aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIvan Nardi <12729895+IvanNardi@users.noreply.github.com>2022-07-30 22:57:20 +0200
committerGitHub <noreply@github.com>2022-07-30 22:57:20 +0200
commit2a596c79e6df7f78dea6ee3b581b4ed99d48bd7b (patch)
tree9479d3fa6c0be8761f091a57b11fe323ab02b2c8
parent8b6a00f84bff9c998643d823502ae9f924fce528 (diff)
HTTP: fix classification (#1692)
If we have a valid HTTP sessions, we should ignore `flow->guessed_protocol_id` field (i.e. classification "by-port") altogheter. The attached trace was classified as "SIP/HTTP" only because the *client* port was 5060... As a general rule, having a classification such as "XXXX/HTTP" is *extremely* suspicious.
Diffstat
-rw-r--r--src/lib/protocols/http.c5
-rw-r--r--tests/pcap/http_on_sip_port.pcapbin0 -> 2080 bytes
-rw-r--r--tests/result/anyconnect-vpn.pcap.out6
-rw-r--r--tests/result/http_on_sip_port.pcap.out24
4 files changed, 30 insertions, 5 deletions
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 6e2cf924b..48a80dd9a 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -759,9 +759,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
if(flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN) {
/* Avoid putting as subprotocol a "core" protocol such as SSL or DNS */
if(ndpi_struct->proto_defaults[flow->guessed_protocol_id].subprotocol_count == 0) {
- flow->detected_protocol_stack[1] = flow->guessed_protocol_id;
- if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN)
+ if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id;
+ flow->detected_protocol_stack[1] = flow->guessed_protocol_id;
+ }
}
}
else {
diff --git a/tests/pcap/http_on_sip_port.pcap b/tests/pcap/http_on_sip_port.pcap
new file mode 100644
index 000000000..dc08d99b5
--- /dev/null
+++ b/tests/pcap/http_on_sip_port.pcap
Binary files differ
diff --git a/tests/result/anyconnect-vpn.pcap.out b/tests/result/anyconnect-vpn.pcap.out
index 0e5e9bac3..7792ad51d 100644
--- a/tests/result/anyconnect-vpn.pcap.out
+++ b/tests/result/anyconnect-vpn.pcap.out
@@ -1,6 +1,6 @@
Guessed flow protos: 12
-DPI Packets (TCP): 161 (7.32 pkts/flow)
+DPI Packets (TCP): 163 (7.41 pkts/flow)
DPI Packets (UDP): 82 (2.22 pkts/flow)
DPI Packets (other): 10 (1.00 pkts/flow)
Confidence Unknown : 2 (flows)
@@ -18,7 +18,7 @@ LRU cache msteams: 0/0/0 (insert/search/found)
Automa host: 107/16 (search/found)
Automa domain: 69/0 (search/found)
Automa tls cert: 4/0 (search/found)
-Automa risk mask: 9/0 (search/found)
+Automa risk mask: 10/0 (search/found)
Automa common alpns: 2/2 (search/found)
Patricia risk mask: 116/0 (search/found)
Patricia risk: 0/0 (search/found)
@@ -60,7 +60,7 @@ JA3 Host Stats:
9 ICMPV6 [fe80::2e7e:81ff:feb0:4aa1]:0 -> [ff02::1]:0 [proto: 102/ICMPV6][ClearText][Confidence: DPI][cat: Network/14][16 pkts/2784 bytes -> 0 pkts/0 bytes][Goodput ratio: 64/0][45.47 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2867/0 3028/0 3072/0 84/0][Pkt Len c2s/s2c min/avg/max/stddev: 174/0 174/0 174/0 0/0][Plen Bins: 0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
10 TCP 10.0.0.227:56955 <-> 10.0.0.151:8060 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: Web/5][6 pkts/650 bytes <-> 5 pkts/1668 bytes][Goodput ratio: 37/80][4.02 sec][Hostname/SNI: 10.0.0.151][bytes ratio: -0.439 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/2 4/4 9/6 3/2][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 108/334 308/1206 89/442][URL: 10.0.0.151:8060/dial/dd.xml][StatusCode: 200][Content-Type: text/xml][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36][Risk: ** Known Proto on Non Std Port **** HTTP Numeric IP Address **][Risk Score: 60][Risk Info: Found host 10.0.0.151][PLAIN TEXT (GET /dial/dd.xml HTTP/1.1)][Plen Bins: 0,0,0,0,0,33,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0]
11 TCP 10.0.0.227:56917 <-> 184.25.56.77:80 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: ConnCheck/30][6 pkts/976 bytes <-> 4 pkts/1032 bytes][Goodput ratio: 62/74][18.47 sec][Hostname/SNI: detectportal.firefox.com][bytes ratio: -0.028 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 28/573 3694/6151 10081/10078 4344/4052][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 163/258 368/450 145/192][URL: detectportal.firefox.com/success.txt][StatusCode: 200][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:69.0) Gecko/20100101 Firefox/69.0][PLAIN TEXT (GET /success.txt HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,50,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 12 TCP 10.0.0.227:56954 <-> 10.0.0.149:8008 [proto: 161.7/CiscoVPN.HTTP][Encrypted][Confidence: DPI][cat: Web/5][4 pkts/527 bytes <-> 3 pkts/1401 bytes][Goodput ratio: 48/85][0.01 sec][Hostname/SNI: 10.0.0.149][bytes ratio: -0.453 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/3 2/3 6/3 3/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 132/467 317/1261 107/561][URL: 10.0.0.149:8008/ssdp/device-desc.xml][StatusCode: 0][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36][Risk: ** HTTP Numeric IP Address **][Risk Score: 10][Risk Info: Found host 10.0.0.149][PLAIN TEXT (HGET /ssdp/device)][Plen Bins: 0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0]
+ 12 TCP 10.0.0.227:56954 <-> 10.0.0.149:8008 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: Web/5][4 pkts/527 bytes <-> 3 pkts/1401 bytes][Goodput ratio: 48/85][0.01 sec][Hostname/SNI: 10.0.0.149][bytes ratio: -0.453 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/3 2/3 6/3 3/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 132/467 317/1261 107/561][URL: 10.0.0.149:8008/ssdp/device-desc.xml][StatusCode: 200][Content-Type: application/xml][User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.90 Safari/537.36][Risk: ** Known Proto on Non Std Port **** HTTP Numeric IP Address **][Risk Score: 60][Risk Info: Found host 10.0.0.149 / Expected on port 80][PLAIN TEXT (HGET /ssdp/device)][Plen Bins: 0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0]
13 UDP [fe80::408:3e45:3abc:1552]:5353 -> [ff02::fb]:5353 [proto: 8/MDNS][ClearText][Confidence: DPI][cat: Network/14][9 pkts/1628 bytes -> 0 pkts/0 bytes][Goodput ratio: 66/0][25.40 sec][Hostname/SNI: _raop._tcp.local][_raop._tcp.local][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 819/0 3174/0 11263/0 3646/0][Pkt Len c2s/s2c min/avg/max/stddev: 152/0 181/0 206/0 24/0][PLAIN TEXT (companion)][Plen Bins: 0,0,33,22,44,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
14 UDP 10.0.0.227:137 -> 10.0.0.255:137 [proto: 10/NetBIOS][ClearText][Confidence: DPI][cat: System/18][15 pkts/1542 bytes -> 0 pkts/0 bytes][Goodput ratio: 59/0][6.05 sec][Hostname/SNI: lp-rkerur-osx][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 465/0 1499/0 677/0][Pkt Len c2s/s2c min/avg/max/stddev: 92/0 103/0 110/0 9/0][PLAIN TEXT ( EMFACNFCELEFFC)][Plen Bins: 0,40,60,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
15 TCP 10.0.0.227:56914 <-> 52.37.243.173:443 [proto: 91.265/TLS.AmazonAWS][Encrypted][Confidence: DPI][cat: Cloud/13][8 pkts/847 bytes <-> 7 pkts/651 bytes][Goodput ratio: 38/29][21.75 sec][bytes ratio: 0.131 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 35/1 3340/2605 9634/9670 4130/3611][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 106/93 131/129 31/31][Plen Bins: 0,75,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/result/http_on_sip_port.pcap.out b/tests/result/http_on_sip_port.pcap.out
new file mode 100644
index 000000000..e81d61583
--- /dev/null
+++ b/tests/result/http_on_sip_port.pcap.out
@@ -0,0 +1,24 @@
+Guessed flow protos: 0
+
+DPI Packets (TCP): 4 (4.00 pkts/flow)
+Confidence DPI : 1 (flows)
+Num dissector calls: 16 (16.00 diss/flow)
+LRU cache ookla: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache zoom: 0/0/0 (insert/search/found)
+LRU cache stun: 0/0/0 (insert/search/found)
+LRU cache tls_cert: 0/0/0 (insert/search/found)
+LRU cache mining: 0/0/0 (insert/search/found)
+LRU cache msteams: 0/0/0 (insert/search/found)
+Automa host: 2/0 (search/found)
+Automa domain: 1/0 (search/found)
+Automa tls cert: 0/0 (search/found)
+Automa risk mask: 1/0 (search/found)
+Automa common alpns: 0/0 (search/found)
+Patricia risk mask: 2/0 (search/found)
+Patricia risk: 2/0 (search/found)
+Patricia protocols: 4/0 (search/found)
+
+HTTP 4 1831 1
+
+ 1 TCP 82.178.111.221:5060 <-> 45.58.148.2:8888 [proto: 7/HTTP][ClearText][Confidence: DPI][cat: Web/5][2 pkts/351 bytes <-> 2 pkts/1480 bytes][Goodput ratio: 63/92][0.32 sec][Hostname/SNI: 45.58.148.2][URL: 45.58.148.2/star-123456/index.m3u8?token=89b198b8844824ca15b8b379c26fc1b7dfcba368-5KUJTJ5Y73AGIAOV-1618753174-1618742374][StatusCode: 403][User-Agent: exoplayer-codelab][Risk: ** Known Proto on Non Std Port **** HTTP Numeric IP Address **][Risk Score: 60][Risk Info: Found host 45.58.148.2 / Expected on port 80][PLAIN TEXT (GET /star)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0]
Powered by cgit, Themed by Ted Yin.