aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--fuzz/corpus/fuzz_is_stun_tcp/data_1bin0 -> 192 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_tcp/data_2bin0 -> 168 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_tcp/data_3bin0 -> 108 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_udp/data_1bin0 -> 708 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_udp/data_2bin0 -> 292 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_udp/data_3bin0 -> 128 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_udp/data_4bin0 -> 236 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_udp/data_5bin0 -> 128 bytes
-rw-r--r--fuzz/corpus/fuzz_is_stun_udp/data_6bin0 -> 292 bytes
-rw-r--r--fuzz/fuzz_is_stun.c2
-rw-r--r--src/lib/protocols/stun.c22
-rw-r--r--tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out2
-rw-r--r--tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out21
13 files changed, 37 insertions, 10 deletions
diff --git a/fuzz/corpus/fuzz_is_stun_tcp/data_1 b/fuzz/corpus/fuzz_is_stun_tcp/data_1
new file mode 100644
index 000000000..a00a45d20
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_tcp/data_1
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_tcp/data_2 b/fuzz/corpus/fuzz_is_stun_tcp/data_2
new file mode 100644
index 000000000..8e4e54bd3
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_tcp/data_2
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_tcp/data_3 b/fuzz/corpus/fuzz_is_stun_tcp/data_3
new file mode 100644
index 000000000..67f400888
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_tcp/data_3
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_udp/data_1 b/fuzz/corpus/fuzz_is_stun_udp/data_1
new file mode 100644
index 000000000..e38208cf9
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_udp/data_1
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_udp/data_2 b/fuzz/corpus/fuzz_is_stun_udp/data_2
new file mode 100644
index 000000000..091cf57de
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_udp/data_2
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_udp/data_3 b/fuzz/corpus/fuzz_is_stun_udp/data_3
new file mode 100644
index 000000000..6f7d16de8
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_udp/data_3
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_udp/data_4 b/fuzz/corpus/fuzz_is_stun_udp/data_4
new file mode 100644
index 000000000..b52294076
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_udp/data_4
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_udp/data_5 b/fuzz/corpus/fuzz_is_stun_udp/data_5
new file mode 100644
index 000000000..d24c5488e
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_udp/data_5
Binary files differ
diff --git a/fuzz/corpus/fuzz_is_stun_udp/data_6 b/fuzz/corpus/fuzz_is_stun_udp/data_6
new file mode 100644
index 000000000..0b6f4cb7e
--- /dev/null
+++ b/fuzz/corpus/fuzz_is_stun_udp/data_6
Binary files differ
diff --git a/fuzz/fuzz_is_stun.c b/fuzz/fuzz_is_stun.c
index 1b1eb2639..dc1c98f07 100644
--- a/fuzz/fuzz_is_stun.c
+++ b/fuzz/fuzz_is_stun.c
@@ -4,6 +4,7 @@
static struct ndpi_detection_module_struct *ndpi_struct = NULL;
static struct ndpi_flow_struct ndpi_flow;
+struct ndpi_iphdr iph;
#ifdef STUN_TCP
struct ndpi_tcphdr tcph;
#else
@@ -31,6 +32,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
#else
packet->tcp = &tcph;
#endif
+ packet->iph = &iph; /* IPv4 only */
is_stun(ndpi_struct, &ndpi_flow, &app_proto);
return 0;
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 62e904b69..b3d83da8c 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -38,6 +38,8 @@ static u_int32_t get_stun_lru_key_raw4(u_int32_t ip, u_int16_t port);
static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int app_proto);
+static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow);
static u_int16_t search_into_cache(struct ndpi_detection_module_struct *ndpi_struct,
@@ -133,6 +135,8 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct,
int off;
const u_int8_t *payload = packet->payload;
u_int16_t payload_length = packet->payload_packet_len;
+ const u_int8_t *orig_payload;
+ u_int16_t orig_payload_length;
u_int32_t magic_cookie;
if(payload_length < STUN_HDR_LEN) {
@@ -306,6 +310,22 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct,
*app_proto = NDPI_PROTOCOL_HANGOUT_DUO;
return 1;
+ case 0x0013:
+ NDPI_LOG_DBG(ndpi_struct, "DATA attribute\n");
+
+ orig_payload = packet->payload;
+ orig_payload_length = packet->payload_packet_len;
+ packet->payload = payload + off + 4;
+ packet->payload_packet_len = payload_length - off - 4;
+
+ stun_search_again(ndpi_struct, flow);
+ NDPI_LOG_DBG(ndpi_struct, "End recursion\n");
+
+ packet->payload = orig_payload;
+ packet->payload_packet_len = orig_payload_length;
+
+ break;
+
default:
NDPI_LOG_DBG2(ndpi_struct, "Unknown attribute %04X\n", attribute);
break;
@@ -326,7 +346,7 @@ static int keep_extra_dissection(struct ndpi_detection_module_struct *ndpi_struc
/* We have a sub-classification */
if((ndpi_struct->monitoring_stun_flags & NDPI_MONITORING_STUN_SUBCLASSIFIED) &&
- flow->detected_protocol_stack[1] != NDPI_PROTOCOL_RTP)
+ flow->detected_protocol_stack[0] != NDPI_PROTOCOL_RTP)
return 1;
/* Looking for XOR-PEER-ADDRESS metadata; TODO: other protocols? */
diff --git a/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out b/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out
index 73bfebb35..a29ed7819 100644
--- a/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out
+++ b/tests/cfgs/default/result/stun_dtls_rtp_unidir.pcapng.out
@@ -6,7 +6,7 @@ Num dissector calls: 12 (6.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
-LRU cache stun: 6/20/0 (insert/search/found)
+LRU cache stun: 6/24/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
diff --git a/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out b/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out
index 631cf3843..a0ff564d9 100644
--- a/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out
+++ b/tests/cfgs/enable_stun_monitoring_with_subproto/result/stun_dtls_rtp_unidir.pcapng.out
@@ -1,19 +1,19 @@
-Guessed flow protos: 1
+Guessed flow protos: 0
-DPI Packets (UDP): 39 (19.50 pkts/flow)
+DPI Packets (UDP): 36 (18.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 12 (6.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
-LRU cache stun: 35/78/0 (insert/search/found)
-LRU cache tls_cert: 0/0/0 (insert/search/found)
+LRU cache stun: 32/88/0 (insert/search/found)
+LRU cache tls_cert: 0/5/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 0/0 (search/found)
Automa domain: 0/0 (search/found)
-Automa tls cert: 0/0 (search/found)
+Automa tls cert: 1/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
Patricia risk mask: 4/0 (search/found)
@@ -23,7 +23,12 @@ Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 4/0 (search/found)
Patricia protocols IPv6: 0/0 (search/found)
-STUN 43 10358 2
+RTP 43 10358 2
- 1 UDP 10.1.0.3:5853 -> 10.10.0.1:2808 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 18][cat: Network/14][18 pkts/5384 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][7.17 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 386/0 4001/0 979/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/0 299/0 750/0 221/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (Coturn)][Plen Bins: 0,5,5,5,34,22,0,0,0,5,0,0,0,0,0,5,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 2 UDP 10.10.0.1:65226 -> 10.1.0.3:57730 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 21][cat: Network/14][25 pkts/4974 bytes -> 0 pkts/0 bytes][Goodput ratio: 79/0][7.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 324/0 4001/0 904/0][Pkt Len c2s/s2c min/avg/max/stddev: 78/0 199/0 478/0 92/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][PLAIN TEXT (username1)][Plen Bins: 0,8,16,16,32,0,4,8,0,12,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+JA3 Host Stats:
+ IP Address # JA3C
+ 1 10.10.0.1 1
+
+
+ 1 UDP 10.1.0.3:5853 -> 10.10.0.1:2808 [proto: 30.87/DTLS.RTP][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 15][cat: Network/14][18 pkts/5384 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][7.17 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 386/0 4001/0 979/0][Pkt Len c2s/s2c min/avg/max/stddev: 102/0 299/0 750/0 221/0][Risk: ** Known Proto on Non Std Port **** Self-signed Cert **][Risk Score: 150][Risk Info: CN=8][DTLSv1.0][JA3S: 1cfcbe58451407e23669f1dd08565519][Issuer: CN=8][Subject: CN=8][Certificate SHA-1: 94:8C:6F:C3:00:6A:A1:63:F1:52:7E:7F:1F:A7:93:90:46:3B:B1:2D][Validity: 2015-12-10 05:41:43 - 2016-01-10 05:41:43][Cipher: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA][PLAIN TEXT (Coturn)][Plen Bins: 0,5,5,5,34,22,0,0,0,5,0,0,0,0,0,5,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 2 UDP 10.10.0.1:65226 -> 10.1.0.3:57730 [proto: 30.87/DTLS.RTP][IP: 0/Unknown][Encrypted][Confidence: DPI][DPI packets: 21][cat: Network/14][25 pkts/4974 bytes -> 0 pkts/0 bytes][Goodput ratio: 79/0][7.16 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 324/0 4001/0 904/0][Pkt Len c2s/s2c min/avg/max/stddev: 78/0 199/0 478/0 92/0][Risk: ** Known Proto on Non Std Port **** TLS (probably) Not Carrying HTTPS **** Missing SNI TLS Extn **][Risk Score: 110][Risk Info: No ALPN][DTLSv1.0][JA3C: fd8faf73d274d5614a51dae82304be0a][PLAIN TEXT (username1)][Plen Bins: 0,8,16,16,32,0,4,8,0,12,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
Powered by cgit, Themed by Ted Yin.