aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols/ssh.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols/ssh.c')
-rw-r--r--src/lib/protocols/ssh.c86
1 files changed, 46 insertions, 40 deletions
diff --git a/src/lib/protocols/ssh.c b/src/lib/protocols/ssh.c
index 8f2eecb9a..5bdf78959 100644
--- a/src/lib/protocols/ssh.c
+++ b/src/lib/protocols/ssh.c
@@ -60,8 +60,34 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
/* ************************************************************************ */
+static int search_ssh_again(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+ ndpi_search_ssh_tcp(ndpi_struct, flow);
+
+ if((flow->protos.ssh.hassh_client[0] != '\0')
+ && (flow->protos.ssh.hassh_server[0] != '\0')) {
+ /* stop extra processing */
+ flow->extra_packets_func = NULL; /* We're good now */
+ return(0);
+ }
+
+ /* Possibly more processing */
+ return(1);
+}
+
+/* ************************************************************************ */
+
static void ndpi_int_ssh_add_connection(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow) {
+ if(flow->extra_packets_func != NULL)
+ return;
+
+ flow->guessed_host_protocol_id = flow->guessed_protocol_id = NDPI_PROTOCOL_SSH;
+
+ /* This is necessary to inform the core to call this dissector again */
+ flow->check_extra_packets = 1;
+ flow->max_extra_packets_to_check = 12;
+ flow->extra_packets_func = search_ssh_again;
+
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSH, NDPI_PROTOCOL_UNKNOWN);
}
@@ -185,7 +211,7 @@ static u_int16_t concat_hash_string(struct ndpi_packet_struct *packet,
/* ssh.languages_server_to_client [None] */
#ifdef SSH_DEBUG
- printf("\n[SSH] %s\n", buf);
+ printf("[SSH] %s\n", buf);
#endif
return(buf_out_len);
@@ -193,7 +219,7 @@ static u_int16_t concat_hash_string(struct ndpi_packet_struct *packet,
invalid_payload:
#ifdef SSH_DEBUG
- printf("\n[SSH] Invalid packet payload\n");
+ printf("[SSH] Invalid packet payload\n");
#endif
return(0);
@@ -215,27 +241,11 @@ static void ndpi_ssh_zap_cr(char *str, int len) {
/* ************************************************************************ */
-static int search_ssh_again(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
- ndpi_search_ssh_tcp(ndpi_struct, flow);
-
- if((flow->protos.ssh.hassh_client[0] != '\0')
- && (flow->protos.ssh.hassh_server[0] == '\0')) {
- /* stop extra processing */
- flow->extra_packets_func = NULL; /* We're good now */
- return(0);
- }
-
- /* Possibly more processing */
- return(1);
-}
-
-/* ************************************************************************ */
-
static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &flow->packet;
#ifdef SSH_DEBUG
- printf("\n[SSH] [stage: %u]\n", flow->l4.tcp.ssh_stage);
+ printf("[SSH] %s()\n", __FUNCTION__);
#endif
if(flow->l4.tcp.ssh_stage == 0) {
@@ -249,20 +259,13 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
ndpi_ssh_zap_cr(flow->protos.ssh.client_signature, len);
#ifdef SSH_DEBUG
- printf("\n[SSH] [client_signature: %s]\n", flow->protos.ssh.client_signature);
+ printf("[SSH] [client_signature: %s]\n", flow->protos.ssh.client_signature);
#endif
}
NDPI_LOG_DBG2(ndpi_struct, "ssh stage 0 passed\n");
flow->l4.tcp.ssh_stage = 1 + packet->packet_direction;
- flow->guessed_host_protocol_id = flow->guessed_protocol_id = NDPI_PROTOCOL_SSH;
ndpi_int_ssh_add_connection(ndpi_struct, flow);
-
- /* This is necessary to inform the core to call this dissector again */
- flow->check_extra_packets = 1;
- flow->max_extra_packets_to_check = 8;
- flow->extra_packets_func = search_ssh_again;
-
return;
}
} else if(flow->l4.tcp.ssh_stage == (2 - packet->packet_direction)) {
@@ -276,7 +279,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
ndpi_ssh_zap_cr(flow->protos.ssh.server_signature, len);
#ifdef SSH_DEBUG
- printf("\n[SSH] [server_signature: %s]\n", flow->protos.ssh.server_signature);
+ printf("[SSH] [server_signature: %s]\n", flow->protos.ssh.server_signature);
#endif
NDPI_LOG_DBG2(ndpi_struct, "ssh stage 1 passed\n");
@@ -287,7 +290,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
#ifdef SSH_DEBUG
- printf("\n[SSH] [completed stage: %u]\n", flow->l4.tcp.ssh_stage);
+ printf("[SSH] [completed stage: %u]\n", flow->l4.tcp.ssh_stage);
#endif
flow->l4.tcp.ssh_stage = 3;
@@ -297,16 +300,16 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
u_int8_t msgcode = *(packet->payload + 5);
ndpi_MD5_CTX ctx;
-#ifdef SSH_DEBUG
- printf("\n[SSH] [stage: %u][msg: %u]\n", flow->l4.tcp.ssh_stage, msgcode);
-#endif
-
if(msgcode == 20 /* key exchange init */) {
char *hassh_buf = calloc(packet->payload_packet_len, sizeof(char));
u_int i, len;
+#ifdef SSH_DEBUG
+ printf("[SSH] [stage: %u][msg: %u][direction: %u][key exchange init]\n", flow->l4.tcp.ssh_stage, msgcode, packet->packet_direction);
+#endif
+
if(hassh_buf) {
- if(flow->l4.tcp.ssh_stage == 3) {
+ if(packet->packet_direction == 0 /* client */) {
u_char fingerprint_client[16];
len = concat_hash_string(packet, hassh_buf, 1 /* client */);
@@ -317,7 +320,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
#ifdef SSH_DEBUG
{
- printf("\n[SSH] [client][%s][", hassh_buf);
+ printf("[SSH] [client][%s][", hassh_buf);
for(i=0; i<16; i++) printf("%02X", fingerprint_client[i]);
printf("]\n");
}
@@ -335,7 +338,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
#ifdef SSH_DEBUG
{
- printf("\n[SSH] [server][%s][", hassh_buf);
+ printf("[SSH] [server][%s][", hassh_buf);
for(i=0; i<16; i++) printf("%02X", fingerprint_server[i]);
printf("]\n");
}
@@ -347,11 +350,14 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
free(hassh_buf);
}
- }
- if(flow->l4.tcp.ssh_stage++ == 4) {
- NDPI_LOG_INFO(ndpi_struct, "found ssh\n");
ndpi_int_ssh_add_connection(ndpi_struct, flow);
+ }
+
+ if((flow->protos.ssh.hassh_client[0] != '\0') && (flow->protos.ssh.hassh_server[0] != '\0')) {
+#ifdef SSH_DEBUG
+ printf("[SSH] Dissection completed\n");
+#endif
flow->extra_packets_func = NULL; /* We're good now */
}
@@ -359,7 +365,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
#ifdef SSH_DEBUG
- printf("\n[SSH] Excluding SSH");
+ printf("[SSH] Excluding SSH");
#endif
NDPI_LOG_DBG(ndpi_struct, "excluding ssh at stage %d\n", flow->l4.tcp.ssh_stage);
Powered by cgit, Themed by Ted Yin.