RDP: improve detection over UDP (#2043)

7 files changed, 95 insertions, 16 deletions

diff --git a/src/lib/protocols/rdp.c b/src/lib/protocols/rdp.c
index dfc47d72b..363f48628 100644
--- a/src/lib/protocols/rdp.c
+++ b/src/lib/protocols/rdp.c
@@ -33,7 +33,9 @@
 
 static void ndpi_int_rdp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
 					struct ndpi_flow_struct *flow) {
+  NDPI_LOG_INFO(ndpi_struct, "found RDP\n");
   ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RDP, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+  ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */
 }
 
 static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
@@ -49,10 +51,7 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
 	&& get_u_int8_t(packet->payload, 4) == packet->payload_packet_len - 5
 	&& get_u_int8_t(packet->payload, 5) == 0xe0
 	&& get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == 0 && get_u_int8_t(packet->payload, 10) == 0) {
-      NDPI_LOG_INFO(ndpi_struct, "found RDP\n");
-    rdp_found:
       ndpi_int_rdp_add_connection(ndpi_struct, flow);
-      ndpi_set_risk(ndpi_struct, flow, NDPI_DESKTOP_OR_FILE_SHARING_SESSION, "Found RDP"); /* Remote assistance */
       return;
     }
 
@@ -61,33 +60,62 @@ static void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct,
     u_int16_t s_port = ntohs(packet->udp->source);
     u_int16_t d_port = ntohs(packet->udp->dest);
 
+    /* Detection:
+       * initial syn/syn-ack pair for RDPUDP v1 & v2
+       * mid-flow (only v1) */
+
     if((packet->payload_packet_len >= 10) && ((s_port == RDP_PORT) || (d_port == RDP_PORT))) {
       if(s_port == RDP_PORT) {
 	/* Server -> Client */
-	if(flow->l4.udp.rdp_from_srv_pkts == 0)
-	  memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1;
-	else {
+	if(flow->l4.udp.rdp_from_srv_pkts == 0) {
+	  if(memcmp(packet->payload, flow->l4.udp.rdp_from_srv, 3) == 0 &&
+	     packet->payload_packet_len >= 16 &&
+	     (ntohs(get_u_int16_t(packet->payload, 6)) & 0x0003) && /* Flags: syn-ack */
+	     ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */
+	     ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */
+	    /* Initial "syn-ack" */
+	    ndpi_int_rdp_add_connection(ndpi_struct, flow);
+	    return;
+	  } else {
+	    /* Mid-flow session? */
+	    memcpy(flow->l4.udp.rdp_from_srv, packet->payload, 3), flow->l4.udp.rdp_from_srv_pkts = 1;
+	  }
+	} else {
 	  if(memcmp(flow->l4.udp.rdp_from_srv, packet->payload, 3) != 0)
 	    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 	  else {
 	    flow->l4.udp.rdp_from_srv_pkts = 2 /* stage 2 */;
-	    
-	    if(flow->l4.udp.rdp_to_srv_pkts == 2)
-	      goto rdp_found;
+
+	    if(flow->l4.udp.rdp_to_srv_pkts == 2) {
+	      ndpi_int_rdp_add_connection(ndpi_struct, flow);
+	      return;
+	    }
 	  }
 	}
       } else {
 	/* Client -> Server */
-	if(flow->l4.udp.rdp_to_srv_pkts == 0)
-	  memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1;
-	else {
+	if(flow->l4.udp.rdp_to_srv_pkts == 0) {
+	  if(get_u_int32_t(packet->payload, 0) == 0xFFFFFFFF &&
+	     packet->payload_packet_len >= 16 &&
+	     (ntohs(get_u_int16_t(packet->payload, 6)) & 0x0001) && /* Flags: syn */
+	     ntohs(get_u_int16_t(packet->payload, 12)) <= 1600 && /* Sensible values for upstream MTU */
+	     ntohs(get_u_int16_t(packet->payload, 14)) <= 1600) { /* Sensible values for downstream MTU */
+	    /* Initial "syn" */
+	    memcpy(flow->l4.udp.rdp_from_srv, packet->payload + 8, 3);
+	  } else {
+	    /* Mid-flow session? */
+	    memcpy(flow->l4.udp.rdp_to_srv, packet->payload, 3), flow->l4.udp.rdp_to_srv_pkts = 1;
+	  }
+	} else {
 	  if(memcmp(flow->l4.udp.rdp_to_srv, packet->payload, 3) != 0)
 	    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 	  else {
 	    flow->l4.udp.rdp_to_srv_pkts = 2 /* stage 2 */;
 	    
-	    if(flow->l4.udp.rdp_from_srv_pkts == 2)
-	      goto rdp_found;
+	    if(flow->l4.udp.rdp_from_srv_pkts == 2) {
+              ndpi_int_rdp_add_connection(ndpi_struct, flow);
+              return;
+	    }
 	  }
 	}
       }
diff --git a/tests/cfgs/default/pcap/rdp.pcap b/tests/cfgs/default/pcap/rdp.pcap
index 46b934027..59e3fa71c 100644
--- a/tests/cfgs/default/pcap/rdp.pcap
+++ b/tests/cfgs/default/pcap/rdp.pcap
diff --git a/tests/cfgs/default/pcap/rdp2.pcap b/tests/cfgs/default/pcap/rdp2.pcap
new file mode 100644
index 000000000..3daa036f9
--- /dev/null
+++ b/tests/cfgs/default/pcap/rdp2.pcap
diff --git a/tests/cfgs/default/pcap/rdp3.pcap b/tests/cfgs/default/pcap/rdp3.pcap
new file mode 100644
index 000000000..fe7921566
--- /dev/null
+++ b/tests/cfgs/default/pcap/rdp3.pcap
diff --git a/tests/cfgs/default/result/rdp.pcap.out b/tests/cfgs/default/result/rdp.pcap.out
index a83e8d311..9afad188f 100644
--- a/tests/cfgs/default/result/rdp.pcap.out
+++ b/tests/cfgs/default/result/rdp.pcap.out
@@ -20,6 +20,6 @@ Patricia risk mask:   2/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia protocols:   2/0 (search/found)
 
-RDP	2010	622743	1
+RDP	20	3658	1
 
-	1	TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][936 pkts/58890 bytes <-> 1074 pkts/563853 bytes][Goodput ratio: 30/92][7.55 sec][bytes ratio: -0.811 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 6/5 850/850 40/38][Pkt Len c2s/s2c min/avg/max/stddev: 44/44 63/525 622/1317 44/511][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 1,63,22,5,1,0,0,0,0,0,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0]
+	1	TCP 172.16.2.185:52494 <-> 192.168.2.142:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][13 pkts/1677 bytes <-> 7 pkts/1981 bytes][Goodput ratio: 64/84][0.37 sec][bytes ratio: -0.083 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/43 25/56 45/86 20/16][Pkt Len c2s/s2c min/avg/max/stddev: 44/56 129/283 616/1223 152/394][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (192.168.2.142)][Plen Bins: 16,16,16,16,0,8,0,0,0,8,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/cfgs/default/result/rdp2.pcap.out b/tests/cfgs/default/result/rdp2.pcap.out
new file mode 100644
index 000000000..7f5cce745
--- /dev/null
+++ b/tests/cfgs/default/result/rdp2.pcap.out
@@ -0,0 +1,26 @@
+Guessed flow protos:	0
+
+DPI Packets (UDP):	6	(3.00 pkts/flow)
+Confidence DPI              : 2 (flows)
+Num dissector calls: 261 (130.50 diss/flow)
+LRU cache ookla:      0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache zoom:       0/0/0 (insert/search/found)
+LRU cache stun:       0/0/0 (insert/search/found)
+LRU cache tls_cert:   0/0/0 (insert/search/found)
+LRU cache mining:     0/0/0 (insert/search/found)
+LRU cache msteams:    0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/0/0 (insert/search/found)
+Automa host:          0/0 (search/found)
+Automa domain:        0/0 (search/found)
+Automa tls cert:      0/0 (search/found)
+Automa risk mask:     0/0 (search/found)
+Automa common alpns:  0/0 (search/found)
+Patricia risk mask:   4/0 (search/found)
+Patricia risk:        0/0 (search/found)
+Patricia protocols:   4/0 (search/found)
+
+RDP	33	6343	2
+
+	1	UDP 10.50.181.210:60355 <-> 10.50.73.36:3389 [VLAN: 1108][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/1907 bytes <-> 3 pkts/1468 bytes][Goodput ratio: 90/90][0.13 sec][bytes ratio: 0.130 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 4/7 41/48 80/90 31/42][Pkt Len c2s/s2c min/avg/max/stddev: 199/64 477/489 1278/1278 463/558][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (drcsalgfc)][Plen Bins: 14,0,14,0,28,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,28,0,0,0,0,0,0,0,0,0]
+	2	UDP 10.8.37.100:51652 <-> 10.100.2.87:3389 [VLAN: 1308][proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 4][cat: RemoteAccess/12][12 pkts/1418 bytes <-> 14 pkts/1550 bytes][Goodput ratio: 60/58][0.73 sec][bytes ratio: -0.044 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 80/65 428/261 140/94][Pkt Len c2s/s2c min/avg/max/stddev: 64/60 118/111 384/148 82/26][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][Plen Bins: 19,46,19,11,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/cfgs/default/result/rdp3.pcap.out b/tests/cfgs/default/result/rdp3.pcap.out
new file mode 100644
index 000000000..38ea11883
--- /dev/null
+++ b/tests/cfgs/default/result/rdp3.pcap.out
@@ -0,0 +1,25 @@
+Guessed flow protos:	0
+
+DPI Packets (UDP):	2	(2.00 pkts/flow)
+Confidence DPI              : 1 (flows)
+Num dissector calls: 112 (112.00 diss/flow)
+LRU cache ookla:      0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache zoom:       0/0/0 (insert/search/found)
+LRU cache stun:       0/0/0 (insert/search/found)
+LRU cache tls_cert:   0/0/0 (insert/search/found)
+LRU cache mining:     0/0/0 (insert/search/found)
+LRU cache msteams:    0/0/0 (insert/search/found)
+LRU cache stun_zoom:  0/0/0 (insert/search/found)
+Automa host:          0/0 (search/found)
+Automa domain:        0/0 (search/found)
+Automa tls cert:      0/0 (search/found)
+Automa risk mask:     0/0 (search/found)
+Automa common alpns:  0/0 (search/found)
+Patricia risk mask:   2/0 (search/found)
+Patricia risk:        0/0 (search/found)
+Patricia protocols:   2/0 (search/found)
+
+RDP	6	5028	1
+
+	1	UDP 192.168.122.181:54759 <-> 192.168.122.2:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: RemoteAccess/12][4 pkts/2694 bytes <-> 2 pkts/2334 bytes][Goodput ratio: 94/96][1.76 sec][bytes ratio: 0.072 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/1649 550/1649 1011/1649 418/0][Pkt Len c2s/s2c min/avg/max/stddev: 184/1060 674/1167 1274/1274 494/107][Risk: ** Desktop/File Sharing **][Risk Score: 10][Risk Info: Found RDP][PLAIN TEXT (OKBI.HARDENING.COM)][Plen Bins: 0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0]