diff options
16 files changed, 209 insertions, 61 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index ff6bf9d77..f7dff3e90 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -9889,15 +9889,10 @@ int ndpi_get_lru_cache_ttl(struct ndpi_detection_module_struct *ndpi_struct, */ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndpi_str, struct ndpi_flow_struct *flow) { -#ifdef NDPI_ENABLE_DEBUG_MESSAGES - u_int16_t proto = - flow->detected_protocol_stack[1] ? flow->detected_protocol_stack[1] : flow->detected_protocol_stack[0]; - - NDPI_LOG_DBG2(ndpi_str, "[DEBUG] %s(%u.%u): %u\n", __FUNCTION__, + NDPI_LOG_DBG2(ndpi_str, "Protos (%u.%u): %d\n", flow->detected_protocol_stack[0], flow->detected_protocol_stack[1], - proto); -#endif + !!flow->extra_packets_func); if(!flow->extra_packets_func) return(0); diff --git a/src/lib/ndpi_private.h b/src/lib/ndpi_private.h index 58260e6a1..cf549c00c 100644 --- a/src/lib/ndpi_private.h +++ b/src/lib/ndpi_private.h @@ -298,7 +298,7 @@ void processCertificateElements(struct ndpi_detection_module_struct *ndpi_struct struct ndpi_flow_struct *flow, u_int16_t p_offset, u_int16_t certificate_len); void switch_to_tls(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow); + struct ndpi_flow_struct *flow, int first_dtls_pkt); int is_dtls(const u_int8_t *buf, u_int32_t buf_len, u_int32_t *block_len); void switch_extra_dissection_to_tls(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index 7cff65530..589c599d2 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -335,6 +335,15 @@ static int keep_extra_dissection(struct ndpi_detection_module_struct *ndpi_struc return 0; } +static u_int32_t __get_master(struct ndpi_flow_struct *flow) { + + if(flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN) + return flow->detected_protocol_stack[1]; + if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) + return flow->detected_protocol_stack[0]; + return NDPI_PROTOCOL_STUN; +} + static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { @@ -343,6 +352,7 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t first_byte; u_int16_t app_proto = NDPI_PROTOCOL_UNKNOWN; u_int32_t unused; + int first_dtls_pkt = 0; NDPI_LOG_DBG2(ndpi_struct, "Packet counter %d protos %d/%d\n", flow->packet_counter, flow->detected_protocol_stack[0], flow->detected_protocol_stack[1]); @@ -370,24 +380,50 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct, NDPI_LOG_DBG(ndpi_struct, "DROP or ZRTP range. Unexpected\n"); } else if(first_byte <= 63) { NDPI_LOG_DBG(ndpi_struct, "DTLS\n"); - if(is_dtls(packet->payload, packet->payload_packet_len, &unused) && - flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN /* No previous subclassification */) { + + if(ndpi_struct->opportunistic_tls_stun_enabled && + is_dtls(packet->payload, packet->payload_packet_len, &unused)) { + + /* Process this DTLS packet via TLS/DTLS code but keep using STUN dissection. + This way we can keep demultiplexing DTLS/STUN/RTP */ + /* Switching to TLS dissector is tricky, because we are calling one dissector from another one, and that is not a common operation... Additionally: - * at that point protocol stack is already set to STUN + * at that point protocol stack is already set to STUN or STUN/XXX * we have room for only two protocols in flow->detected_protocol_stack[] so we can't have something like STUN/DTLS/SNAPCHAT_CALL - * the easiest (!?) solution is to remove STUN, and let TLS dissector to set both - master (i.e. DTLS) and subprotocol (if any) */ - if(ndpi_struct->opportunistic_tls_stun_enabled) { - /* TODO: right way? It is a bit scary... do we need to reset something else too? */ - ndpi_reset_detected_protocol(ndpi_struct, flow); - ndpi_int_change_category(ndpi_struct, flow, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED); - - flow->stun.maybe_dtls = 1; - NDPI_LOG_DBG(ndpi_struct, "Switch to TLS\n"); - switch_to_tls(ndpi_struct, flow); + * the easiest (!?) solution is to remove everything, and let the TLS dissector + to set both master (i.e. DTLS) and subprotocol (if any) */ + + if(packet->tcp) { + /* TODO: TLS code assumes that DTLS is only over UDP */ + NDPI_LOG_DBG(ndpi_struct, "Ignoring DTLS over TCP\n"); + } else { + if(flow->tls_quic.certificate_processed == 1) { + NDPI_LOG_DBG(ndpi_struct, "Interesting DTLS stuff already processed. Ignoring\n"); + } else { + if(flow->stun.maybe_dtls == 0) { + /* First DTLS packet of the flow */ + first_dtls_pkt = 1; + + /* TODO: right way? It is a bit scary... do we need to reset something else too? */ + ndpi_reset_detected_protocol(ndpi_struct, flow); + ndpi_int_change_category(ndpi_struct, flow, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED); + + /* Give room for DTLS handshake, where we might have + retransmissions and fragments */ + flow->max_extra_packets_to_check += 10; + flow->stun.maybe_dtls = 1; + } + NDPI_LOG_DBG(ndpi_struct, "Switch to TLS (%d/%d)\n", + flow->detected_protocol_stack[0], flow->detected_protocol_stack[1]); + + switch_to_tls(ndpi_struct, flow, first_dtls_pkt); + + NDPI_LOG_DBG(ndpi_struct, "(%d/%d)\n", + flow->detected_protocol_stack[0], flow->detected_protocol_stack[1]); + } } } } else if(first_byte <= 127) { @@ -402,14 +438,19 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct, rtp_get_stream_type(packet->payload[1] & 0x7F, &flow->flow_multimedia_type); if(flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN) { - /* STUN/SUBPROTO -> SUBPROTO/RTP */ - ndpi_set_detected_protocol(ndpi_struct, flow, - NDPI_PROTOCOL_RTP, flow->detected_protocol_stack[0], - NDPI_CONFIDENCE_DPI); + if(flow->detected_protocol_stack[1] == NDPI_PROTOCOL_DTLS) { + /* Keep DTLS/SUBPROTO since we already wrote to flow->protos.tls_quic */ + } else { + /* STUN/SUBPROTO -> SUBPROTO/RTP */ + ndpi_set_detected_protocol(ndpi_struct, flow, + NDPI_PROTOCOL_RTP, flow->detected_protocol_stack[0], + NDPI_CONFIDENCE_DPI); + } } else { - /* STUN -> STUN/RTP */ + /* STUN -> STUN/RTP, or + DTLS -> DTLS/RTP */ ndpi_set_detected_protocol(ndpi_struct, flow, - NDPI_PROTOCOL_RTP, NDPI_PROTOCOL_STUN, + NDPI_PROTOCOL_RTP, __get_master(flow), NDPI_CONFIDENCE_DPI); } return 0; /* Stop */ @@ -522,7 +563,7 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN || app_proto != NDPI_PROTOCOL_UNKNOWN) { NDPI_LOG_DBG(ndpi_struct, "Setting %d\n", app_proto); - ndpi_set_detected_protocol(ndpi_struct, flow, app_proto, NDPI_PROTOCOL_STUN, confidence); + ndpi_set_detected_protocol(ndpi_struct, flow, app_proto, __get_master(flow), confidence); } /* This is quite complex. We want extra dissection for: diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index 44c36cb6d..b86d51f54 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -1231,18 +1231,6 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct, const u_int8_t *block = (const u_int8_t *)&p[processed]; if(!is_dtls(block, p_len, &block_len)) { - if(processed == 0 && /* First block */ - flow->stun.maybe_dtls == 1) { - /* Sometimes STUN packets are interleaved with TLS ones. Ignore STUN ones - since we already are after STUN dissection and we are interested only on - TLS stuff right now */ -#ifdef DEBUG_TLS - printf("Probably a stun packet. Keep going with TLS on next packets\n"); -#endif - /* Note that we can immediately "return" because, being the first block, - we don't need to restore packet->payload and packet->payload_packet_len */ - return(1); /* Keep working */ - } no_dtls = 1; break; } @@ -1332,6 +1320,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct, #endif change_cipher_found = 1; processed += block_len + 13; + flow->tls_quic.certificate_processed = 1; /* Fake, to avoid extra dissection */ break; } else { #ifdef DEBUG_TLS @@ -1359,7 +1348,6 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct, if(no_dtls || change_cipher_found || flow->tls_quic.certificate_processed) { NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_DTLS); - flow->extra_packets_func = NULL; return(0); /* That's all */ } else { return(1); /* Keep working */ @@ -1401,19 +1389,21 @@ void switch_extra_dissection_to_tls(struct ndpi_detection_module_struct *ndpi_st /* **************************************** */ void switch_to_tls(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) + struct ndpi_flow_struct *flow, int first_time) { #ifdef DEBUG_TLS printf("Switching to TLS\n"); #endif - /* Reset reassemblers */ - if(flow->tls_quic.message[0].buffer) - ndpi_free(flow->tls_quic.message[0].buffer); - memset(&flow->tls_quic.message[0], '\0', sizeof(flow->tls_quic.message[0])); - if(flow->tls_quic.message[1].buffer) - ndpi_free(flow->tls_quic.message[1].buffer); - memset(&flow->tls_quic.message[1], '\0', sizeof(flow->tls_quic.message[1])); + if(first_time) { + /* Reset reassemblers */ + if(flow->tls_quic.message[0].buffer) + ndpi_free(flow->tls_quic.message[0].buffer); + memset(&flow->tls_quic.message[0], '\0', sizeof(flow->tls_quic.message[0])); + if(flow->tls_quic.message[1].buffer) + ndpi_free(flow->tls_quic.message[1].buffer); + memset(&flow->tls_quic.message[1], '\0', sizeof(flow->tls_quic.message[1])); + } ndpi_search_tls_wrapper(ndpi_struct, flow); } @@ -1498,8 +1488,9 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp protocol = __get_master(ndpi_struct, flow); ndpi_set_detected_protocol(ndpi_struct, flow, protocol, protocol, NDPI_CONFIDENCE_DPI); - - tlsInitExtraPacketProcessing(ndpi_struct, flow); + /* We don't want to ovewrite STUN extra dissection, if enabled */ + if(!flow->extra_packets_func) + tlsInitExtraPacketProcessing(ndpi_struct, flow); } /* **************************************** */ diff --git a/tests/cfgs/default/pcap/stun_dtls_rtp.pcapng b/tests/cfgs/default/pcap/stun_dtls_rtp.pcapng Binary files differnew file mode 100644 index 000000000..9d51e7ca7 --- /dev/null +++ b/tests/cfgs/default/pcap/stun_dtls_rtp.pcapng diff --git a/tests/cfgs/default/pcap/stun_dtls_rtp_unidir.pcapng b/tests/cfgs/default/pcap/stun_dtls_rtp_unidir.pcapng Binary files differnew file mode 100644 index 000000000..a986d71fd --- /dev/null +++ b/tests/cfgs/default/pcap/stun_dtls_rtp_unidir.pcapng diff --git a/tests/cfgs/default/result/dtls_certificate.pcapng.out b/tests/cfgs/default/result/dtls_certificate.pcapng.out index e704d64f5..8f2b8dd59 100644 --- a/tests/cfgs/default/result/dtls_certificate.pcapng.out +++ b/tests/cfgs/default/result/dtls_certificate.pcapng.out @@ -1,4 +1,4 @@ -Guessed flow protos: 0 +Guessed flow protos: 1 DPI Packets (UDP): 1 (1.00 pkts/flow) Confidence DPI : 1 (flows) diff --git a/tests/cfgs/default/result/stun_dtls_rtp.pcapng.out b/tests/cfgs/default/result/stun_dtls_rtp.pcapng.out new file mode 100644 index 000000000..cf2146aec --- /dev/null +++ b/tests/cfgs/default/result/stun_dtls_rtp.pcapng.out @@ -0,0 +1,28 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 1 (1.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 6 (6.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 2/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 2/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 1/1 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +GoogleHangoutDuo 39 8413 1 + + 1 UDP 192.168.12.156:37967 <-> 142.250.82.76:19305 [proto: 78.201/STUN.GoogleHangoutDuo][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][25 pkts/4202 bytes <-> 14 pkts/4211 bytes][Goodput ratio: 75/86][0.88 sec][bytes ratio: -0.001 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 37/35 203/107 47/36][Pkt Len c2s/s2c min/avg/max/stddev: 103/82 168/301 587/1245 125/320][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic][PLAIN TEXT (ShSURJhNF)][Plen Bins: 0,5,47,30,2,0,0,0,0,0,0,0,0,2,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out b/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out new file mode 100644 index 000000000..73bfebb35 --- /dev/null +++ b/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out @@ -0,0 +1,29 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 10 (5.00 pkts/flow) +Confidence DPI : 2 (flows) +Num dissector calls: 12 (6.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 6/20/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 4/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 4/0 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +STUN 43 10358 2 + + 1 UDP 10.1.0.3:5853 -> 10.10.0.1:2808 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 5][cat: Network/14][18 pkts/5384 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][7.17 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 386/0 4001/0 979/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/0 299/0 750/0 221/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (Coturn)][Plen Bins: 0,5,5,5,34,22,0,0,0,5,0,0,0,0,0,5,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 UDP 10.10.0.1:65226 -> 10.1.0.3:57730 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 5][cat: Network/14][25 pkts/4974 bytes -> 0 pkts/0 bytes][Goodput ratio: 79/0][7.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 324/0 4001/0 904/0][Pkt Len c2s/s2c min/avg/max/stddev: 78/0 199/0 478/0 92/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (username1)][Plen Bins: 0,8,16,16,32,0,4,8,0,12,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out b/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out index 9edd39028..5c41173be 100644 --- a/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out +++ b/tests/cfgs/default/result/stun_dtls_unidirectional_client.pcap.out @@ -1,12 +1,12 @@ -Guessed flow protos: 0 +Guessed flow protos: 1 -DPI Packets (UDP): 4 (4.00 pkts/flow) +DPI Packets (UDP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) Num dissector calls: 6 (6.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) -LRU cache stun: 0/4/0 (insert/search/found) +LRU cache stun: 0/8/0 (insert/search/found) LRU cache tls_cert: 0/1/0 (insert/search/found) LRU cache mining: 0/0/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) @@ -30,4 +30,4 @@ JA3 Host Stats: 1 26.83.9.81 1 - 1 UDP 26.83.9.81:57567 -> 33.35.223.103:540 [proto: 30/DTLS][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 4][6 pkts/1708 bytes -> 0 pkts/0 bytes][Goodput ratio: 85/0][1.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 232/0 299/0 116/0][Pkt Len c2s/s2c min/avg/max/stddev: 106/0 285/0 873/0 267/0][Risk: ** Known Proto on Non Std Port **** TLS (probably) Not Carrying HTTPS **** Missing SNI TLS Extn **** Unidirectional Traffic **][Risk Score: 120][Risk Info: No server to client traffic / No ALPN][DTLSv1.0][JA3C: f5eee7bc59657db39e2b9cdd401d78b7][PLAIN TEXT (ugPnBzE)][Plen Bins: 0,0,16,51,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 UDP 26.83.9.81:57567 -> 33.35.223.103:540 [proto: 30/DTLS][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 6][cat: Network/14][6 pkts/1708 bytes -> 0 pkts/0 bytes][Goodput ratio: 85/0][1.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 1/0 232/0 299/0 116/0][Pkt Len c2s/s2c min/avg/max/stddev: 106/0 285/0 873/0 267/0][Risk: ** Known Proto on Non Std Port **** TLS (probably) Not Carrying HTTPS **** Missing SNI TLS Extn **** Unidirectional Traffic **][Risk Score: 120][Risk Info: No server to client traffic / No ALPN][DTLSv1.0][JA3C: f5eee7bc59657db39e2b9cdd401d78b7][PLAIN TEXT (ugPnBzE)][Plen Bins: 0,0,16,51,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out b/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out index 82f672fc4..45f162e20 100644 --- a/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out +++ b/tests/cfgs/default/result/stun_dtls_unidirectional_server.pcap.out @@ -1,12 +1,12 @@ -Guessed flow protos: 0 +Guessed flow protos: 1 -DPI Packets (UDP): 3 (3.00 pkts/flow) +DPI Packets (UDP): 6 (6.00 pkts/flow) Confidence DPI : 1 (flows) Num dissector calls: 6 (6.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) -LRU cache stun: 0/4/0 (insert/search/found) +LRU cache stun: 0/8/0 (insert/search/found) LRU cache tls_cert: 0/1/0 (insert/search/found) LRU cache mining: 0/0/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) @@ -29,4 +29,4 @@ JA3 Host Stats: IP Address # JA3C - 1 UDP 33.35.223.103:540 -> 26.83.9.81:57567 [proto: 30/DTLS][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 3][6 pkts/1563 bytes -> 0 pkts/0 bytes][Goodput ratio: 84/0][1.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 232/0 299/0 116/0][Pkt Len c2s/s2c min/avg/max/stddev: 106/0 260/0 958/0 312/0][Risk: ** Known Proto on Non Std Port **** Self-signed Cert **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No client to server traffic / CN=LiveFoundry Inc.][DTLSv1.0][JA3S: 1974c5c625e99dc22d0477079a54aed3][Issuer: CN=LiveFoundry Inc.][Subject: CN=LiveFoundry Inc.][Certificate SHA-1: 23:F4:E7:42:93:22:91:BB:A3:54:70:97:94:2A:DE:AF:26:61:18:98][Validity: 2015-08-27 09:07:05 - 2016-08-27 09:07:05][Cipher: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA][PLAIN TEXT (LiveFoundry Inc.0)][Plen Bins: 0,0,67,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 UDP 33.35.223.103:540 -> 26.83.9.81:57567 [proto: 30/DTLS][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 6][cat: Network/14][6 pkts/1563 bytes -> 0 pkts/0 bytes][Goodput ratio: 84/0][1.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 232/0 299/0 116/0][Pkt Len c2s/s2c min/avg/max/stddev: 106/0 260/0 958/0 312/0][Risk: ** Known Proto on Non Std Port **** Self-signed Cert **** Unidirectional Traffic **][Risk Score: 160][Risk Info: No client to server traffic / CN=LiveFoundry Inc.][DTLSv1.0][JA3S: 1974c5c625e99dc22d0477079a54aed3][Issuer: CN=LiveFoundry Inc.][Subject: CN=LiveFoundry Inc.][Certificate SHA-1: 23:F4:E7:42:93:22:91:BB:A3:54:70:97:94:2A:DE:AF:26:61:18:98][Validity: 2015-08-27 09:07:05 - 2016-08-27 09:07:05][Cipher: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA][PLAIN TEXT (LiveFoundry Inc.0)][Plen Bins: 0,0,67,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/stun_zoom.pcapng.out b/tests/cfgs/default/result/stun_zoom.pcapng.out index 33d4614a9..172308c30 100644 --- a/tests/cfgs/default/result/stun_zoom.pcapng.out +++ b/tests/cfgs/default/result/stun_zoom.pcapng.out @@ -6,7 +6,7 @@ Num dissector calls: 12 (6.00 diss/flow) LRU cache ookla: 0/0/0 (insert/search/found) LRU cache bittorrent: 0/0/0 (insert/search/found) LRU cache zoom: 0/0/0 (insert/search/found) -LRU cache stun: 0/18/0 (insert/search/found) +LRU cache stun: 0/24/0 (insert/search/found) LRU cache tls_cert: 0/4/0 (insert/search/found) LRU cache mining: 0/0/0 (insert/search/found) LRU cache msteams: 0/0/0 (insert/search/found) diff --git a/tests/cfgs/enable_stun_monitoring_with_subproto/pcap/stun_dtls_rtp.pcapng b/tests/cfgs/enable_stun_monitoring_with_subproto/pcap/stun_dtls_rtp.pcapng new file mode 120000 index 000000000..d30bde120 --- /dev/null +++ b/tests/cfgs/enable_stun_monitoring_with_subproto/pcap/stun_dtls_rtp.pcapng @@ -0,0 +1 @@ +../../default/pcap/stun_dtls_rtp.pcapng
\ No newline at end of file diff --git a/tests/cfgs/enable_stun_monitoring_with_subproto/pcap/stun_dtls_rtp_unidir.pcapng b/tests/cfgs/enable_stun_monitoring_with_subproto/pcap/stun_dtls_rtp_unidir.pcapng new file mode 120000 index 000000000..b7223bfd0 --- /dev/null +++ b/tests/cfgs/enable_stun_monitoring_with_subproto/pcap/stun_dtls_rtp_unidir.pcapng @@ -0,0 +1 @@ +../../default/pcap/stun_dtls_rtp_unidir.pcapng
\ No newline at end of file diff --git a/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp.pcapng.out b/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp.pcapng.out new file mode 100644 index 000000000..817890521 --- /dev/null +++ b/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp.pcapng.out @@ -0,0 +1,33 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 25 (25.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 6 (6.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 2/0/0 (insert/search/found) +LRU cache tls_cert: 1/2/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 1/1 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 2/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 1/1 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +GoogleHangoutDuo 39 8413 1 + +JA3 Host Stats: + IP Address # JA3C + 1 192.168.12.156 1 + + + 1 UDP 192.168.12.156:37967 <-> 142.250.82.76:19305 [proto: 30.201/DTLS.GoogleHangoutDuo][IP: 126/Google][Encrypted][Confidence: DPI][DPI packets: 25][cat: VoIP/10][25 pkts/4202 bytes <-> 14 pkts/4211 bytes][Goodput ratio: 75/86][0.88 sec][bytes ratio: -0.001 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 37/35 203/107 47/36][Pkt Len c2s/s2c min/avg/max/stddev: 103/82 168/301 587/1245 125/320][Risk: ** Known Proto on Non Std Port **** Self-signed Cert **** TLS (probably) Not Carrying HTTPS **** Missing SNI TLS Extn **][Risk Score: 210][Risk Info: No ALPN / CN=hangouts][DTLSv1.2][JA3C: c14667d7da3e6f7a7ab5519ef78c2452][JA3S: 1f5d6a6d0bc5d514dd84d13e6283d309][Issuer: CN=hangouts][Subject: CN=hangouts][Certificate SHA-1: AF:DD:BF:F5:59:23:0C:D1:B0:9F:B1:04:2E:89:DF:4C:1B:AB:BE:CC][Validity: 2022-11-30 17:35:18 - 2023-12-01 17:35:18][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256][PLAIN TEXT (ShSURJhNF)][Plen Bins: 0,5,47,30,2,0,0,0,0,0,0,0,0,2,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out b/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out new file mode 100644 index 000000000..631cf3843 --- /dev/null +++ b/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out @@ -0,0 +1,29 @@ +Guessed flow protos: 1 + +DPI Packets (UDP): 39 (19.50 pkts/flow) +Confidence DPI : 2 (flows) +Num dissector calls: 12 (6.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 35/78/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 4/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 4/0 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +STUN 43 10358 2 + + 1 UDP 10.1.0.3:5853 -> 10.10.0.1:2808 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 18][cat: Network/14][18 pkts/5384 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][7.17 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 386/0 4001/0 979/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/0 299/0 750/0 221/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (Coturn)][Plen Bins: 0,5,5,5,34,22,0,0,0,5,0,0,0,0,0,5,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 UDP 10.10.0.1:65226 -> 10.1.0.3:57730 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 21][cat: Network/14][25 pkts/4974 bytes -> 0 pkts/0 bytes][Goodput ratio: 79/0][7.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 324/0 4001/0 904/0][Pkt Len c2s/s2c min/avg/max/stddev: 78/0 199/0 478/0 92/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (username1)][Plen Bins: 0,8,16,16,32,0,4,8,0,12,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |