Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-08 17:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

SSH: Cleanup code style.

Browse source
This commit is contained in:
Vlad Grigorescu 2015-03-03 16:22:22 -05:00
parent 3190ca275e
commit b76f7d9fa7
5 changed files with 278 additions and 285 deletions
Download patch file Download diff file Expand all files Collapse all files

14
src/analyzer/protocol/ssh/Plugin.cc
View file

@ -1,15 +1,13 @@
// See the file in the main distribution directory for copyright.
#include "plugin/Plugin.h"
#include "SSH.h"
namespace plugin {
namespace Bro_SSH {
namespace Bro_SSH {
class Plugin : public plugin::Plugin {
public:
class Plugin : public plugin::Plugin {
public:
plugin::Configuration Configure()
{
AddComponent(new ::analyzer::Component("SSH", ::analyzer::SSH::SSH_Analyzer::Instantiate));
@ -19,8 +17,8 @@ public:
config.description = "Secure Shell analyzer";
return config;
}
} plugin;
} plugin;
}
}
}
}

6
src/analyzer/protocol/ssh/SSH.cc
View file

@ -12,9 +12,7 @@
using namespace analyzer::SSH;
SSH_Analyzer::SSH_Analyzer(Connection* c)
: tcp::TCP_ApplicationAnalyzer("SSH", c)
: tcp::TCP_ApplicationAnalyzer("SSH", c)
{
interp = new binpac::SSH::SSH_Conn(this);
had_gap = false;
@ -31,12 +29,10 @@ SSH_Analyzer::~SSH_Analyzer()
void SSH_Analyzer::Done()
{
tcp::TCP_ApplicationAnalyzer::Done();
interp->FlowEOF(true);
interp->FlowEOF(false);
}
void SSH_Analyzer::EndpointEOF(bool is_orig)

16
src/analyzer/protocol/ssh/SSH.h
View file

@ -8,11 +8,11 @@
#include "analyzer/protocol/tcp/TCP.h"
#include "ssh_pac.h"
namespace analyzer { namespace SSH {
namespace analyzer {
namespace SSH {
class SSH_Analyzer : public tcp::TCP_ApplicationAnalyzer {
class SSH_Analyzer : public tcp::TCP_ApplicationAnalyzer {
public:
public:
SSH_Analyzer(Connection* conn);
virtual ~SSH_Analyzer();
@ -27,7 +27,7 @@ public:
static analyzer::Analyzer* Instantiate(Connection* conn)
{ return new SSH_Analyzer(conn); }
protected:
protected:
binpac::SSH::SSH_Conn* interp;
void ProcessEncrypted(int len, bool orig);
@ -41,8 +41,8 @@ protected:
int service_accept_size;
int userauth_failure_size;
};
} } // namespace analyzer::*
};
}
}
#endif

115
src/analyzer/protocol/ssh/ssh-protocol.pac
View file

@ -128,43 +128,43 @@ enum ssh2_message_id {
## SSH Generic
type SSH_PDU(is_orig: bool) = case $context.connection.get_state(is_orig) of {
VERSION_EXCHANGE -> version: SSH_Version(is_orig);
KEX_INIT -> kex: SSH_Key_Exchange(is_orig);
KEX_DH_GEX -> kex_dh_gex: SSH_Key_Exchange_DH_GEX(is_orig);
KEX_DH -> kex_dh: SSH_Key_Exchange_DH(is_orig);
KEX_ECC -> kex_ecc: SSH_Key_Exchange_ECC(is_orig);
KEX_GSS -> kex_gss: SSH_Key_Exchange_GSS(is_orig);
KEX_RSA -> kex_rsa: SSH_Key_Exchange_RSA(is_orig);
VERSION_EXCHANGE -> version : SSH_Version(is_orig);
KEX_INIT -> kex : SSH_Key_Exchange(is_orig);
KEX_DH_GEX -> kex_dh_gex : SSH_Key_Exchange_DH_GEX(is_orig);
KEX_DH -> kex_dh : SSH_Key_Exchange_DH(is_orig);
KEX_ECC -> kex_ecc : SSH_Key_Exchange_ECC(is_orig);
KEX_GSS -> kex_gss : SSH_Key_Exchange_GSS(is_orig);
KEX_RSA -> kex_rsa : SSH_Key_Exchange_RSA(is_orig);
} &byteorder=bigendian;
type SSH_Version(is_orig: bool) = record {
version: bytestring &oneline;
pad: bytestring &length=0 &transient;
version : bytestring &oneline;
pad : bytestring &length=0 &transient;
} &let {
update_state : bool = $context.connection.update_state(KEX_INIT, is_orig);
update_version: bool = $context.connection.update_version(version, is_orig);
update_version : bool = $context.connection.update_version(version, is_orig);
};
type SSH_Key_Exchange(is_orig: bool) = case $context.connection.get_version() of {
SSH1 -> ssh1_msg: SSH1_Key_Exchange(is_orig);
SSH2 -> ssh2_msg: SSH2_Key_Exchange(is_orig);
SSH1 -> ssh1_msg : SSH1_Key_Exchange(is_orig);
SSH2 -> ssh2_msg : SSH2_Key_Exchange(is_orig);
};
## SSH1
type SSH1_Key_Exchange(is_orig: bool) = record {
packet_length: uint32;
packet_length : uint32;
pad_fill : bytestring &length = 8 - (packet_length % 8);
msg_type : uint8;
message : SSH1_Message(is_orig, msg_type, packet_length-5);
message : SSH1_Message(is_orig, msg_type, packet_length - 5);
crc : uint32;
} &length = packet_length + 4 + 8 - (packet_length % 8);
type SSH1_Message(is_orig: bool, msg_type: uint8, length: uint32) = case msg_type of {
SSH_SMSG_PUBLIC_KEY -> public_key: SSH1_PUBLIC_KEY(length);
SSH_CMSG_SESSION_KEY -> session_key: SSH1_SESSION_KEY(length);
SSH_SMSG_PUBLIC_KEY -> public_key : SSH1_PUBLIC_KEY(length);
SSH_CMSG_SESSION_KEY -> session_key : SSH1_SESSION_KEY(length);
} &let {
detach: bool = $context.connection.update_state(ENCRYPTED, is_orig);
detach : bool=$context.connection.update_state(ENCRYPTED, is_orig);
};
type SSH1_PUBLIC_KEY(length: uint32) = record {
@ -188,18 +188,19 @@ type SSH1_SESSION_KEY(length: uint32) = record {
} &length=length;
type ssh1_mp_int = record {
len: uint16;
val: bytestring &length=(len+7)/8;
len : uint16;
val : bytestring &length=(len+7)/8;
};
## SSH2
type SSH2_Key_Exchange_Header = record {
packet_length : uint32;
padding_length: uint8;
padding_length : uint8;
msg_type : uint8;
} &let {
payload_length: uint32 = packet_length - padding_length - 2;
payload_length : uint32 = packet_length - padding_length - 2;
} &length=6;
type SSH2_Key_Exchange(is_orig: bool) = record {
@ -209,10 +210,10 @@ type SSH2_Key_Exchange(is_orig: bool) = record {
} &length=header.packet_length + 4;
type SSH2_Message(is_orig: bool, msg_type: uint8, length: uint32) = case msg_type of {
MSG_KEXINIT -> kexinit: SSH_KEXINIT(length, is_orig);
default -> unknown: bytestring &length=length;
MSG_KEXINIT -> kexinit : SSH_KEXINIT(length, is_orig);
default -> unknown : bytestring &length=length;
} &let {
detach: bool = $context.connection.update_state(ENCRYPTED, is_orig) &if(msg_type == MSG_NEWKEYS);
detach : bool = $context.connection.update_state(ENCRYPTED, is_orig) &if(msg_type == MSG_NEWKEYS);
};
type SSH_KEXINIT(length: uint32, is_orig: bool) = record {
@ -230,7 +231,7 @@ type SSH_KEXINIT(length: uint32, is_orig: bool) = record {
first_kex_packet_follows : uint8;
reserved : uint32;
} &let {
proc_kex : bool = $context.connection.update_kex(kex_algorithms.val, is_orig);
proc_kex : bool= $context.connection.update_kex(kex_algorithms.val, is_orig);
} &length=length;
# KEX_DH exchanges
@ -263,28 +264,28 @@ type SSH_Key_Exchange_DH_GEX_Message(is_orig: bool, msg_type: uint8, length: uin
};
type SSH_DH_GEX_REQUEST = record {
min: uint32;
min : uint32;
n : uint32;
max: uint32;
max : uint32;
} &length=12;
type SSH_DH_GEX_REQUEST_OLD = record {
n: uint32;
n : uint32;
} &length=4;
type SSH_DH_GEX_GROUP(length: uint32) = record {
p: ssh_string;
g: ssh_string;
p : ssh_string;
g : ssh_string;
} &length=length;
type SSH_DH_GEX_INIT(length: uint32) = record {
e: ssh_string;
e : ssh_string;
} &length=length;
type SSH_DH_GEX_REPLY(length: uint32) = record {
k_s : ssh_string;
f : ssh_string;
signature: ssh_string;
signature : ssh_string;
} &length=length;
# KEX_RSA exchanges
@ -302,16 +303,16 @@ type SSH_Key_Exchange_RSA_Message(is_orig: bool, msg_type: uint8, length: uint32
};
type SSH_RSA_PUBKEY(length: uint32) = record {
k_s: ssh_string;
k_t: ssh_string;
k_s : ssh_string;
k_t : ssh_string;
} &length=length;
type SSH_RSA_SECRET(length: uint32) = record {
encrypted_payload: ssh_string;
encrypted_payload : ssh_string;
} &length=length;
type SSH_RSA_DONE(length: uint32) = record {
signature: ssh_string;
signature : ssh_string;
} &length=length;
# KEX_GSS exchanges
@ -333,12 +334,12 @@ type SSH_Key_Exchange_GSS_Message(is_orig: bool, msg_type: uint8, length: uint32
};
type SSH_GSS_INIT(length: uint32) = record {
output_token: ssh_string;
output_token : ssh_string;
e : ssh_string;
} &length=length;
type SSH_GSS_CONTINUE(length: uint32) = record {
output_token: ssh_string;
output_token : ssh_string;
} &length=length;
type SSH_GSS_COMPLETE(length: uint32) = record {
@ -346,18 +347,18 @@ type SSH_GSS_COMPLETE(length: uint32) = record {
per_msg_token : ssh_string;
have_token : uint8;
parse_token : case have_token of {
0 -> no_token: empty;
default -> token: ssh_string;
0 -> no_token : empty;
default -> token : ssh_string;
};
} &length=length;
type SSH_GSS_HOSTKEY(length: uint32) = record {
k_s: ssh_string;
k_s : ssh_string;
} &length=length;
type SSH_GSS_ERROR(length: uint32) = record {
major_status: uint32;
minor_status: uint32;
major_status : uint32;
minor_status : uint32;
message : ssh_string;
language : ssh_string;
} &length=length;
@ -378,7 +379,7 @@ type SSH_Key_Exchange_ECC_Message(is_orig: bool, msg_type: uint8, length: uint32
# This deviates from the RFC. SSH_MSG_KEX_ECDH_INIT and
# SSH_MSG_KEX_ECMQV_INIT can be parsed the same way.
type SSH_ECC_INIT(length: uint32) = record {
q_c: ssh_string;
q_c : ssh_string;
};
# This deviates from the RFC. SSH_MSG_KEX_ECDH_REPLY and
@ -390,14 +391,14 @@ type SSH_ECC_REPLY(length: uint32) = record {
};
type ssh_string = record {
len: uint32;
val: bytestring &length=len;
len : uint32;
val : bytestring &length=len;
};
type ssh_host_key = record {
len: uint32;
key_type: ssh_string;
key: ssh_string;
len : uint32;
key_type : ssh_string;
key : ssh_string;
} &length=(len + 4);
## Done with types
@ -430,7 +431,7 @@ refine connection SSH_Conn += {
kex_algs_cache_.free();
%}
function get_state(is_orig: bool): int
function get_state(is_orig: bool) : int
%{
if ( is_orig )
{
@ -442,7 +443,7 @@ refine connection SSH_Conn += {
}
%}
function update_state(s: state, is_orig: bool): bool
function update_state(s: state, is_orig: bool) : bool
%{
if ( is_orig )
state_up_ = s;
@ -451,12 +452,12 @@ refine connection SSH_Conn += {
return true;
%}
function get_version(): int
function get_version() : int
%{
return version_;
%}
function update_version(v: bytestring, is_orig: bool): bool
function update_version(v: bytestring, is_orig: bool) : bool
%{
if ( is_orig && ( v.length() >= 4 ) )
{
@ -468,7 +469,7 @@ refine connection SSH_Conn += {
return true;
%}
function update_kex_state_if_equal(s: string, to_state: state): bool
function update_kex_state_if_equal(s: string, to_state: state) : bool
%{
if ( strcmp(c_str(kex_algorithm_), s.c_str()) == 0 )
{
@ -479,7 +480,7 @@ refine connection SSH_Conn += {
return false;
%}
function update_kex_state_if_startswith(s: string, to_state: state): bool
function update_kex_state_if_startswith(s: string, to_state: state) : bool
%{
if ( (uint) kex_algorithm_.length() < s.length() )
return false;
@ -493,7 +494,7 @@ refine connection SSH_Conn += {
return false;
%}
function update_kex(algs: bytestring, orig: bool): bool
function update_kex(algs: bytestring, orig: bool) : bool
%{
if ( !kex_seen_ )
{
@ -569,8 +570,6 @@ refine connection SSH_Conn += {
Unref(server_list);
return true;
%}
};