Commit graph

28 commits

Author SHA1 Message Date
Johanna Amann
6d612ced3d Mark one-parameter constructors as explicit & use override where possible
This commit marks (hopefully) ever one-parameter constructor as explicit.

It also uses override in (hopefully) all circumstances where a virtual
method is overridden.

There are a very few other minor changes - most of them were necessary
to get everything to compile (like one additional constructor). In one
case I changed an implicit operation to an explicit string conversion -
I think the automatically chosen conversion was much more convoluted.

This took longer than I want to admit but not as long as I feared :)
2018-03-27 07:17:32 -07:00
Johanna Amann
9fd7816501 Allow File analyzers to direcly pass mime type.
This makes it much easier for protocols where the mime type is known in
advance like, for example, TLS. We now do no longer have to perform deep
script-level magic.
2017-02-10 17:03:33 -08:00
Seth Hall
eebd896f63 Change failure in utf16_bytestring_to_utf8_val to be a conn weird.
Whenever we saw errors in UTF16->UTF8 conversion before, we would
get a reporter message with no connection information.  Now we
get a weird attached to a connection so that debugging these
problems will hopefully be a bit easier in the future.
2016-08-17 00:57:49 -04:00
Seth Hall
c63bd17b5f Create a binpac function for converting UTF16 text to UTF8
- Abstracting a function from RDP and NTLM analyzers.
2016-04-03 23:59:02 -04:00
Johanna Amann
710409507c Fix FreeBSD build errors 2015-08-31 10:56:21 -07:00
Robin Sommer
f8323837fa Merge remote-tracking branch 'origin/topic/dnthayer/fix-rdp'
* origin/topic/dnthayer/fix-rdp:
  Fix initialization of a pointer in RDP analyzer
2015-08-31 10:35:19 -07:00
Daniel Thayer
587fac5924 Fix initialization of a pointer in RDP analyzer
A pointer to the end of a buffer was incorrectly being initialized
to a value beyond the end of the buffer.
2015-08-30 17:21:42 -05:00
Jon Siwek
5af997b32b Add missing .pac dependencies for some binpac analyzer targets. 2015-04-22 14:02:51 -05:00
Robin Sommer
27885e8f0d Attempt at fixing BIT-1337.
Can't say if this is the cause, but it could be.
2015-04-21 16:42:23 -07:00
Robin Sommer
cb767b9336 Merge remote-tracking branch 'origin/topic/jsiwek/bit-1343'
* origin/topic/jsiwek/bit-1343:
  BIT-1343: factor common ASN.1 code from RDP and SNMP analyzer.

BIT-1343 #merged
2015-04-21 13:46:26 -07:00
Jon Siwek
6af87dc2c8 BIT-1343: factor common ASN.1 code from RDP and SNMP analyzer. 2015-04-21 13:13:24 -05:00
Seth Hall
3335da67e0 Tiny spelling correction. 2015-04-09 11:08:13 -04:00
Jon Siwek
ffbeafb549 Fix Coverity warning in RDP analyzer. 2015-04-06 10:12:08 -05:00
Jon Siwek
32ae94de9a Merge remote-tracking branch 'origin/topic/seth/rdp'
* origin/topic/seth/rdp: (31 commits)
  Improved transition into SSL/TLS from RDP.
  Fixes tests in RDP branch.
  add a special case to the X509 code that deals with RDP certificates.
  A few more changes to handling encryption in RDP.
  Adds some comments and fixes a broxygen warning.
  Fixes another optional part of an RDP unit.
  Support RDP negotiation requests optionally and support zero length cookies.
  Changed UTF-16 to UTF-8 conversion to be more lenient.
  Fixed an issue with parse failure on an optional field.
  Removing a stray printf from RDP analyzer.
  Another big RDP update.
  New script to add a field to rdp.log when the connection is upgraded to SSL.
  Huge updates to the RDP analyzer from Josh Liburdi.
  FreeRDP test trace showing SSL encryption -- RDP analyzer does not currently handle this and SSL analyzer does not identify it either
  Wireshark test trace for native encryption -- generates a binpac error
  Delete RDP-004.pcap
  Delete nla_win7_win2k8r2.pcap
  Update dpd.sig
  Fixed typo
  Added check for connection existence
  ...

BIT-1340 #merged
2015-03-30 17:10:04 -05:00
Seth Hall
371cf10c86 Improved transition into SSL/TLS from RDP. 2015-03-05 16:57:58 -05:00
Seth Hall
276e072e6e A few more changes to handling encryption in RDP. 2015-03-05 13:38:54 -05:00
Seth Hall
b92a68e2bd Adds some comments and fixes a broxygen warning. 2015-03-05 11:37:37 -05:00
Seth Hall
6909d0de87 Fixes another optional part of an RDP unit. 2015-03-05 03:02:19 -05:00
Seth Hall
374ac42814 Support RDP negotiation requests optionally and support zero length cookies. 2015-03-05 02:48:21 -05:00
Seth Hall
b4e3fbc9e7 Changed UTF-16 to UTF-8 conversion to be more lenient.
- This seems to solve the occasional problems with strings not
   getting converted.
2015-03-05 02:30:32 -05:00
Seth Hall
d59d0b57c1 Fixed an issue with parse failure on an optional field.
- Quite a bit more of this needs to happen.
2015-03-05 02:23:35 -05:00
Seth Hall
e05bebc5fb Removing a stray printf from RDP analyzer. 2015-03-05 02:10:11 -05:00
Seth Hall
f45e057779 Another big RDP update.
- New fields for certificate type, number of certificates,
   if certificates are permanent on the server, and the selected
   security protocol.
 - Fixed some issues with X.509 certificate handling over RDP
   (the event handler wasn't sufficiently constrained).
 - Better detection of and transition into encrypted mode.  No more
   binpac parse failures from the test traces anymore!
 - Some event name clean up and new events.
 - X.509 Certificate chains are now handled correctly (was only grabbing
   a single certificate).
2015-03-05 01:15:12 -05:00
Seth Hall
bbedb73a45 Huge updates to the RDP analyzer from Josh Liburdi.
- More data pulled into scriptland.
  - Logs expanded with client screen resolution and desired color depth.
  - Values in UTF-16 on the wire are converted to UTF-8 before being
    sent to scriptland.
  - If the RDP turns into SSL records, we now pass data that appears
    to be SSL to the PIA analyzer.
  - If RDP uses native encryption with X.509 certs we pass those
    certs to the files framework and the base scripts pass them forward
    to the X.509 analyzer.
  - Lots of cleanup and adjustment to fit the documented protocol
    a bit better.
  - Cleaned up the DPD signatures.
  - Moved to flowunit instead of datagram.
  - Added tests.
2015-03-04 13:12:03 -05:00
Josh Liburdi
b1614b7fe9 Modified how cookie value is handled 2015-02-15 22:45:16 -08:00
Josh Liburdi
0ef8a106df Moved DPD to each individual event process 2015-02-15 22:44:00 -08:00
Josh Liburdi
fd655aa85d Removed debug code for SSL 2015-02-15 09:24:28 -08:00
Josh Liburdi
46713fb5c7 Init RDP analyzer 2015-02-14 13:16:48 -08:00