;
if (ssl_state->curr_connp->session_id_length == 0) {
ssl_state->flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID;
ssl_state->current_flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID;
}
break;
@ -1029,8 +1031,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
SCLogDebug("Client hello is not seen before master key "
"message!");
}
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY;
ssl_state->current_flags = SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY;
break;
@ -1039,7 +1040,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
SCLogDebug("Incorrect SSL Record type sent in the toclient "
"direction!");
} else {
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_KEYX;
ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX;
}
/* fall through */
@ -1061,14 +1062,14 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
if (direction == 0) {
if (ssl_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) {
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED;
ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED;
SCLogDebug("SSLv2 client side has started the encryption");
} else if (ssl_state->flags & SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY) {
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED;
ssl_state->current_flags = SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED;
SCLogDebug("SSLv2 client side has started the encryption");
}
} else {
ssl_state->flags |= SSL_AL_FLAG_SSL_SERVER_SSN_ENCRYPTED;
ssl_state->current_flags = SSL_AL_FLAG_SSL_SERVER_SSN_ENCRYPTED;
SCLogDebug("SSLv2 Server side has started the encryption");
}
@ -1086,12 +1087,14 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
break;
case SSLV2_MT_SERVER_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_SERVER_HELLO;
ssl_state->flags |= SSL_AL_FLAG_SSL_SERVER_HS;
ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO;
ssl_state->current_flags |= SSL_AL_FLAG_SSL_SERVER_HS;
break;
}
ssl_state->flags |= ssl_state->current_flags;
if (input_len + ssl_state->curr_connp->bytes_processed >=
(ssl_state->curr_connp->record_length +
ssl_state->curr_connp->record_lengths_length)) {
@ -1316,6 +1319,11 @@ static int SSLDecode(Flow *f, uint8_t direction, void *alstate, AppLayerParserSt
else
ssl_state->curr_connp = &ssl_state->server_connp;
/* If entering on a new record, reset the current flags. */
if (ssl_state->curr_connp->bytes_processed == 0) {
ssl_state->current_flags = 0;
}
/* if we have more than one record */
while (input_len > 0) {
if (counter++ == 30) {

2
src/app-layer-ssl.h
Unescape Escape View File

@ -184,6 +184,8 @@ typedef struct SSLState_ {
uint16_t events;
uint32_t current_flags;
SSLStateConnp *curr_connp;
SSLStateConnp client_connp;

Write Preview
Loading…
Cancel
Save