diff options
| author | Michele Campus <fci1908@gmail.com> | 2016-08-28 01:05:08 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-08-28 01:05:08 +0200 |
| commit | 7364fcc7dfdff86fd7e5225f2ff2eda9d14646ab (patch) | |
| tree | d33ad6c3f5f3708087a3ab5fe0fa6a9af68ed649 | |
| parent | 210602476f52a8487bfc62b3e09304890f68edd6 (diff) | |
| parent | 562b90d93cdf20931c9a31686aad1ed8eea49013 (diff) | |
Merge pull request #255 from emanuele-f/openvpn
Fix openvpn with multiple hard_reset_client not being recognized
| -rw-r--r-- | src/lib/protocols/openvpn.c | 22 | ||||
| -rw-r--r-- | tests/pcap/openvpn.pcap | bin | 31811 -> 61903 bytes | |||
| -rw-r--r-- | tests/result/openvpn.pcap.out | 5 |
3 files changed, 18 insertions, 9 deletions
diff --git a/src/lib/protocols/openvpn.c b/src/lib/protocols/openvpn.c index f13b274c8..3e8412355 100644 --- a/src/lib/protocols/openvpn.c +++ b/src/lib/protocols/openvpn.c @@ -35,6 +35,7 @@ #define P_HMAC_160 20 // (RSA-|DSA-)SHA(1), ..others, SHA1 is openvpn default #define P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) (9 + hmac_size) #define P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size) (P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) + 8) +#define P_HARD_RESET_CLIENT_MAX_COUNT 5 static inline u_int32_t get_packet_id(const u_int8_t * payload, u_int8_t hms) { return ntohl(*(u_int32_t*)(payload + P_HARD_RESET_PACKET_ID_OFFSET(hms))); @@ -57,6 +58,7 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct, u_int8_t opcode; u_int8_t alen; int8_t hmac_size; + int8_t failed = 0; if (packet->payload_packet_len >= 40) { // skip openvpn TCP transport packet size @@ -65,7 +67,7 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct, opcode = ovpn_payload[0] & P_OPCODE_MASK; - if (flow->ovpn_counter == 0 && (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || + if (flow->ovpn_counter < P_HARD_RESET_CLIENT_MAX_COUNT && (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || opcode == P_CONTROL_HARD_RESET_CLIENT_V2)) { if (check_pkid_and_detect_hmac_size(ovpn_payload) > 0) { @@ -76,8 +78,8 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct, flow->ovpn_session_id[0], flow->ovpn_session_id[1], flow->ovpn_session_id[2], flow->ovpn_session_id[3], flow->ovpn_session_id[4], flow->ovpn_session_id[5], flow->ovpn_session_id[6], flow->ovpn_session_id[7]); } - } else if (flow->ovpn_counter == 1 && (opcode == P_CONTROL_HARD_RESET_SERVER_V1 || - opcode == P_CONTROL_HARD_RESET_SERVER_V2)) { + } else if (flow->ovpn_counter >= 1 && flow->ovpn_counter <= P_HARD_RESET_CLIENT_MAX_COUNT && + (opcode == P_CONTROL_HARD_RESET_SERVER_V1 || opcode == P_CONTROL_HARD_RESET_SERVER_V2)) { hmac_size = check_pkid_and_detect_hmac_size(ovpn_payload); @@ -87,16 +89,22 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct, if (memcmp(flow->ovpn_session_id, session_remote, 8) == 0) ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENVPN, NDPI_PROTOCOL_UNKNOWN); - else + else { NDPI_LOG(NDPI_PROTOCOL_OPENVPN, ndpi_struct, NDPI_LOG_DEBUG, "key mismatch: %02x%02x%02x%02x%02x%02x%02x%02x\n", session_remote[0], session_remote[1], session_remote[2], session_remote[3], session_remote[4], session_remote[5], session_remote[6], session_remote[7]); - } - } else if (flow->ovpn_counter >= 2) - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OPENVPN); + failed = 1; + } + } else + failed = 1; + } else + failed = 1; flow->ovpn_counter++; + + if (failed) + NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OPENVPN); } } diff --git a/tests/pcap/openvpn.pcap b/tests/pcap/openvpn.pcap Binary files differindex d0448afcc..9ae8351a1 100644 --- a/tests/pcap/openvpn.pcap +++ b/tests/pcap/openvpn.pcap diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out index 7f6a21fbc..81d959dc1 100644 --- a/tests/result/openvpn.pcap.out +++ b/tests/result/openvpn.pcap.out @@ -1,4 +1,5 @@ -OpenVPN 178 28939 2 +OpenVPN 298 57111 3 1 UDP 192.168.43.12:41507 <-> 139.59.151.137:13680 [proto: 159/OpenVPN][83 pkts/13559 bytes] - 2 TCP 192.168.1.77:60140 <-> 46.101.231.218:443 [proto: 159/OpenVPN][95 pkts/15380 bytes] + 2 UDP 192.168.43.18:13680 <-> 139.59.151.137:13680 [proto: 159/OpenVPN][120 pkts/28172 bytes] + 3 TCP 192.168.1.77:60140 <-> 46.101.231.218:443 [proto: 159/OpenVPN][95 pkts/15380 bytes] |