diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/ciscovpn.c | 65 |
1 files changed, 1 insertions, 64 deletions
diff --git a/src/lib/protocols/ciscovpn.c b/src/lib/protocols/ciscovpn.c index d7fa21d5b..a356dd6cf 100644 --- a/src/lib/protocols/ciscovpn.c +++ b/src/lib/protocols/ciscovpn.c @@ -39,63 +39,15 @@ void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, stru { struct ndpi_packet_struct *packet = &ndpi_struct->packet; u_int16_t udport = 0, usport = 0; - u_int16_t tdport = 0, tsport = 0; - NDPI_LOG_DBG(ndpi_struct, "search CISCOVPN\n"); - if(packet->tcp != NULL) { - tsport = ntohs(packet->tcp->source), tdport = ntohs(packet->tcp->dest); - NDPI_LOG_DBG2(ndpi_struct, "calculated CISCOVPN over tcp ports\n"); - } - if(packet->udp != NULL) { usport = ntohs(packet->udp->source), udport = ntohs(packet->udp->dest); NDPI_LOG_DBG2(ndpi_struct, "calculated CISCOVPN over udp ports\n"); } - if((tdport == 10000 && tsport == 10000) || - ((tsport == 443 || tdport == 443) && - (packet->payload_packet_len >= 4) && - (packet->payload[0] == 0x17 /* TLS Application Data */ && - packet->payload[1] == 0x01 && - packet->payload[2] == 0x00 && - packet->payload[3] == 0x00) - ) - ) { - /* This is a good query 17010000*/ - NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); - ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); - return; - } -#if 0 - /* Code disabled as it is too generic and it can lead to false positives */ - else if(((tsport == 443 || tdport == 443) || - (tsport == 80 || tdport == 80)) && - (packet->payload_packet_len >= 5) && - ((packet->payload[0] == 0x17 /* TLS Application Data */ && - packet->payload[1] == 0x03 && packet->payload[2] == 0x03 && /* TLS 1.2 */ - packet->payload[3] == 0x00 && packet->payload[4] == 0x3A /* Length */))) - { - /* TLS signature of Cisco AnyConnect 0X170303003A */ - NDPI_LOG_INFO(ndpi_struct, "found CISCO Anyconnect VPN\n"); - ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); - return; - } -#endif - else if(((tsport == 8009 || tdport == 8009) || - (tsport == 8008 || tdport == 8008)) && - (packet->payload_packet_len >= 5) && - ((packet->payload[0] == 0x17 /* TLS Application Data */ && - packet->payload[1] == 0x03 && packet->payload[2] == 0x03 && /* TLS 1.2 */ - packet->payload[3] == 0x00 && packet->payload[4] == 0x69 /* Length */))) - { - /* TCP signature of Cisco AnyConnect 0X1703030069 */ - NDPI_LOG_INFO(ndpi_struct, "found CISCO Anyconnect VPN\n"); - ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); - return; - } - else if( + if( ( (usport == 10000 && udport == 10000) && @@ -110,21 +62,6 @@ void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, stru /* This is a good query fe577e2b */ NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); - } else if( - ( - (usport == 443 || udport == 443) - && - (packet->payload_packet_len >= 5) && - (packet->payload[0] == 0x17 /* TLS Application Data */ && - packet->payload[1] == 0x01 && - packet->payload[2] == 0x00 && - packet->payload[3] == 0x00 && - packet->payload[4] == 0x01) - ) - ) - { - NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); - ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); return; } |