Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge remote-tracking branch 'origin/topic/awelzel/3099-fix-and-extend-socks5-sig'

Browse source 
* origin/topic/awelzel/3099-fix-and-extend-socks5-sig:
  socks/dpd: Add newer auth methods
  socks/dpd: Fix socks5_server side signature

(cherry picked from commit c389d9804b)
This commit is contained in:
Tim Wojtulewicz 2023-06-12 10:56:55 -07:00
parent e41a5c3a93
commit b34e70e6cd
7 changed files with 63 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/base/protocols/socks/dpd.sig
View file

@ -31,7 +31,7 @@ signature dpd_socks4_reverse_server {
signature dpd_socks5_client {
ip-proto == tcp
# Watch for a few authentication methods to reduce false positives.
payload /^\x05.[\x00\x01\x02]/
payload /^\x05.[\x00\x01\x02\x03\x05\x06\x07\x08\x09]/
tcp-state originator
}
@ -40,9 +40,23 @@ signature dpd_socks5_server {
requires-reverse-signature dpd_socks5_client
# Watch for a single authentication method to be chosen by the server or
# the server to indicate the no authentication is required.
payload /^\x05(\x00|\x01[\x00\x01\x02])/
# From wikipedia:
# 0x00: No authentication
# 0x01: GSSAPI (RFC 1961)
# 0x02: Username/password (RFC 1929)
# 0x03–0x7F: methods assigned by IANA[11]
# 0x03: Challenge-Handshake Authentication Protocol
# 0x04: Unassigned
# 0x05: Challenge-Response Authentication Method
# 0x06: Secure Sockets Layer
# 0x07: NDS Authentication
# 0x08: Multi-Authentication Framework
# 0x09: JSON Parameter Block
# 0x0A–0x7F: Unassigned
# 0x80–0xFE: methods reserved for private use
#
# Keep in sync with dpd_socks5_client, 0xff is "no acceptable methods"
payload /^\x05[\x00\x01\x02\x03\x05\x06\x07\x08\x09\xff]/
tcp-state responder
enable "socks"
}