aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ssl: store current state separately from cumulative state

Browse Source 
The ssl_state keyword needs the current state, not the cumulative state
in order be compatible with Snort's implementation.
pull/2266/head
Jason Ish 12 years ago committed by Victor Julien
parent 7ce196e3bf
commit afc796a099
2 changed files with 26 additions and 16 deletions
Show Stats Download Patch File Download Diff File

40
src/app-layer-ssl.c
Unescape Escape View File

@ -244,7 +244,7 @@ static int SSLv3ParseHandshakeType(SSLState *ssl_state, uint8_t *input,
switch (ssl_state->curr_connp->handshake_type) { switch (ssl_state->curr_connp->handshake_type) {
case SSLV3_HS_CLIENT_HELLO: case SSLV3_HS_CLIENT_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_HELLO; ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO;
/* skip version */ /* skip version */
input += SSLV3_CLIENT_HELLO_VERSION_LEN; input += SSLV3_CLIENT_HELLO_VERSION_LEN;
@ -371,15 +371,15 @@ end:
break; break;
case SSLV3_HS_SERVER_HELLO: case SSLV3_HS_SERVER_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_SERVER_HELLO; ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO;
break; break;
case SSLV3_HS_SERVER_KEY_EXCHANGE: case SSLV3_HS_SERVER_KEY_EXCHANGE:
ssl_state->flags |= SSL_AL_FLAG_STATE_SERVER_KEYX; ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_KEYX;
break; break;
case SSLV3_HS_CLIENT_KEY_EXCHANGE: case SSLV3_HS_CLIENT_KEY_EXCHANGE:
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_KEYX; ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX;
break; break;
case SSLV3_HS_CERTIFICATE: case SSLV3_HS_CERTIFICATE:
@ -480,6 +480,8 @@ end:
return -1; return -1;
} }
ssl_state->flags |= ssl_state->current_flags;
uint32_t write_len = 0; uint32_t write_len = 0;
if ((ssl_state->curr_connp->bytes_processed + input_len) >= if ((ssl_state->curr_connp->bytes_processed + input_len) >=
ssl_state->curr_connp->record_length + (SSLV3_RECORD_HDR_LEN)) { ssl_state->curr_connp->record_length + (SSLV3_RECORD_HDR_LEN)) {
@ -907,8 +909,8 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
break; break;
case SSLV2_MT_CLIENT_HELLO: case SSLV2_MT_CLIENT_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_HELLO; ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_HELLO;
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_HS; ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_HS;
if (ssl_state->curr_connp->record_lengths_length == 3) { if (ssl_state->curr_connp->record_lengths_length == 3) {
switch (ssl_state->curr_connp->bytes_processed) { switch (ssl_state->curr_connp->bytes_processed) {
@ -920,7 +922,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
input_len -= 6; input_len -= 6;
ssl_state->curr_connp->bytes_processed += 6; ssl_state->curr_connp->bytes_processed += 6;
if (ssl_state->curr_connp->session_id_length == 0) { if (ssl_state->curr_connp->session_id_length == 0) {
ssl_state->flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID; ssl_state->current_flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID;
} }
break; break;
@ -979,7 +981,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
input_len -= 6; input_len -= 6;
ssl_state->curr_connp->bytes_processed += 6; ssl_state->curr_connp->bytes_processed += 6;
if (ssl_state->curr_connp->session_id_length == 0) { if (ssl_state->curr_connp->session_id_length == 0) {
ssl_state->flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID; ssl_state->current_flags |= SSL_AL_FLAG_SSL_NO_SESSION_ID;
} }
break; break;
@ -1029,8 +1031,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
SCLogDebug("Client hello is not seen before master key " SCLogDebug("Client hello is not seen before master key "
"message!"); "message!");
} }
ssl_state->current_flags = SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY;
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY;
break; break;
@ -1039,7 +1040,7 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
SCLogDebug("Incorrect SSL Record type sent in the toclient " SCLogDebug("Incorrect SSL Record type sent in the toclient "
"direction!"); "direction!");
} else { } else {
ssl_state->flags |= SSL_AL_FLAG_STATE_CLIENT_KEYX; ssl_state->current_flags = SSL_AL_FLAG_STATE_CLIENT_KEYX;
} }
/* fall through */ /* fall through */
@ -1061,14 +1062,14 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
if (direction == 0) { if (direction == 0) {
if (ssl_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) { if (ssl_state->flags & SSL_AL_FLAG_SSL_NO_SESSION_ID) {
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED; ssl_state->current_flags |= SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED;
SCLogDebug("SSLv2 client side has started the encryption"); SCLogDebug("SSLv2 client side has started the encryption");
} else if (ssl_state->flags & SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY) { } else if (ssl_state->flags & SSL_AL_FLAG_SSL_CLIENT_MASTER_KEY) {
ssl_state->flags |= SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED; ssl_state->current_flags = SSL_AL_FLAG_SSL_CLIENT_SSN_ENCRYPTED;
SCLogDebug("SSLv2 client side has started the encryption"); SCLogDebug("SSLv2 client side has started the encryption");
} }
} else { } else {
ssl_state->flags |= SSL_AL_FLAG_SSL_SERVER_SSN_ENCRYPTED; ssl_state->current_flags = SSL_AL_FLAG_SSL_SERVER_SSN_ENCRYPTED;
SCLogDebug("SSLv2 Server side has started the encryption"); SCLogDebug("SSLv2 Server side has started the encryption");
} }
@ -1086,12 +1087,14 @@ static int SSLv2Decode(uint8_t direction, SSLState *ssl_state,
break; break;
case SSLV2_MT_SERVER_HELLO: case SSLV2_MT_SERVER_HELLO:
ssl_state->flags |= SSL_AL_FLAG_STATE_SERVER_HELLO; ssl_state->current_flags = SSL_AL_FLAG_STATE_SERVER_HELLO;
ssl_state->flags |= SSL_AL_FLAG_SSL_SERVER_HS; ssl_state->current_flags |= SSL_AL_FLAG_SSL_SERVER_HS;
break; break;
} }
ssl_state->flags |= ssl_state->current_flags;
if (input_len + ssl_state->curr_connp->bytes_processed >= if (input_len + ssl_state->curr_connp->bytes_processed >=
(ssl_state->curr_connp->record_length + (ssl_state->curr_connp->record_length +
ssl_state->curr_connp->record_lengths_length)) { ssl_state->curr_connp->record_lengths_length)) {
@ -1316,6 +1319,11 @@ static int SSLDecode(Flow *f, uint8_t direction, void *alstate, AppLayerParserSt
else else
ssl_state->curr_connp = &ssl_state->server_connp; ssl_state->curr_connp = &ssl_state->server_connp;
/* If entering on a new record, reset the current flags. */
if (ssl_state->curr_connp->bytes_processed == 0) {
ssl_state->current_flags = 0;
}
/* if we have more than one record */ /* if we have more than one record */
while (input_len > 0) { while (input_len > 0) {
if (counter++ == 30) { if (counter++ == 30) {

2
src/app-layer-ssl.h
Unescape Escape View File

@ -184,6 +184,8 @@ typedef struct SSLState_ {
uint16_t events; uint16_t events;
uint32_t current_flags;
SSLStateConnp *curr_connp; SSLStateConnp *curr_connp;
SSLStateConnp client_connp; SSLStateConnp client_connp;

Write Preview
Loading…
Cancel
Save