suricata
app-layer-ssl.c File Reference
#include "suricata-common.h"
#include "decode.h"
#include "threads.h"
#include "stream-tcp-private.h"
#include "stream-tcp-reassemble.h"
#include "stream-tcp.h"
#include "stream.h"
#include "app-layer.h"
#include "app-layer-detect-proto.h"
#include "app-layer-protos.h"
#include "app-layer-parser.h"
#include "app-layer-frames.h"
#include "app-layer-ssl.h"
#include "decode-events.h"
#include "conf.h"
#include "util-spm.h"
#include "util-unittest.h"
#include "util-debug.h"
#include "util-print.h"
#include "util-pool.h"
#include "util-byte.h"
#include "util-ja3.h"
#include "util-enum.h"
#include "flow-util.h"
#include "flow-private.h"
#include "util-validate.h"
Include dependency graph for app-layer-ssl.c:

Go to the source code of this file.

Data Structures

struct  SslConfig_
 
struct  SSLDecoderResult
 

Macros

#define SSL_CONFIG_DEFAULT_JA3   0
 
#define SSLV3_CHANGE_CIPHER_SPEC   20
 
#define SSLV3_ALERT_PROTOCOL   21
 
#define SSLV3_HANDSHAKE_PROTOCOL   22
 
#define SSLV3_APPLICATION_PROTOCOL   23
 
#define SSLV3_HEARTBEAT_PROTOCOL   24
 
#define SSLV3_HS_HELLO_REQUEST   0
 
#define SSLV3_HS_CLIENT_HELLO   1
 
#define SSLV3_HS_SERVER_HELLO   2
 
#define SSLV3_HS_NEW_SESSION_TICKET   4
 
#define SSLV3_HS_CERTIFICATE   11
 
#define SSLV3_HS_SERVER_KEY_EXCHANGE   12
 
#define SSLV3_HS_CERTIFICATE_REQUEST   13
 
#define SSLV3_HS_SERVER_HELLO_DONE   14
 
#define SSLV3_HS_CERTIFICATE_VERIFY   15
 
#define SSLV3_HS_CLIENT_KEY_EXCHANGE   16
 
#define SSLV3_HS_FINISHED   20
 
#define SSLV3_HS_CERTIFICATE_URL   21
 
#define SSLV3_HS_CERTIFICATE_STATUS   22
 
#define SSLV2_MT_ERROR   0
 
#define SSLV2_MT_CLIENT_HELLO   1
 
#define SSLV2_MT_CLIENT_MASTER_KEY   2
 
#define SSLV2_MT_CLIENT_FINISHED   3
 
#define SSLV2_MT_SERVER_HELLO   4
 
#define SSLV2_MT_SERVER_VERIFY   5
 
#define SSLV2_MT_SERVER_FINISHED   6
 
#define SSLV2_MT_REQUEST_CERTIFICATE   7
 
#define SSLV2_MT_CLIENT_CERTIFICATE   8
 
#define SSLV3_RECORD_HDR_LEN   5
 
#define SSLV3_MESSAGE_HDR_LEN   4
 
#define SSLV3_RECORD_MAX_LEN   ((1 << 14) + 1024)
 
#define SSLV3_CLIENT_HELLO_VERSION_LEN   2
 
#define SSLV3_CLIENT_HELLO_RANDOM_LEN   32
 
#define TLS_HB_REQUEST   1
 
#define TLS_HB_RESPONSE   2
 
#define SSL_RECORD_MINIMUM_LENGTH   6
 
#define SHA1_STRING_LENGTH   60
 
#define HAS_SPACE(n)   ((uint64_t)(input - initial_input) + (uint64_t)(n) <= (uint64_t)(input_len))
 
#define SSL_DECODER_ERROR(e)
 
#define SSL_DECODER_OK(c)
 
#define SSL_DECODER_INCOMPLETE(c, n)
 
#define ValidateRecordState(...)
 
#define SSLParserHSReset(connp)
 
#define SSLParserReset(state)
 
#define SSLSetEvent(ssl_state, event)
 

Typedefs

typedef struct SslConfig_ SslConfig
 

Enumerations

enum  {
  ERR_INVALID_CERTIFICATE =1, ERR_INVALID_LENGTH, ERR_INVALID_VERSION, ERR_INVALID_SERIAL,
  ERR_INVALID_ALGORITHMIDENTIFIER, ERR_INVALID_X509NAME, ERR_INVALID_DATE, ERR_INVALID_EXTENSIONS,
  ERR_INVALID_DER, ERR_EXTRACT_SUBJECT, ERR_EXTRACT_ISSUER, ERR_EXTRACT_VALIDITY
}
 
enum  SslConfigEncryptHandling { SSL_CNF_ENC_HANDLE_DEFAULT = 0, SSL_CNF_ENC_HANDLE_BYPASS = 1, SSL_CNF_ENC_HANDLE_FULL = 2 }
 

Functions

void SSLVersionToString (uint16_t version, char *buffer)
 
void RegisterSSLParsers (void)
 Function to register the SSL protocol parser and other functions. More...
 
void SSLEnableJA3 (void)
 if not explicitly disabled in config, enable ja3 support More...
 
bool SSLJA3IsEnabled (void)
 

Variables

SCEnumCharMap tls_frame_table []
 
SCEnumCharMap tls_decoder_event_table []
 
SslConfig ssl_config
 

Detailed Description

Macro Definition Documentation

◆ HAS_SPACE

#define HAS_SPACE (   n)    ((uint64_t)(input - initial_input) + (uint64_t)(n) <= (uint64_t)(input_len))

Definition at line 215 of file app-layer-ssl.c.

◆ SHA1_STRING_LENGTH

#define SHA1_STRING_LENGTH   60

Definition at line 213 of file app-layer-ssl.c.

◆ SSL_CONFIG_DEFAULT_JA3

#define SSL_CONFIG_DEFAULT_JA3   0

Definition at line 148 of file app-layer-ssl.c.

◆ SSL_DECODER_ERROR

#define SSL_DECODER_ERROR (   e)
Value:
(struct SSLDecoderResult) \
{ \
(e), 0 \
}

Definition at line 221 of file app-layer-ssl.c.

◆ SSL_DECODER_INCOMPLETE

#define SSL_DECODER_INCOMPLETE (   c,
 
)
Value:
(struct SSLDecoderResult) \
{ \
(c), (n) \
}

Definition at line 231 of file app-layer-ssl.c.

◆ SSL_DECODER_OK

#define SSL_DECODER_OK (   c)
Value:
(struct SSLDecoderResult) \
{ \
(c), 0 \
}

Definition at line 226 of file app-layer-ssl.c.

◆ SSL_RECORD_MINIMUM_LENGTH

#define SSL_RECORD_MINIMUM_LENGTH   6

Definition at line 211 of file app-layer-ssl.c.

◆ SSLParserHSReset

#define SSLParserHSReset (   connp)
Value:
do { \
(connp)->handshake_type = 0; \
(connp)->message_length = 0; \
} while (0)

Definition at line 267 of file app-layer-ssl.c.

◆ SSLParserReset

#define SSLParserReset (   state)
Value:
do { \
SCLogDebug("resetting state"); \
(state)->curr_connp->bytes_processed = 0; \
SSLParserHSReset((state)->curr_connp); \
} while(0)

Definition at line 273 of file app-layer-ssl.c.

◆ SSLSetEvent

#define SSLSetEvent (   ssl_state,
  event 
)
Value:
do { \
SCLogDebug("setting event %u", (event)); \
if ((ssl_state) == NULL) { \
SCLogDebug("could not set decoder event %u", event); \
} else { \
AppLayerDecoderEventsSetEventRaw(&(ssl_state)->tx_data.events, (event)); \
(ssl_state)->events++; \
} \
} while (0)

Definition at line 280 of file app-layer-ssl.c.

◆ SSLV2_MT_CLIENT_CERTIFICATE

#define SSLV2_MT_CLIENT_CERTIFICATE   8

Definition at line 197 of file app-layer-ssl.c.

◆ SSLV2_MT_CLIENT_FINISHED

#define SSLV2_MT_CLIENT_FINISHED   3

Definition at line 192 of file app-layer-ssl.c.

◆ SSLV2_MT_CLIENT_HELLO

#define SSLV2_MT_CLIENT_HELLO   1

Definition at line 190 of file app-layer-ssl.c.

◆ SSLV2_MT_CLIENT_MASTER_KEY

#define SSLV2_MT_CLIENT_MASTER_KEY   2

Definition at line 191 of file app-layer-ssl.c.

◆ SSLV2_MT_ERROR

#define SSLV2_MT_ERROR   0

Definition at line 189 of file app-layer-ssl.c.

◆ SSLV2_MT_REQUEST_CERTIFICATE

#define SSLV2_MT_REQUEST_CERTIFICATE   7

Definition at line 196 of file app-layer-ssl.c.

◆ SSLV2_MT_SERVER_FINISHED

#define SSLV2_MT_SERVER_FINISHED   6

Definition at line 195 of file app-layer-ssl.c.

◆ SSLV2_MT_SERVER_HELLO

#define SSLV2_MT_SERVER_HELLO   4

Definition at line 193 of file app-layer-ssl.c.

◆ SSLV2_MT_SERVER_VERIFY

#define SSLV2_MT_SERVER_VERIFY   5

Definition at line 194 of file app-layer-ssl.c.

◆ SSLV3_ALERT_PROTOCOL

#define SSLV3_ALERT_PROTOCOL   21

Definition at line 168 of file app-layer-ssl.c.

◆ SSLV3_APPLICATION_PROTOCOL

#define SSLV3_APPLICATION_PROTOCOL   23

Definition at line 170 of file app-layer-ssl.c.

◆ SSLV3_CHANGE_CIPHER_SPEC

#define SSLV3_CHANGE_CIPHER_SPEC   20

Definition at line 167 of file app-layer-ssl.c.

◆ SSLV3_CLIENT_HELLO_RANDOM_LEN

#define SSLV3_CLIENT_HELLO_RANDOM_LEN   32

Definition at line 205 of file app-layer-ssl.c.

◆ SSLV3_CLIENT_HELLO_VERSION_LEN

#define SSLV3_CLIENT_HELLO_VERSION_LEN   2

Definition at line 204 of file app-layer-ssl.c.

◆ SSLV3_HANDSHAKE_PROTOCOL

#define SSLV3_HANDSHAKE_PROTOCOL   22

Definition at line 169 of file app-layer-ssl.c.

◆ SSLV3_HEARTBEAT_PROTOCOL

#define SSLV3_HEARTBEAT_PROTOCOL   24

Definition at line 171 of file app-layer-ssl.c.

◆ SSLV3_HS_CERTIFICATE

#define SSLV3_HS_CERTIFICATE   11

Definition at line 178 of file app-layer-ssl.c.

◆ SSLV3_HS_CERTIFICATE_REQUEST

#define SSLV3_HS_CERTIFICATE_REQUEST   13

Definition at line 180 of file app-layer-ssl.c.

◆ SSLV3_HS_CERTIFICATE_STATUS

#define SSLV3_HS_CERTIFICATE_STATUS   22

Definition at line 186 of file app-layer-ssl.c.

◆ SSLV3_HS_CERTIFICATE_URL

#define SSLV3_HS_CERTIFICATE_URL   21

Definition at line 185 of file app-layer-ssl.c.

◆ SSLV3_HS_CERTIFICATE_VERIFY

#define SSLV3_HS_CERTIFICATE_VERIFY   15

Definition at line 182 of file app-layer-ssl.c.

◆ SSLV3_HS_CLIENT_HELLO

#define SSLV3_HS_CLIENT_HELLO   1

Definition at line 175 of file app-layer-ssl.c.

◆ SSLV3_HS_CLIENT_KEY_EXCHANGE

#define SSLV3_HS_CLIENT_KEY_EXCHANGE   16

Definition at line 183 of file app-layer-ssl.c.

◆ SSLV3_HS_FINISHED

#define SSLV3_HS_FINISHED   20

Definition at line 184 of file app-layer-ssl.c.

◆ SSLV3_HS_HELLO_REQUEST

#define SSLV3_HS_HELLO_REQUEST   0

Definition at line 174 of file app-layer-ssl.c.

◆ SSLV3_HS_NEW_SESSION_TICKET

#define SSLV3_HS_NEW_SESSION_TICKET   4

Definition at line 177 of file app-layer-ssl.c.

◆ SSLV3_HS_SERVER_HELLO

#define SSLV3_HS_SERVER_HELLO   2

Definition at line 176 of file app-layer-ssl.c.

◆ SSLV3_HS_SERVER_HELLO_DONE

#define SSLV3_HS_SERVER_HELLO_DONE   14

Definition at line 181 of file app-layer-ssl.c.

◆ SSLV3_HS_SERVER_KEY_EXCHANGE

#define SSLV3_HS_SERVER_KEY_EXCHANGE   12

Definition at line 179 of file app-layer-ssl.c.

◆ SSLV3_MESSAGE_HDR_LEN

#define SSLV3_MESSAGE_HDR_LEN   4

Definition at line 200 of file app-layer-ssl.c.

◆ SSLV3_RECORD_HDR_LEN

#define SSLV3_RECORD_HDR_LEN   5

Definition at line 199 of file app-layer-ssl.c.

◆ SSLV3_RECORD_MAX_LEN

#define SSLV3_RECORD_MAX_LEN   ((1 << 14) + 1024)

max length according to RFC 5246 6.2.2 is 2^14 + 1024

Definition at line 202 of file app-layer-ssl.c.

◆ TLS_HB_REQUEST

#define TLS_HB_REQUEST   1

Definition at line 208 of file app-layer-ssl.c.

◆ TLS_HB_RESPONSE

#define TLS_HB_RESPONSE   2

Definition at line 209 of file app-layer-ssl.c.

◆ ValidateRecordState

#define ValidateRecordState (   ...)

Definition at line 264 of file app-layer-ssl.c.

Typedef Documentation

◆ SslConfig

typedef struct SslConfig_ SslConfig

Enumeration Type Documentation

◆ anonymous enum

anonymous enum
Enumerator
ERR_INVALID_CERTIFICATE 
ERR_INVALID_LENGTH 
ERR_INVALID_VERSION 
ERR_INVALID_SERIAL 
ERR_INVALID_ALGORITHMIDENTIFIER 
ERR_INVALID_X509NAME 
ERR_INVALID_DATE 
ERR_INVALID_EXTENSIONS 
ERR_INVALID_DER 
ERR_EXTRACT_SUBJECT 
ERR_EXTRACT_ISSUER 
ERR_EXTRACT_VALIDITY 

Definition at line 127 of file app-layer-ssl.c.

◆ SslConfigEncryptHandling

Enumerator
SSL_CNF_ENC_HANDLE_DEFAULT 

disable raw content, continue tracking

SSL_CNF_ENC_HANDLE_BYPASS 

skip processing of flow, bypass if possible

SSL_CNF_ENC_HANDLE_FULL 

handle fully like any other proto

Definition at line 149 of file app-layer-ssl.c.

Function Documentation

◆ RegisterSSLParsers()

void RegisterSSLParsers ( void  )

Function to register the SSL protocol parser and other functions.

SSLv2 and SSLv23

Definition at line 2956 of file app-layer-ssl.c.

References ALPROTO_TLS, AppLayerProtoDetectConfProtoDetectionEnabled(), AppLayerProtoDetectRegisterProtocol(), SC_ATOMIC_INIT, and ssl_config.

Here is the call graph for this function:

◆ SSLEnableJA3()

void SSLEnableJA3 ( void  )

if not explicitly disabled in config, enable ja3 support

Implemented using atomic to allow rule reloads to do this at runtime.

Definition at line 3091 of file app-layer-ssl.c.

References SslConfig_::disable_ja3, g_disable_hashing, SC_ATOMIC_GET, SC_ATOMIC_SET, and ssl_config.

◆ SSLJA3IsEnabled()

bool SSLJA3IsEnabled ( void  )

Definition at line 3102 of file app-layer-ssl.c.

References SC_ATOMIC_GET, and ssl_config.

Referenced by Ja3IsDisabled().

Here is the caller graph for this function:

◆ SSLVersionToString()

Variable Documentation

◆ ssl_config

SslConfig ssl_config

Definition at line 163 of file app-layer-ssl.c.

Referenced by RegisterSSLParsers(), SSLEnableJA3(), and SSLJA3IsEnabled().

◆ tls_decoder_event_table

SCEnumCharMap tls_decoder_event_table[]

Definition at line 90 of file app-layer-ssl.c.

◆ tls_frame_table

SCEnumCharMap tls_frame_table[]

Definition at line 58 of file app-layer-ssl.c.

SSLParserHSReset
#define SSLParserHSReset(connp)
Definition: app-layer-ssl.c:266
SSLDecoderResult
Definition: app-layer-ssl.c:216