diff options
| author | Toni <matzeton@googlemail.com> | 2022-07-06 12:40:25 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-07-06 12:40:25 +0200 |
| commit | 175f863665ce9850398a415fc35ec4ee848b096f (patch) | |
| tree | 49b5c7b3b737f3a0edd378e6e9a14a36199c74bb /src/lib/protocols/mail_smtp.c | |
| parent | c019946f601bf3b55f64f78841a0d696e6c0bfc5 (diff) | |
Label SMTP w/ STARTTLS as SMTPS *and* dissect TLS clho. (#1639)
* Label SMTP w/ STARTTLS as SMTPS *and* dissect TLS clho.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Revert "SMTP with STARTTLS is now identified as SMTPS"
This reverts commit 52d987b603f49d996b4060f43265d1cf43c3c482.
* Revert "Compilation fix"
This reverts commit c019946f601bf3b55f64f78841a0d696e6c0bfc5.
* Sync unit tests.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'src/lib/protocols/mail_smtp.c')
| -rw-r--r-- | src/lib/protocols/mail_smtp.c | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/src/lib/protocols/mail_smtp.c b/src/lib/protocols/mail_smtp.c index fddd42b97..2b1ffd52f 100644 --- a/src/lib/protocols/mail_smtp.c +++ b/src/lib/protocols/mail_smtp.c @@ -30,6 +30,22 @@ #include "ndpi_api.h" +#define SMTP_BIT_220 0x01 +#define SMTP_BIT_250 0x02 +#define SMTP_BIT_235 0x04 +#define SMTP_BIT_334 0x08 +#define SMTP_BIT_354 0x10 +#define SMTP_BIT_HELO_EHLO 0x20 +#define SMTP_BIT_MAIL 0x40 +#define SMTP_BIT_RCPT 0x80 +#define SMTP_BIT_AUTH_LOGIN 0x100 +#define SMTP_BIT_STARTTLS 0x200 +#define SMTP_BIT_DATA 0x400 +#define SMTP_BIT_NOOP 0x800 +#define SMTP_BIT_RSET 0x1000 +#define SMTP_BIT_TlRM 0x2000 +#define SMTP_BIT_AUTH_PLAIN 0x4000 + /* #define SMTP_DEBUG 1 */ extern int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct, @@ -393,6 +409,13 @@ int ndpi_extra_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_st if (rc == 0 && memcmp(packet->payload, "220", 3) != 0) { flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1; + if (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) { + ndpi_set_detected_protocol(ndpi_struct, flow, + NDPI_PROTOCOL_MAIL_SMTPS, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); + } else { + ndpi_set_detected_protocol(ndpi_struct, flow, + flow->guessed_host_protocol_id, NDPI_PROTOCOL_MAIL_SMTPS, NDPI_CONFIDENCE_DPI); + } } } else { ndpi_search_mail_smtp_tcp(ndpi_struct, flow); |