diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/ssh.c | 59 |
1 files changed, 52 insertions, 7 deletions
diff --git a/src/lib/protocols/ssh.c b/src/lib/protocols/ssh.c index 7679a2337..ac1146ba0 100644 --- a/src/lib/protocols/ssh.c +++ b/src/lib/protocols/ssh.c @@ -25,10 +25,13 @@ #include "ndpi_protocol_ids.h" #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SSH +#define VERSION_CUTOFF 7 #include "ndpi_api.h" #include "ndpi_md5.h" +#include <string.h> + /* HASSH - https://github.com/salesforce/hassh @@ -57,20 +60,62 @@ /* #define SSH_DEBUG 1 */ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); - + /* ************************************************************************ */ -static void ssh_analyse_signature_version(struct ndpi_detection_module_struct *ndpi_struct, +static void ssh_analyze_signature_version(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *str_to_check, u_int8_t is_client_signature) { - + if (str_to_check == NULL) return; + + char *rem; + char *signature; + char *version; + int major_number; + + char *copy = (char*)ndpi_malloc(sizeof(char)*(strlen(str_to_check)+1)); + int obsolete_ssh_version = 0; + /* - if(obsolete_ssh_version) - NDPI_SET_BIT(flow->risk, is_client_signature ? NDPI_SSH_OBSOLETE_CLIENT_SIGNATURE : NDPI_SSH_OBSOLETE_SERVER_SIGNATURE); + string example: SSH-2.0-OpenSSH_5.3 */ + strcpy(copy, str_to_check); + + /* SSH */ + strtok_r(copy, "-", &rem); + + /* 2.0 */ + strtok_r(NULL, "-", &rem); + /* signature = OpenSSH_5.3 */ + signature = strtok_r(NULL, "-", &rem); + + /* OpenSSH */ + strtok_r(signature, "_", &rem); + + /* version = 5.3 */ + version = strtok_r(NULL, "_", &rem); + + if (version == NULL) return; + + /* major_number = 5 */ + major_number = atoi(strtok_r(version, ".", &rem)); + + if (major_number < VERSION_CUTOFF) { + obsolete_ssh_version = 1; + } + + #ifdef SSH_DEBUG + if(obsolete_ssh_version) + printf("[SSH] Obsolete signature\n"); + #endif + + if(obsolete_ssh_version) + NDPI_SET_BIT(flow->risk, is_client_signature ? NDPI_SSH_OBSOLETE_CLIENT_SIGNATURE : NDPI_SSH_OBSOLETE_SERVER_SIGNATURE); + + ndpi_free(copy); } /* ************************************************************************ */ @@ -303,7 +348,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct flow->protos.ssh.client_signature[len] = '\0'; ndpi_ssh_zap_cr(flow->protos.ssh.client_signature, len); - ssh_analyse_signature_version(ndpi_struct, flow, flow->protos.ssh.client_signature, 1); + ssh_analyze_signature_version(ndpi_struct, flow, flow->protos.ssh.client_signature, 1); #ifdef SSH_DEBUG printf("[SSH] [client_signature: %s]\n", flow->protos.ssh.client_signature); @@ -323,7 +368,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct flow->protos.ssh.server_signature[len] = '\0'; ndpi_ssh_zap_cr(flow->protos.ssh.server_signature, len); - ssh_analyse_signature_version(ndpi_struct, flow, flow->protos.ssh.server_signature, 0); + ssh_analyze_signature_version(ndpi_struct, flow, flow->protos.ssh.server_signature, 0); #ifdef SSH_DEBUG printf("[SSH] [server_signature: %s]\n", flow->protos.ssh.server_signature); |