Label SMTP w/ STARTTLS as SMTPS *and* dissect TLS clho. (#1639)

* Label SMTP w/ STARTTLS as SMTPS *and* dissect TLS clho.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

* Revert "SMTP with STARTTLS is now identified as SMTPS"

This reverts commit 52d987b603f49d996b4060f43265d1cf43c3c482.

* Revert "Compilation fix"

This reverts commit c019946f601bf3b55f64f78841a0d696e6c0bfc5.

* Sync unit tests.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

2 files changed, 30 insertions, 16 deletions

diff --git a/src/lib/protocols/mail_smtp.c b/src/lib/protocols/mail_smtp.c
index fddd42b97..2b1ffd52f 100644
--- a/src/lib/protocols/mail_smtp.c
+++ b/src/lib/protocols/mail_smtp.c
@@ -30,6 +30,22 @@
 #include "ndpi_api.h"
 
 
+#define SMTP_BIT_220		0x01
+#define SMTP_BIT_250		0x02
+#define SMTP_BIT_235		0x04
+#define SMTP_BIT_334		0x08
+#define SMTP_BIT_354		0x10
+#define SMTP_BIT_HELO_EHLO	0x20
+#define SMTP_BIT_MAIL		0x40
+#define SMTP_BIT_RCPT		0x80
+#define SMTP_BIT_AUTH_LOGIN	0x100
+#define SMTP_BIT_STARTTLS	0x200
+#define SMTP_BIT_DATA		0x400
+#define SMTP_BIT_NOOP		0x800
+#define SMTP_BIT_RSET		0x1000
+#define SMTP_BIT_TlRM		0x2000
+#define SMTP_BIT_AUTH_PLAIN	0x4000
+
 /* #define SMTP_DEBUG 1 */
 
 extern int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
@@ -393,6 +409,13 @@ int ndpi_extra_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_st
     if (rc == 0 && memcmp(packet->payload, "220", 3) != 0)
     {
       flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
+      if (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) {
+        ndpi_set_detected_protocol(ndpi_struct, flow,
+                                   NDPI_PROTOCOL_MAIL_SMTPS, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+      } else {
+        ndpi_set_detected_protocol(ndpi_struct, flow,
+                                   flow->guessed_host_protocol_id, NDPI_PROTOCOL_MAIL_SMTPS, NDPI_CONFIDENCE_DPI);
+      }
     }
   } else {
     ndpi_search_mail_smtp_tcp(ndpi_struct, flow);
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 5cd74c0df..69bec44f5 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -855,10 +855,7 @@ int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
   case 0x02: /* Server Hello */
     processClientServerHello(ndpi_struct, flow, 0);
     flow->protos.tls_quic.hello_processed = 1;
-
-    ndpi_int_tls_add_connection(ndpi_struct, flow,
-				/* Check if this is a SMTP connection with STARTTLS or TLS */
-				(flow->l4.tcp.smtp_command_bitmask & SMTP_BIT_STARTTLS) ? NDPI_PROTOCOL_MAIL_SMTPS : NDPI_PROTOCOL_TLS);
+    ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS);
 
 #ifdef DEBUG_TLS
     printf("*** TLS [version: %02X][%s Hello]\n",
@@ -1246,8 +1243,7 @@ static void tlsCheckUncommonALPN(struct ndpi_detection_module_struct *ndpi_struc
 static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
 					struct ndpi_flow_struct *flow, u_int32_t protocol) {
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
-  u_int16_t upper_detected_protocol;
-    
+
 #if DEBUG_TLS
   printf("[TLS] %s()\n", __FUNCTION__);
 #endif
@@ -1262,17 +1258,12 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
     return;
   }
 
-  if(protocol != NDPI_PROTOCOL_TLS) {
-    if(flow->l4.tcp.smtp_command_bitmask & SMTP_BIT_STARTTLS)
-      upper_detected_protocol = flow->detected_protocol_stack[0];
-    else
-      upper_detected_protocol = protocol;
-  } else {
+  if(protocol != NDPI_PROTOCOL_TLS)
+    ;
+  else
     protocol = ndpi_tls_refine_master_protocol(ndpi_struct, flow, protocol);
-    upper_detected_protocol = protocol;
-  }
-  
-  ndpi_set_detected_protocol(ndpi_struct, flow, upper_detected_protocol, protocol, NDPI_CONFIDENCE_DPI);
+
+  ndpi_set_detected_protocol(ndpi_struct, flow, protocol, protocol, NDPI_CONFIDENCE_DPI);
 
   tlsInitExtraPacketProcessing(ndpi_struct, flow);
 }