]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
krb5: add AS-REQ and TGS-REQ transactions
authorEloy Pérez González <zer1t0ps@protonmail.com>
Thu, 28 Apr 2022 10:40:56 +0000 (12:40 +0200)
committerVictor Julien <vjulien@oisf.net>
Thu, 11 May 2023 12:22:07 +0000 (14:22 +0200)
Fix bug in ticket #4529

rust/src/krb/krb5.rs

index bceae25519ff0248c10ce573c0c821ab5912758a..b550d1f99d474abea01a5edfee76ba83502e02a4 100644 (file)
@@ -132,6 +132,16 @@ impl KRB5State {
                 if hdr.class() != Class::Application { return 0; }
                 match hdr.tag().0 {
                     10 => {
+                        let req = krb5_parser::parse_as_req(i);
+                        if let Ok((_,kdc_req)) = req {
+                            let mut tx = self.new_tx(direction);
+                            tx.msg_type = MessageType::KRB_AS_REQ;
+                            tx.cname = kdc_req.req_body.cname;
+                            tx.realm = Some(kdc_req.req_body.realm);
+                            tx.sname = kdc_req.req_body.sname;
+                            tx.etype = None;
+                            self.transactions.push(tx);
+                        };
                         self.req_id = 10;
                     },
                     11 => {
@@ -152,6 +162,16 @@ impl KRB5State {
                         self.req_id = 0;
                     },
                     12 => {
+                        let req = krb5_parser::parse_tgs_req(i);
+                        if let Ok((_,kdc_req)) = req {
+                            let mut tx = self.new_tx(direction);
+                            tx.msg_type = MessageType::KRB_TGS_REQ;
+                            tx.cname = kdc_req.req_body.cname;
+                            tx.realm = Some(kdc_req.req_body.realm);
+                            tx.sname = kdc_req.req_body.sname;
+                            tx.etype = None;
+                            self.transactions.push(tx);
+                        };
                         self.req_id = 12;
                     },
                     13 => {