Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 09:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

SSH: Cleanup code style.

Browse source
This commit is contained in:
Vlad Grigorescu 2015-03-03 16:22:22 -05:00
parent 3190ca275e
commit b76f7d9fa7
5 changed files with 278 additions and 285 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/protocol/ssh/Plugin.cc
View file

@ -1,15 +1,13 @@
// See the file in the main distribution directory for copyright. // See the file in the main distribution directory for copyright.
#include "plugin/Plugin.h" #include "plugin/Plugin.h"
#include "SSH.h" #include "SSH.h"
namespace plugin { namespace plugin {
namespace Bro_SSH { namespace Bro_SSH {
class Plugin : public plugin::Plugin { class Plugin : public plugin::Plugin {
public: public:
plugin::Configuration Configure() plugin::Configuration Configure()
{ {
AddComponent(new ::analyzer::Component("SSH", ::analyzer::SSH::SSH_Analyzer::Instantiate)); AddComponent(new ::analyzer::Component("SSH", ::analyzer::SSH::SSH_Analyzer::Instantiate));
@ -19,8 +17,8 @@ public:
config.description = "Secure Shell analyzer"; config.description = "Secure Shell analyzer";
return config; return config;
} }
} plugin; } plugin;
} }
} }

6
src/analyzer/protocol/ssh/SSH.cc
View file

@ -12,9 +12,7 @@
using namespace analyzer::SSH; using namespace analyzer::SSH;
SSH_Analyzer::SSH_Analyzer(Connection* c) SSH_Analyzer::SSH_Analyzer(Connection* c)
: tcp::TCP_ApplicationAnalyzer("SSH", c)
: tcp::TCP_ApplicationAnalyzer("SSH", c)
{ {
interp = new binpac::SSH::SSH_Conn(this); interp = new binpac::SSH::SSH_Conn(this);
had_gap = false; had_gap = false;
@ -31,12 +29,10 @@ SSH_Analyzer::~SSH_Analyzer()
void SSH_Analyzer::Done() void SSH_Analyzer::Done()
{ {
tcp::TCP_ApplicationAnalyzer::Done(); tcp::TCP_ApplicationAnalyzer::Done();
interp->FlowEOF(true); interp->FlowEOF(true);
interp->FlowEOF(false); interp->FlowEOF(false);
} }
void SSH_Analyzer::EndpointEOF(bool is_orig) void SSH_Analyzer::EndpointEOF(bool is_orig)

16
src/analyzer/protocol/ssh/SSH.h
View file

@ -8,11 +8,11 @@
#include "analyzer/protocol/tcp/TCP.h" #include "analyzer/protocol/tcp/TCP.h"
#include "ssh_pac.h" #include "ssh_pac.h"
namespace analyzer { namespace SSH { namespace analyzer {
namespace SSH {
class SSH_Analyzer : public tcp::TCP_ApplicationAnalyzer {
class SSH_Analyzer : public tcp::TCP_ApplicationAnalyzer { public:
public:
SSH_Analyzer(Connection* conn); SSH_Analyzer(Connection* conn);
virtual ~SSH_Analyzer(); virtual ~SSH_Analyzer();
@ -27,7 +27,7 @@ public:
static analyzer::Analyzer* Instantiate(Connection* conn) static analyzer::Analyzer* Instantiate(Connection* conn)
{ return new SSH_Analyzer(conn); } { return new SSH_Analyzer(conn); }
protected: protected:
binpac::SSH::SSH_Conn* interp; binpac::SSH::SSH_Conn* interp;
void ProcessEncrypted(int len, bool orig); void ProcessEncrypted(int len, bool orig);
@ -41,8 +41,8 @@ protected:
int service_accept_size; int service_accept_size;
int userauth_failure_size; int userauth_failure_size;
}; };
} } // namespace analyzer::*
}
}
#endif #endif

115
src/analyzer/protocol/ssh/ssh-protocol.pac
View file

@ -128,43 +128,43 @@ enum ssh2_message_id {
## SSH Generic ## SSH Generic
type SSH_PDU(is_orig: bool) = case $context.connection.get_state(is_orig) of { type SSH_PDU(is_orig: bool) = case $context.connection.get_state(is_orig) of {
VERSION_EXCHANGE -> version: SSH_Version(is_orig); VERSION_EXCHANGE -> version : SSH_Version(is_orig);
KEX_INIT -> kex: SSH_Key_Exchange(is_orig); KEX_INIT -> kex : SSH_Key_Exchange(is_orig);
KEX_DH_GEX -> kex_dh_gex: SSH_Key_Exchange_DH_GEX(is_orig); KEX_DH_GEX -> kex_dh_gex : SSH_Key_Exchange_DH_GEX(is_orig);
KEX_DH -> kex_dh: SSH_Key_Exchange_DH(is_orig); KEX_DH -> kex_dh : SSH_Key_Exchange_DH(is_orig);
KEX_ECC -> kex_ecc: SSH_Key_Exchange_ECC(is_orig); KEX_ECC -> kex_ecc : SSH_Key_Exchange_ECC(is_orig);
KEX_GSS -> kex_gss: SSH_Key_Exchange_GSS(is_orig); KEX_GSS -> kex_gss : SSH_Key_Exchange_GSS(is_orig);
KEX_RSA -> kex_rsa: SSH_Key_Exchange_RSA(is_orig); KEX_RSA -> kex_rsa : SSH_Key_Exchange_RSA(is_orig);
} &byteorder=bigendian; } &byteorder=bigendian;
type SSH_Version(is_orig: bool) = record { type SSH_Version(is_orig: bool) = record {
version: bytestring &oneline; version : bytestring &oneline;
pad: bytestring &length=0 &transient; pad : bytestring &length=0 &transient;
} &let { } &let {
update_state : bool = $context.connection.update_state(KEX_INIT, is_orig); update_state : bool = $context.connection.update_state(KEX_INIT, is_orig);
update_version: bool = $context.connection.update_version(version, is_orig); update_version : bool = $context.connection.update_version(version, is_orig);
}; };
type SSH_Key_Exchange(is_orig: bool) = case $context.connection.get_version() of { type SSH_Key_Exchange(is_orig: bool) = case $context.connection.get_version() of {
SSH1 -> ssh1_msg: SSH1_Key_Exchange(is_orig); SSH1 -> ssh1_msg : SSH1_Key_Exchange(is_orig);
SSH2 -> ssh2_msg: SSH2_Key_Exchange(is_orig); SSH2 -> ssh2_msg : SSH2_Key_Exchange(is_orig);
}; };
## SSH1 ## SSH1
type SSH1_Key_Exchange(is_orig: bool) = record { type SSH1_Key_Exchange(is_orig: bool) = record {
packet_length: uint32; packet_length : uint32;
pad_fill : bytestring &length = 8 - (packet_length % 8); pad_fill : bytestring &length = 8 - (packet_length % 8);
msg_type : uint8; msg_type : uint8;
message : SSH1_Message(is_orig, msg_type, packet_length-5); message : SSH1_Message(is_orig, msg_type, packet_length - 5);
crc : uint32; crc : uint32;
} &length = packet_length + 4 + 8 - (packet_length % 8); } &length = packet_length + 4 + 8 - (packet_length % 8);
type SSH1_Message(is_orig: bool, msg_type: uint8, length: uint32) = case msg_type of { type SSH1_Message(is_orig: bool, msg_type: uint8, length: uint32) = case msg_type of {
SSH_SMSG_PUBLIC_KEY -> public_key: SSH1_PUBLIC_KEY(length); SSH_SMSG_PUBLIC_KEY -> public_key : SSH1_PUBLIC_KEY(length);
SSH_CMSG_SESSION_KEY -> session_key: SSH1_SESSION_KEY(length); SSH_CMSG_SESSION_KEY -> session_key : SSH1_SESSION_KEY(length);
} &let { } &let {
detach: bool = $context.connection.update_state(ENCRYPTED, is_orig); detach : bool=$context.connection.update_state(ENCRYPTED, is_orig);
}; };
type SSH1_PUBLIC_KEY(length: uint32) = record { type SSH1_PUBLIC_KEY(length: uint32) = record {
@ -188,18 +188,19 @@ type SSH1_SESSION_KEY(length: uint32) = record {
} &length=length; } &length=length;
type ssh1_mp_int = record { type ssh1_mp_int = record {
len: uint16; len : uint16;
val: bytestring &length=(len+7)/8; val : bytestring &length=(len+7)/8;
}; };
## SSH2 ## SSH2
type SSH2_Key_Exchange_Header = record { type SSH2_Key_Exchange_Header = record {
packet_length : uint32; packet_length : uint32;
padding_length: uint8; padding_length : uint8;
msg_type : uint8; msg_type : uint8;
} &let { } &let {
payload_length: uint32 = packet_length - padding_length - 2; payload_length : uint32 = packet_length - padding_length - 2;
} &length=6; } &length=6;
type SSH2_Key_Exchange(is_orig: bool) = record { type SSH2_Key_Exchange(is_orig: bool) = record {
@ -209,10 +210,10 @@ type SSH2_Key_Exchange(is_orig: bool) = record {
} &length=header.packet_length + 4; } &length=header.packet_length + 4;
type SSH2_Message(is_orig: bool, msg_type: uint8, length: uint32) = case msg_type of { type SSH2_Message(is_orig: bool, msg_type: uint8, length: uint32) = case msg_type of {
MSG_KEXINIT -> kexinit: SSH_KEXINIT(length, is_orig); MSG_KEXINIT -> kexinit : SSH_KEXINIT(length, is_orig);
default -> unknown: bytestring &length=length; default -> unknown : bytestring &length=length;
} &let { } &let {
detach: bool = $context.connection.update_state(ENCRYPTED, is_orig) &if(msg_type == MSG_NEWKEYS); detach : bool = $context.connection.update_state(ENCRYPTED, is_orig) &if(msg_type == MSG_NEWKEYS);
}; };
type SSH_KEXINIT(length: uint32, is_orig: bool) = record { type SSH_KEXINIT(length: uint32, is_orig: bool) = record {
@ -230,7 +231,7 @@ type SSH_KEXINIT(length: uint32, is_orig: bool) = record {
first_kex_packet_follows : uint8; first_kex_packet_follows : uint8;
reserved : uint32; reserved : uint32;
} &let { } &let {
proc_kex : bool = $context.connection.update_kex(kex_algorithms.val, is_orig); proc_kex : bool= $context.connection.update_kex(kex_algorithms.val, is_orig);
} &length=length; } &length=length;
# KEX_DH exchanges # KEX_DH exchanges
@ -263,28 +264,28 @@ type SSH_Key_Exchange_DH_GEX_Message(is_orig: bool, msg_type: uint8, length: uin
}; };
type SSH_DH_GEX_REQUEST = record { type SSH_DH_GEX_REQUEST = record {
min: uint32; min : uint32;
n : uint32; n : uint32;
max: uint32; max : uint32;
} &length=12; } &length=12;
type SSH_DH_GEX_REQUEST_OLD = record { type SSH_DH_GEX_REQUEST_OLD = record {
n: uint32; n : uint32;
} &length=4; } &length=4;
type SSH_DH_GEX_GROUP(length: uint32) = record { type SSH_DH_GEX_GROUP(length: uint32) = record {
p: ssh_string; p : ssh_string;
g: ssh_string; g : ssh_string;
} &length=length; } &length=length;
type SSH_DH_GEX_INIT(length: uint32) = record { type SSH_DH_GEX_INIT(length: uint32) = record {
e: ssh_string; e : ssh_string;
} &length=length; } &length=length;
type SSH_DH_GEX_REPLY(length: uint32) = record { type SSH_DH_GEX_REPLY(length: uint32) = record {
k_s : ssh_string; k_s : ssh_string;
f : ssh_string; f : ssh_string;
signature: ssh_string; signature : ssh_string;
} &length=length; } &length=length;
# KEX_RSA exchanges # KEX_RSA exchanges
@ -302,16 +303,16 @@ type SSH_Key_Exchange_RSA_Message(is_orig: bool, msg_type: uint8, length: uint32
}; };
type SSH_RSA_PUBKEY(length: uint32) = record { type SSH_RSA_PUBKEY(length: uint32) = record {
k_s: ssh_string; k_s : ssh_string;
k_t: ssh_string; k_t : ssh_string;
} &length=length; } &length=length;
type SSH_RSA_SECRET(length: uint32) = record { type SSH_RSA_SECRET(length: uint32) = record {
encrypted_payload: ssh_string; encrypted_payload : ssh_string;
} &length=length; } &length=length;
type SSH_RSA_DONE(length: uint32) = record { type SSH_RSA_DONE(length: uint32) = record {
signature: ssh_string; signature : ssh_string;
} &length=length; } &length=length;
# KEX_GSS exchanges # KEX_GSS exchanges
@ -333,12 +334,12 @@ type SSH_Key_Exchange_GSS_Message(is_orig: bool, msg_type: uint8, length: uint32
}; };
type SSH_GSS_INIT(length: uint32) = record { type SSH_GSS_INIT(length: uint32) = record {
output_token: ssh_string; output_token : ssh_string;
e : ssh_string; e : ssh_string;
} &length=length; } &length=length;
type SSH_GSS_CONTINUE(length: uint32) = record { type SSH_GSS_CONTINUE(length: uint32) = record {
output_token: ssh_string; output_token : ssh_string;
} &length=length; } &length=length;
type SSH_GSS_COMPLETE(length: uint32) = record { type SSH_GSS_COMPLETE(length: uint32) = record {
@ -346,18 +347,18 @@ type SSH_GSS_COMPLETE(length: uint32) = record {
per_msg_token : ssh_string; per_msg_token : ssh_string;
have_token : uint8; have_token : uint8;
parse_token : case have_token of { parse_token : case have_token of {
0 -> no_token: empty; 0 -> no_token : empty;
default -> token: ssh_string; default -> token : ssh_string;
}; };
} &length=length; } &length=length;
type SSH_GSS_HOSTKEY(length: uint32) = record { type SSH_GSS_HOSTKEY(length: uint32) = record {
k_s: ssh_string; k_s : ssh_string;
} &length=length; } &length=length;
type SSH_GSS_ERROR(length: uint32) = record { type SSH_GSS_ERROR(length: uint32) = record {
major_status: uint32; major_status : uint32;
minor_status: uint32; minor_status : uint32;
message : ssh_string; message : ssh_string;
language : ssh_string; language : ssh_string;
} &length=length; } &length=length;
@ -378,7 +379,7 @@ type SSH_Key_Exchange_ECC_Message(is_orig: bool, msg_type: uint8, length: uint32
# This deviates from the RFC. SSH_MSG_KEX_ECDH_INIT and # This deviates from the RFC. SSH_MSG_KEX_ECDH_INIT and
# SSH_MSG_KEX_ECMQV_INIT can be parsed the same way. # SSH_MSG_KEX_ECMQV_INIT can be parsed the same way.
type SSH_ECC_INIT(length: uint32) = record { type SSH_ECC_INIT(length: uint32) = record {
q_c: ssh_string; q_c : ssh_string;
}; };
# This deviates from the RFC. SSH_MSG_KEX_ECDH_REPLY and # This deviates from the RFC. SSH_MSG_KEX_ECDH_REPLY and
@ -390,14 +391,14 @@ type SSH_ECC_REPLY(length: uint32) = record {
}; };
type ssh_string = record { type ssh_string = record {
len: uint32; len : uint32;
val: bytestring &length=len; val : bytestring &length=len;
}; };
type ssh_host_key = record { type ssh_host_key = record {
len: uint32; len : uint32;
key_type: ssh_string; key_type : ssh_string;
key: ssh_string; key : ssh_string;
} &length=(len + 4); } &length=(len + 4);
## Done with types ## Done with types
@ -430,7 +431,7 @@ refine connection SSH_Conn += {
kex_algs_cache_.free(); kex_algs_cache_.free();
%} %}
function get_state(is_orig: bool): int function get_state(is_orig: bool) : int
%{ %{
if ( is_orig ) if ( is_orig )
{ {
@ -442,7 +443,7 @@ refine connection SSH_Conn += {
} }
%} %}
function update_state(s: state, is_orig: bool): bool function update_state(s: state, is_orig: bool) : bool
%{ %{
if ( is_orig ) if ( is_orig )
state_up_ = s; state_up_ = s;
@ -451,12 +452,12 @@ refine connection SSH_Conn += {
return true; return true;
%} %}
function get_version(): int function get_version() : int
%{ %{
return version_; return version_;
%} %}
function update_version(v: bytestring, is_orig: bool): bool function update_version(v: bytestring, is_orig: bool) : bool
%{ %{
if ( is_orig && ( v.length() >= 4 ) ) if ( is_orig && ( v.length() >= 4 ) )
{ {
@ -468,7 +469,7 @@ refine connection SSH_Conn += {
return true; return true;
%} %}
function update_kex_state_if_equal(s: string, to_state: state): bool function update_kex_state_if_equal(s: string, to_state: state) : bool
%{ %{
if ( strcmp(c_str(kex_algorithm_), s.c_str()) == 0 ) if ( strcmp(c_str(kex_algorithm_), s.c_str()) == 0 )
{ {
@ -479,7 +480,7 @@ refine connection SSH_Conn += {
return false; return false;
%} %}
function update_kex_state_if_startswith(s: string, to_state: state): bool function update_kex_state_if_startswith(s: string, to_state: state) : bool
%{ %{
if ( (uint) kex_algorithm_.length() < s.length() ) if ( (uint) kex_algorithm_.length() < s.length() )
return false; return false;
@ -493,7 +494,7 @@ refine connection SSH_Conn += {
return false; return false;
%} %}
function update_kex(algs: bytestring, orig: bool): bool function update_kex(algs: bytestring, orig: bool) : bool
%{ %{
if ( !kex_seen_ ) if ( !kex_seen_ )
{ {
@ -569,8 +570,6 @@ refine connection SSH_Conn += {
Unref(server_list); Unref(server_list);
return true; return true;
%} %}
}; };