diff options
| author | Toni <matzeton@googlemail.com> | 2022-07-05 16:35:23 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-07-05 16:35:23 +0200 |
| commit | f4a1739f9c950963f94915916d0a9f088a803abc (patch) | |
| tree | a9d56561dea8e1942085da181711b3591833e78b /src/lib/ndpi_main.c | |
| parent | 388dfb8e1309d1998aa9e16a85b33041f9008035 (diff) | |
Detect SMTPs w/ STARTTLS as TLS and dissect client/server hello. Fixes #1630. (#1637)
* FTP needs to get updated as well as it has similiar STARTTLS semantics -> follow-up
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'src/lib/ndpi_main.c')
| -rw-r--r-- | src/lib/ndpi_main.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 481d1fbbc..47385de70 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -8034,7 +8034,9 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp switch(proto) { case NDPI_PROTOCOL_TLS: case NDPI_PROTOCOL_DTLS: - if(flow->l4.tcp.tls.certificate_processed) return(0); + if(flow->l4.tcp.tls.certificate_processed || + (flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 1 && + flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 1)) return(0); if(flow->l4.tcp.tls.num_tls_blocks <= ndpi_str->num_tls_blocks_to_follow) { // printf("*** %u/%u\n", flow->l4.tcp.tls.num_tls_blocks, ndpi_str->num_tls_blocks_to_follow); @@ -8058,8 +8060,8 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp case NDPI_PROTOCOL_MAIL_IMAP: case NDPI_PROTOCOL_MAIL_SMTP: if(flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0' && - flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 0 && - flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 0) + (flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 1 || + flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 0)) return(1); break; |