{"action":"created","issue":{"url":"https://api.github.com/repos/OISF/suricata/issues/3264","repository_url":"https://api.github.com/repos/OISF/suricata","labels_url":"https://api.github.com/repos/OISF/suricata/issues/3264/labels{/name}","comments_url":"https://api.github.com/repos/OISF/suricata/issues/3264/comments","events_url":"https://api.github.com/repos/OISF/suricata/issues/3264/events","html_url":"https://github.com/OISF/suricata/pull/3264","id":301984992,"number":3264,"title":"[RFC] Add ikev2 parser v01","user":{"login":"chifflier","id":308574,"avatar_url":"https://avatars2.githubusercontent.com/u/308574?v=4","gravatar_id":"","url":"https://api.github.com/users/chifflier","html_url":"https://github.com/chifflier","followers_url":"https://api.github.com/users/chifflier/followers","following_url":"https://api.github.com/users/chifflier/following{/other_user}","gists_url":"https://api.github.com/users/chifflier/gists{/gist_id}","starred_url":"https://api.github.com/users/chifflier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chifflier/subscriptions","organizations_url":"https://api.github.com/users/chifflier/orgs","repos_url":"https://api.github.com/users/chifflier/repos","events_url":"https://api.github.com/users/chifflier/events{/privacy}","received_events_url":"https://api.github.com/users/chifflier/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-03T09:48:45Z","updated_at":"2018-03-06T08:03:34Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/OISF/suricata/pulls/3264","html_url":"https://github.com/OISF/suricata/pull/3264","diff_url":"https://github.com/OISF/suricata/pull/3264.diff","patch_url":"https://github.com/OISF/suricata/pull/3264.patch"},"body":"Make sure these boxes are signed before submitting your Pull Request -- thank you.\r\n\r\n- [X] I have read the contributing guide lines at https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing\r\n- [X] I have signed the Open Information Security Foundation contribution agreement at https://suricata-ids.org/about/contribution-agreement/\r\n- [X] I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)\r\n\r\nThis PR adds support for a new protocol, IKEv2 (used for IPsec key exchange, RFC 7296).\r\n- It follows the first messages exchanged on UDP port 500 to extract the handshake parameters. The client sends a list of proposals, the parameters are chosen by the server\r\n- It is written in rust, and uses the crate `ipsec-parser` to decode the messages.\r\n- It adds a logger for the handshake parameters (SPIs, exchange type, cryptographic parameters, notify messages, etc.) in JSON format\r\n- It adds new rules for IKEv2 events: decoding errors, weak cryptographic proposals (deprecated encryption ciphers, small DH groups, etc.).\r\n\r\nExample of JSON output (only \"ikev2\" key):\r\n``\r\n{\"version_major\":2,\"version_minor\":0,\"exchange_type\":34,\"message_id\":0,\"init_spi\":\"729d50d0d8008dc1\",\"resp_spi\":\"31713cfe052ad2fe\",\"role\":\"responder\",\"alg_enc\":\"ENCR_AES_GCM_16\",\"alg_auth\":\"NONE\",\"alg_prf\":\"PRF_HMAC_SHA2_256\",\"alg_dh\":\"brainpoolP512r1\",\"alg_esn\":\"NoESN\",\"errors\":0,\"payload_list\":\"SecurityAssociation,KeyExchange,Nonce,Notify,Notify,CertificateRequest,Notify,Notify,NoNextPayload\",\"notify_list\":\"NAT_DETECTION_SOURCE_IP,NAT_DETECTION_DESTINATION_IP,IKEV2_FRAGMENTATION_SUPPORTED,MULTIPLE_AUTH_SUPPORTED\"}}\r\n``\r\n\r\nThe following is planned for the future:\r\n- when NAT-T is enabled, some key exchange messages are encapsulated and sent on port 4500/udp.  The same parser can be reused for this port, with some changes to ignore ESP data\r\n- the list of deprecated/weak algorithm parameters could be a configuration/data file provided to the configuration. This would allow sharing rules with TLS, for ex."},"comment":{"url":"https://api.github.com/repos/OISF/suricata/issues/comments/370696313","html_url":"https://github.com/OISF/suricata/pull/3264#issuecomment-370696313","issue_url":"https://api.github.com/repos/OISF/suricata/issues/3264","id":370696313,"user":{"login":"chifflier","id":308574,"avatar_url":"https://avatars2.githubusercontent.com/u/308574?v=4","gravatar_id":"","url":"https://api.github.com/users/chifflier","html_url":"https://github.com/chifflier","followers_url":"https://api.github.com/users/chifflier/followers","following_url":"https://api.github.com/users/chifflier/following{/other_user}","gists_url":"https://api.github.com/users/chifflier/gists{/gist_id}","starred_url":"https://api.github.com/users/chifflier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chifflier/subscriptions","organizations_url":"https://api.github.com/users/chifflier/orgs","repos_url":"https://api.github.com/users/chifflier/repos","events_url":"https://api.github.com/users/chifflier/events{/privacy}","received_events_url":"https://api.github.com/users/chifflier/received_events","type":"User","site_admin":false},"created_at":"2018-03-06T08:03:34Z","updated_at":"2018-03-06T08:03:34Z","author_association":"CONTRIBUTOR","body":"I pushed a (small) update to documentation (given that there are only events, no new keywords yet). Please tell me if there is I need to add more things"}}
{"actor":{"display_login":"chifflier"}}