diff options
| author | Ravi Kerur <ravi.kerur@viasat.com> | 2019-09-28 19:52:53 -0700 |
|---|---|---|
| committer | Ravi Kerur <ravi.kerur@viasat.com> | 2019-09-28 19:52:53 -0700 |
| commit | bc1b26617430fcc15bacd1324758ca18ae38adf1 (patch) | |
| tree | 5340bde318803c46bbcbba3f9df3be86f1134acb | |
| parent | b0c68dc29b18566043d7dd3bfd690cfe5c4e5d77 (diff) | |
Add Cisco anyconnect VPN signature.
Signed-off-by: Ravi Kerur <ravi.kerur@viasat.com>
| -rw-r--r-- | src/lib/ndpi_main.c | 2 | ||||
| -rw-r--r-- | src/lib/protocols/ciscovpn.c | 28 | ||||
| -rw-r--r-- | tests/pcap/anyconnect-vpn.pcap | bin | 0 -> 1065223 bytes |
3 files changed, 28 insertions, 2 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index dbcea0f42..44963d183 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1555,7 +1555,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CISCOVPN, 0 /* can_have_a_subprotocol */, no_master, no_master, "CiscoVPN", NDPI_PROTOCOL_CATEGORY_VPN, - ndpi_build_default_ports(ports_a, 10000, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_a, 10000, 8008, 8009, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 10000, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TEAMSPEAK, 0 /* can_have_a_subprotocol */, no_master, diff --git a/src/lib/protocols/ciscovpn.c b/src/lib/protocols/ciscovpn.c index d98f91e02..4a73e5728 100644 --- a/src/lib/protocols/ciscovpn.c +++ b/src/lib/protocols/ciscovpn.c @@ -48,7 +48,33 @@ void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, stru NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); return; - } + } + else if(((tsport == 443 || tdport == 443) || + (tsport == 80 || tdport == 80)) && + ((packet->payload[0] == 0x17 && + packet->payload[1] == 0x03 && + packet->payload[2] == 0x03 && + packet->payload[3] == 0x00 && + packet->payload[4] == 0x3A))) + { + /* TLS signature of Cisco AnyConnect 0X170303003A */ + NDPI_LOG_INFO(ndpi_struct, "found CISCO Anyconnect VPN\n"); + ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); + return; + } + else if(((tsport == 8009 || tdport == 8009) || + (tsport == 8008 || tdport == 8008)) && + ((packet->payload[0] == 0x17 && + packet->payload[1] == 0x03 && + packet->payload[2] == 0x03 && + packet->payload[3] == 0x00 && + packet->payload[4] == 0x69))) + { + /* TCP signature of Cisco AnyConnect 0X1703030069 */ + NDPI_LOG_INFO(ndpi_struct, "found CISCO Anyconnect VPN\n"); + ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); + return; + } else if( ( (usport == 10000 && udport == 10000) diff --git a/tests/pcap/anyconnect-vpn.pcap b/tests/pcap/anyconnect-vpn.pcap Binary files differnew file mode 100644 index 000000000..0a1f99dc3 --- /dev/null +++ b/tests/pcap/anyconnect-vpn.pcap |