mirror of
https://github.com/zeek/zeek.git
synced 2025-10-02 06:38:20 +00:00
d6ca1ec4f6
The server replies with \x05 and identifier for the chosen method. Not quite sure what the previous signature meant capture. See also: https://datatracker.ietf.org/doc/html/rfc1928#section-3 Closes #3099.
46 lines
1.1 KiB
Standard ML
46 lines
1.1 KiB
Standard ML
signature dpd_socks4_client {
|
|
ip-proto == tcp
|
|
# '32' is a rather arbitrary max length for the user name.
|
|
payload /^\x04[\x01\x02].{0,32}\x00/
|
|
tcp-state originator
|
|
}
|
|
|
|
signature dpd_socks4_server {
|
|
ip-proto == tcp
|
|
requires-reverse-signature dpd_socks4_client
|
|
payload /^\x00[\x5a\x5b\x5c\x5d]/
|
|
tcp-state responder
|
|
enable "socks"
|
|
}
|
|
|
|
signature dpd_socks4_reverse_client {
|
|
ip-proto == tcp
|
|
# '32' is a rather arbitrary max length for the user name.
|
|
payload /^\x04[\x01\x02].{0,32}\x00/
|
|
tcp-state responder
|
|
}
|
|
|
|
signature dpd_socks4_reverse_server {
|
|
ip-proto == tcp
|
|
requires-reverse-signature dpd_socks4_reverse_client
|
|
payload /^\x00[\x5a\x5b\x5c\x5d]/
|
|
tcp-state originator
|
|
enable "socks"
|
|
}
|
|
|
|
signature dpd_socks5_client {
|
|
ip-proto == tcp
|
|
# Watch for a few authentication methods to reduce false positives.
|
|
payload /^\x05.[\x00\x01\x02]/
|
|
tcp-state originator
|
|
}
|
|
|
|
signature dpd_socks5_server {
|
|
ip-proto == tcp
|
|
requires-reverse-signature dpd_socks5_client
|
|
# Watch for a single authentication method to be chosen by the server or
|
|
# the server to indicate the no authentication is required.
|
|
payload /^\x05[\x00\x01\x02\xff]/
|
|
tcp-state responder
|
|
enable "socks"
|
|
}
|