aboutsummaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/ndpi_main.c54
-rw-r--r--src/lib/protocols/ssl.c92
2 files changed, 117 insertions, 29 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 8ed89e3ae..537893567 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1616,7 +1616,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "Nintendo", NDPI_PROTOCOL_CATEGORY_GAME,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
-
+
/* calling function for host and content matched protocols */
init_string_based_protocols(ndpi_mod);
@@ -1635,7 +1635,7 @@ static int ac_match_handler(AC_MATCH_t *m, void *param) {
/*
Return 1 for stopping to the first match.
We might consider searching for the more
- specific match, paying more cpu cycles.
+ specific match, paying more cpu cycles.
*/
*matching_protocol_id = m->patterns[0].rep.number;
@@ -3426,6 +3426,50 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
/* ********************************************************************************* */
+void ndpi_process_extra_packet(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow,
+ const unsigned char *packet,
+ const unsigned short packetlen,
+ const u_int64_t current_tick_l,
+ struct ndpi_id_struct *src,
+ struct ndpi_id_struct *dst)
+{
+ if(flow == NULL)
+ return;
+
+ if(flow->server_id == NULL) flow->server_id = dst; /* Default */
+
+ /* need at least 20 bytes for ip header */
+ if(packetlen < 20) {
+ return;
+ }
+
+ flow->packet.tick_timestamp_l = current_tick_l;
+ flow->packet.tick_timestamp = (u_int32_t)current_tick_l/1000;
+
+ /* parse packet */
+ flow->packet.iph = (struct ndpi_iphdr *)packet;
+ /* we are interested in ipv4 packet */
+
+ /* set up the packet headers for the extra packet function to use if it wants */
+ if(ndpi_init_packet_header(ndpi_struct, flow, packetlen) != 0)
+ return;
+
+ /* detect traffic for tcp or udp only */
+ flow->src = src, flow->dst = dst;
+ ndpi_connection_tracking(ndpi_struct, flow);
+
+ /* call the extra packet function (which may add more data/info to flow) */
+ if (flow->extra_packets_func) {
+ if ((flow->extra_packets_func(ndpi_struct, flow)) == 0)
+ flow->check_extra_packets = 0;
+ }
+
+ flow->num_extra_packets_checked++;
+}
+
+/* ********************************************************************************* */
+
ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
const unsigned char *packet,
@@ -4622,7 +4666,7 @@ int ndpi_match_prefix(const u_int8_t *payload, size_t payload_len,
const char *str, size_t str_len)
{
int rc = str_len <= payload_len ? memcmp(payload, str, str_len) == 0 : 0;
-
+
return rc;
}
@@ -4635,7 +4679,7 @@ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_stru
AC_TEXT_t ac_input_text;
ndpi_automa *automa = is_host_match ? &ndpi_struct->host_automa : &ndpi_struct->content_automa;
int rc;
-
+
if((automa->ac_automa == NULL) || (string_to_match_len == 0)) return(NDPI_PROTOCOL_UNKNOWN);
if(!automa->ac_automa_finalized) {
@@ -4645,7 +4689,7 @@ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_stru
ac_input_text.astring = string_to_match, ac_input_text.length = string_to_match_len;
ac_automata_search(((AC_AUTOMATA_t*)automa->ac_automa), &ac_input_text, (void*)&matching_protocol_id);
-
+
ac_automata_reset(((AC_AUTOMATA_t*)automa->ac_automa));
return(matching_protocol_id);
diff --git a/src/lib/protocols/ssl.c b/src/lib/protocols/ssl.c
index 5860abed7..5afca5389 100644
--- a/src/lib/protocols/ssl.c
+++ b/src/lib/protocols/ssl.c
@@ -47,7 +47,7 @@ static u_int32_t ndpi_ssl_refine_master_protocol(struct ndpi_detection_module_st
if(packet->tcp != NULL) {
switch(protocol) {
-
+
case NDPI_PROTOCOL_SSL:
case NDPI_PROTOCOL_SSL_NO_CERT:
{
@@ -57,7 +57,7 @@ static u_int32_t ndpi_ssl_refine_master_protocol(struct ndpi_detection_module_st
*/
u_int16_t sport = ntohs(packet->tcp->source);
u_int16_t dport = ntohs(packet->tcp->dest);
-
+
if((sport == 465) || (dport == 465))
protocol = NDPI_PROTOCOL_MAIL_SMTPS;
else if((sport == 993) || (dport == 993)
@@ -70,7 +70,7 @@ static u_int32_t ndpi_ssl_refine_master_protocol(struct ndpi_detection_module_st
break;
}
}
-
+
return protocol;
}
@@ -98,14 +98,14 @@ static void ndpi_int_ssl_add_connection(struct ndpi_detection_module_struct *ndp
((ch) >= '{' && (ch) <= '~'))
static void stripCertificateTrailer(char *buffer, int buffer_len) {
-
+
int i, is_puny;
-
+
// printf("->%s<-\n", buffer);
-
+
for(i = 0; i < buffer_len; i++) {
// printf("%c [%d]\n", buffer[i], buffer[i]);
-
+
if((buffer[i] != '.')
&& (buffer[i] != '-')
&& (buffer[i] != '_')
@@ -120,12 +120,12 @@ static void stripCertificateTrailer(char *buffer, int buffer_len) {
/* check for punycode encoding */
is_puny = check_punycode_string(buffer, buffer_len);
-
+
// not a punycode string - need more checks
if(is_puny == 0) {
-
+
if(i > 0) i--;
-
+
while(i > 0) {
if(!ndpi_isalpha(buffer[i])) {
buffer[i] = '\0';
@@ -134,8 +134,8 @@ static void stripCertificateTrailer(char *buffer, int buffer_len) {
} else
break;
}
-
- for(i = buffer_len; i > 0; i--) {
+
+ for(i = buffer_len; i > 0; i--) {
if(buffer[i] == '.') break;
else if(ndpi_isdigit(buffer[i]))
buffer[i] = '\0', buffer_len = i;
@@ -306,6 +306,46 @@ int getSSLcertificate(struct ndpi_detection_module_struct *ndpi_struct,
return(0); /* Not found */
}
+int sslTryAndRetrieveServerCertificate(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ /* consider only specific SSL packets (handshake) */
+ if((packet->payload_packet_len > 9) && (packet->payload[0] == 0x16)) {
+ char certificate[64];
+ int rc;
+ certificate[0] = '\0';
+ rc = getSSLcertificate(ndpi_struct, flow, certificate, sizeof(certificate));
+ packet->ssl_certificate_num_checks++;
+ if (rc > 0) {
+ packet->ssl_certificate_detected++;
+ if (flow->protos.ssl.server_certificate[0] != '\0')
+ /* 0 means we're done processing extra packets (since we found what we wanted) */
+ return 0;
+ }
+ /* Client hello, Server Hello, and certificate packets probably all checked in this case */
+ if ((packet->ssl_certificate_num_checks >= 3)
+ && (flow->l4.tcp.seen_syn)
+ && (flow->l4.tcp.seen_syn_ack)
+ && (flow->l4.tcp.seen_ack) /* We have seen the 3-way handshake */)
+ {
+ /* We're done processing extra packets since we've probably checked all possible cert packets */
+ return 0;
+ }
+ }
+ /* 1 means keep looking for more packets */
+ return 1;
+}
+
+void sslInitExtraPacketProcessing(int caseNum, struct ndpi_flow_struct *flow) {
+ flow->check_extra_packets = 1;
+ /* 0 is the case for waiting for the server certificate */
+ if (caseNum == 0) {
+ /* At most 7 packets should almost always be enough to find the server certificate if it's there */
+ flow->max_extra_packets_to_check = 7;
+ flow->extra_packets_func = sslTryAndRetrieveServerCertificate;
+ }
+}
+
int sslDetectProtocolFromCertificate(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &flow->packet;
@@ -325,18 +365,22 @@ int sslDetectProtocolFromCertificate(struct ndpi_detection_module_struct *ndpi_s
#ifdef CERTIFICATE_DEBUG
printf("***** [SSL] %s\n", certificate);
#endif
- u_int32_t subproto = ndpi_match_host_subprotocol(ndpi_struct, flow, certificate,
+ u_int32_t subproto = ndpi_match_host_subprotocol(ndpi_struct, flow, certificate,
strlen(certificate), NDPI_PROTOCOL_SSL);
-
if(subproto != NDPI_PROTOCOL_UNKNOWN) {
- ndpi_set_detected_protocol(ndpi_struct, flow, subproto,
- ndpi_ssl_refine_master_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSL));
- return(rc); /* Fix courtesy of Gianluca Costa <g.costa@xplico.org> */
- }
-
+ /* If we've detected the subprotocol from client certificate but haven't had a chance
+ * to see the server certificate yet, set up extra packet processing to wait
+ * a few more packets. */
+ if((flow->protos.ssl.client_certificate[0] != '\0') && (flow->protos.ssl.server_certificate[0] == '\0')) {
+ sslInitExtraPacketProcessing(0, flow);
+ }
+ ndpi_set_detected_protocol(ndpi_struct, flow, subproto,
+ ndpi_ssl_refine_master_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSL));
+ return(rc); /* Fix courtesy of Gianluca Costa <g.costa@xplico.org> */
+ }
#ifdef NDPI_PROTOCOL_TOR
- if(ndpi_is_ssl_tor(ndpi_struct, flow, certificate) != 0)
- return(rc);
+ if(ndpi_is_ssl_tor(ndpi_struct, flow, certificate) != 0)
+ return(rc);
#endif
}
@@ -346,11 +390,11 @@ int sslDetectProtocolFromCertificate(struct ndpi_detection_module_struct *ndpi_s
&& flow->l4.tcp.seen_ack /* We have seen the 3-way handshake */)
|| (flow->protos.ssl.server_certificate[0] != '\0')
/* || (flow->protos.ssl.client_certificate[0] != '\0') */
- )
+ ) {
ndpi_int_ssl_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_SSL);
- }
+ }
}
-
+ }
return(0);
}
Powered by cgit, Themed by Ted Yin.