Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-14 04:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Return of Robin's old SOCKS analyzer/decapsulator and tunnel code checkpoint.

Browse source 
- More discussion is needed to figure out how to integrate the SOCKS analyzer best.

- Tunnels framework now logs for the SOCKS analyzer.
This commit is contained in:
Seth Hall 2012-04-21 23:50:09 -04:00
parent dff3fabcea
commit e2da969415
15 changed files with 468 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

31
scripts/base/frameworks/dpd/dpd.sig
View file

@ -155,3 +155,34 @@ signature dpd_ssl_client {
# payload /^..\x11\x29/
# enable "ayiya"
#}
signature dpd_socks_client {
ip-proto == tcp
# '32' is a rather arbitrary max length for the user name.
payload /^\x04[\x01\x02].{0,32}\x00/
tcp-state originator
}
signature dpd_socks_server {
ip-proto == tcp
requires-reverse-signature dpd_socks_client
payload /^\x00[\x5a\x5b\x5c\x5d]/
tcp-state responder
enable "socks"
}
signature dpd_socks_reverse_client {
ip-proto == tcp
# '32' is a rather arbitrary max length for the user name.
payload /^\x04[\x01\x02].{0,32}\x00/
tcp-state responder
}
signature dpd_socks_reverse_server {
ip-proto == tcp
requires-reverse-signature dpd_socks_client
payload /^\x00[\x5a\x5b\x5c\x5d]/
tcp-state originator
enable "socks"
}