diff options
| author | pacant <pacant2@gmail.com> | 2021-07-14 11:13:22 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-07-14 11:13:22 +0200 |
| commit | 19a29e1e228f4a821c7ce89be064f70d80f4282a (patch) | |
| tree | 20eab205da8fff9108fe83ee8a088f92ef02f553 /src/lib | |
| parent | c411df523e7e418a9bd9074768308e86370f5aa4 (diff) | |
TLS Risks - Certificate Validity Too Long (#1239)
* Added flow risk: TLS certificate too long
* Added flow risk: TLS certificate too long
* Date for TLS limit added
* TLS certificate check fixed
Co-authored-by: pacant <a.pace97@outlook.com>
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/ndpi_main.c | 1 | ||||
| -rw-r--r-- | src/lib/ndpi_utils.c | 4 | ||||
| -rw-r--r-- | src/lib/protocols/tls.c | 9 |
3 files changed, 12 insertions, 2 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 4b65df0be..09af06680 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -102,6 +102,7 @@ static ndpi_risk_info ndpi_known_risks[] = { { NDPI_MALICIOUS_SHA1_CERTIFICATE, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_DESKTOP_OR_FILE_SHARING_SESSION, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_TLS_UNCOMMON_ALPN, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_TLS_CERT_VALIDITY_TOO_LONG, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, /* Leave this as last member */ { NDPI_MAX_RISK, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE } diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c index 95f0a4345..3a3c18aff 100644 --- a/src/lib/ndpi_utils.c +++ b/src/lib/ndpi_utils.c @@ -1731,6 +1731,10 @@ const char* ndpi_risk2str(ndpi_risk_enum risk) { case NDPI_TLS_UNCOMMON_ALPN: return("Uncommon TLS ALPN"); + + case NDPI_TLS_CERT_VALIDITY_TOO_LONG: + return("TLS certificate validity longer than 13 months"); + default: snprintf(buf, sizeof(buf), "%d", (int)risk); diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index c1c31d5bc..7a3b5e44f 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -94,6 +94,8 @@ union ja3_info { */ #define NDPI_MAX_TLS_REQUEST_SIZE 10000 +#define TLS_THRESHOLD 34186659 // Threshold for certificate validity +#define TLS_LIMIT_DATE 1598918400 // From 01/09/2020 TLS certificates lifespan is limited to 13 months /* skype.c */ extern u_int8_t is_skype_flow(struct ndpi_detection_module_struct *ndpi_struct, @@ -420,7 +422,7 @@ static void processCertificateElements(struct ndpi_detection_module_struct *ndpi for(j=0; j<len; j++) printf("%c", packet->payload[i+4+j]); printf("]\n"); #endif - + if(len < (sizeof(utcDate)-1)) { struct tm utc; utc.tm_isdst = -1; /* Not set by strptime */ @@ -454,7 +456,7 @@ static void processCertificateElements(struct ndpi_detection_module_struct *ndpi for(j=0; j<len; j++) printf("%c", packet->payload[offset+j]); printf("]\n"); #endif - + if(len < (sizeof(utcDate)-1)) { struct tm utc; utc.tm_isdst = -1; /* Not set by strptime */ @@ -472,6 +474,9 @@ static void processCertificateElements(struct ndpi_detection_module_struct *ndpi } } + if (flow->protos.tls_quic_stun.tls_quic.notBefore > TLS_LIMIT_DATE) + if((flow->protos.tls_quic_stun.tls_quic.notAfter-flow->protos.tls_quic_stun.tls_quic.notBefore) > TLS_THRESHOLD) + ndpi_set_risk(flow, NDPI_TLS_CERT_VALIDITY_TOO_LONG); /* Certificate validity longer than 13 months*/ if((time_sec < flow->protos.tls_quic_stun.tls_quic.notBefore) || (time_sec > flow->protos.tls_quic_stun.tls_quic.notAfter)) |