aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/include/ndpi_define.h.in16
-rw-r--r--src/lib/ndpi_main.c16
-rw-r--r--src/lib/protocols/mail_smtp.c23
-rw-r--r--src/lib/protocols/tls.c23
-rw-r--r--tests/result/ftp-start-tls.pcap.out4
-rw-r--r--tests/result/smtp-starttls.pcap.out2
6 files changed, 39 insertions, 45 deletions
diff --git a/src/include/ndpi_define.h.in b/src/include/ndpi_define.h.in
index c0566ca8e..2999a38f7 100644
--- a/src/include/ndpi_define.h.in
+++ b/src/include/ndpi_define.h.in
@@ -453,20 +453,4 @@ static inline u_int64_t get_u_int64_t(const u_int8_t* X, int O)
#define ETH_P_PPPoE 0x8864
#endif
-#define SMTP_BIT_220 0x01
-#define SMTP_BIT_250 0x02
-#define SMTP_BIT_235 0x04
-#define SMTP_BIT_334 0x08
-#define SMTP_BIT_354 0x10
-#define SMTP_BIT_HELO_EHLO 0x20
-#define SMTP_BIT_MAIL 0x40
-#define SMTP_BIT_RCPT 0x80
-#define SMTP_BIT_AUTH_LOGIN 0x100
-#define SMTP_BIT_STARTTLS 0x200
-#define SMTP_BIT_DATA 0x400
-#define SMTP_BIT_NOOP 0x800
-#define SMTP_BIT_RSET 0x1000
-#define SMTP_BIT_TlRM 0x2000
-#define SMTP_BIT_AUTH_PLAIN 0x4000
-
#endif /* __NDPI_DEFINE_INCLUDE_FILE__ */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index d071d6d9f..3c6d6ba84 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -5339,13 +5339,6 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s
// printf("====>> %u.%u [%u]\n", ret->master_protocol, ret->app_protocol, flow->detected_protocol_stack[0]);
switch(ret->app_protocol) {
- case NDPI_PROTOCOL_MAIL_IMAPS:
- case NDPI_PROTOCOL_MAIL_SMTPS:
- case NDPI_PROTOCOL_MAIL_POPS:
- /* ALPN not necessary for secure email */
- NDPI_CLR_BIT(flow->risk, NDPI_TLS_NOT_CARRYING_HTTPS);
- break;
-
/*
Skype for a host doing MS Teams means MS Teams
(MS Teams uses Skype as transport protocol for voice/video)
@@ -8042,9 +8035,7 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
switch(proto) {
case NDPI_PROTOCOL_TLS:
case NDPI_PROTOCOL_DTLS:
- if(flow->l4.tcp.tls.certificate_processed ||
- (flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 1 &&
- flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 1)) return(0);
+ if(flow->l4.tcp.tls.certificate_processed) return(0);
if(flow->l4.tcp.tls.num_tls_blocks <= ndpi_str->num_tls_blocks_to_follow) {
// printf("*** %u/%u\n", flow->l4.tcp.tls.num_tls_blocks, ndpi_str->num_tls_blocks_to_follow);
@@ -8064,6 +8055,11 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
break;
case NDPI_PROTOCOL_FTP_CONTROL:
+ if(flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0' &&
+ flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 0 &&
+ flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 0)
+ return(1);
+ break;
case NDPI_PROTOCOL_MAIL_POP:
case NDPI_PROTOCOL_MAIL_IMAP:
case NDPI_PROTOCOL_MAIL_SMTP:
diff --git a/src/lib/protocols/mail_smtp.c b/src/lib/protocols/mail_smtp.c
index fddd42b97..2b1ffd52f 100644
--- a/src/lib/protocols/mail_smtp.c
+++ b/src/lib/protocols/mail_smtp.c
@@ -30,6 +30,22 @@
#include "ndpi_api.h"
+#define SMTP_BIT_220 0x01
+#define SMTP_BIT_250 0x02
+#define SMTP_BIT_235 0x04
+#define SMTP_BIT_334 0x08
+#define SMTP_BIT_354 0x10
+#define SMTP_BIT_HELO_EHLO 0x20
+#define SMTP_BIT_MAIL 0x40
+#define SMTP_BIT_RCPT 0x80
+#define SMTP_BIT_AUTH_LOGIN 0x100
+#define SMTP_BIT_STARTTLS 0x200
+#define SMTP_BIT_DATA 0x400
+#define SMTP_BIT_NOOP 0x800
+#define SMTP_BIT_RSET 0x1000
+#define SMTP_BIT_TlRM 0x2000
+#define SMTP_BIT_AUTH_PLAIN 0x4000
+
/* #define SMTP_DEBUG 1 */
extern int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
@@ -393,6 +409,13 @@ int ndpi_extra_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_st
if (rc == 0 && memcmp(packet->payload, "220", 3) != 0)
{
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
+ if (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) {
+ ndpi_set_detected_protocol(ndpi_struct, flow,
+ NDPI_PROTOCOL_MAIL_SMTPS, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+ } else {
+ ndpi_set_detected_protocol(ndpi_struct, flow,
+ flow->guessed_host_protocol_id, NDPI_PROTOCOL_MAIL_SMTPS, NDPI_CONFIDENCE_DPI);
+ }
}
} else {
ndpi_search_mail_smtp_tcp(ndpi_struct, flow);
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 5cd74c0df..69bec44f5 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -855,10 +855,7 @@ int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
case 0x02: /* Server Hello */
processClientServerHello(ndpi_struct, flow, 0);
flow->protos.tls_quic.hello_processed = 1;
-
- ndpi_int_tls_add_connection(ndpi_struct, flow,
- /* Check if this is a SMTP connection with STARTTLS or TLS */
- (flow->l4.tcp.smtp_command_bitmask & SMTP_BIT_STARTTLS) ? NDPI_PROTOCOL_MAIL_SMTPS : NDPI_PROTOCOL_TLS);
+ ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS);
#ifdef DEBUG_TLS
printf("*** TLS [version: %02X][%s Hello]\n",
@@ -1246,8 +1243,7 @@ static void tlsCheckUncommonALPN(struct ndpi_detection_module_struct *ndpi_struc
static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow, u_int32_t protocol) {
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
- u_int16_t upper_detected_protocol;
-
+
#if DEBUG_TLS
printf("[TLS] %s()\n", __FUNCTION__);
#endif
@@ -1262,17 +1258,12 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
return;
}
- if(protocol != NDPI_PROTOCOL_TLS) {
- if(flow->l4.tcp.smtp_command_bitmask & SMTP_BIT_STARTTLS)
- upper_detected_protocol = flow->detected_protocol_stack[0];
- else
- upper_detected_protocol = protocol;
- } else {
+ if(protocol != NDPI_PROTOCOL_TLS)
+ ;
+ else
protocol = ndpi_tls_refine_master_protocol(ndpi_struct, flow, protocol);
- upper_detected_protocol = protocol;
- }
-
- ndpi_set_detected_protocol(ndpi_struct, flow, upper_detected_protocol, protocol, NDPI_CONFIDENCE_DPI);
+
+ ndpi_set_detected_protocol(ndpi_struct, flow, protocol, protocol, NDPI_CONFIDENCE_DPI);
tlsInitExtraPacketProcessing(ndpi_struct, flow);
}
diff --git a/tests/result/ftp-start-tls.pcap.out b/tests/result/ftp-start-tls.pcap.out
index d11171015..a04ab94c1 100644
--- a/tests/result/ftp-start-tls.pcap.out
+++ b/tests/result/ftp-start-tls.pcap.out
@@ -1,6 +1,6 @@
-Guessed flow protos: 1
+Guessed flow protos: 0
-DPI Packets (TCP): 51 (51.00 pkts/flow)
+DPI Packets (TCP): 10 (10.00 pkts/flow)
Confidence DPI : 1 (flows)
FTP_CONTROL 51 7510 1
diff --git a/tests/result/smtp-starttls.pcap.out b/tests/result/smtp-starttls.pcap.out
index a7418ae2b..15243e040 100644
--- a/tests/result/smtp-starttls.pcap.out
+++ b/tests/result/smtp-starttls.pcap.out
@@ -10,4 +10,4 @@ JA3 Host Stats:
1 10.0.0.1 1
- 1 TCP 10.0.0.1:57406 <-> 173.194.68.26:25 [proto: 29.126/SMTPS.Google][Encrypted][Confidence: DPI][cat: Email/3][17 pkts/2514 bytes <-> 19 pkts/5889 bytes][Goodput ratio: 55/79][0.48 sec][Hostname/SNI: mx.google.com][bytes ratio: -0.402 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 30/24 156/103 42/26][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 148/310 752/1484 168/444][Risk: ** Obsolete TLS (v1.1 or older) **][Risk Score: 100][Risk Info: No client to server traffic / TLSv1][TLSv1][JA3C: fab507fe132c544e8a0eb7c394affeae][PLAIN TEXT (x.google.com ESMTP s4)][Plen Bins: 23,18,13,9,4,4,4,0,0,4,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0]
+ 1 TCP 10.0.0.1:57406 <-> 173.194.68.26:25 [proto: 29.126/SMTPS.Google][Encrypted][Confidence: DPI][cat: Email/3][17 pkts/2514 bytes <-> 19 pkts/5889 bytes][Goodput ratio: 55/79][0.48 sec][Hostname/SNI: mx.google.com][bytes ratio: -0.402 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 30/24 156/103 42/26][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 148/310 752/1484 168/444][Risk: ** Obsolete TLS (v1.1 or older) **][Risk Score: 100][Risk Info: TLSv1][TLSv1][JA3C: fab507fe132c544e8a0eb7c394affeae][PLAIN TEXT (x.google.com ESMTP s4)][Plen Bins: 23,18,13,9,4,4,4,0,0,4,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0]
Powered by cgit, Themed by Ted Yin.