aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols/mail_smtp.c
Commit message (Collapse)AuthorAge
* Fix writes to `flow->protos` union fields (#1354)Ivan Nardi2021-11-15
| | | | | | | | | | | | | | | | | | | | | | | | | We can write to `flow->protos` only after a proper classification. This issue has been found in Kerberos, DHCP, HTTP, STUN, IMO, FTP, SMTP, IMAP and POP code. There are two kinds of fixes: * write to `flow->protos` only if a final protocol has been detected * move protocol state out of `flow->protos` The hard part is to find, for each protocol, the right tradeoff between memory usage and code complexity. Handle Kerberos like DNS: if we find a request, we set the protocol and an extra callback to further parsing the reply. For all the other protocols, move the state out of `flow->protos`. This is an issue only for the FTP/MAIL stuff. Add DHCP Class Identification value to the output of ndpiReader and to the Jason serialization. Extend code coverage of fuzz tests. Close #1343 Close #1342
* IMAP, POP3, SMTP: improve dissection (#1368)Ivan Nardi2021-11-11
| | | Avoid NATS false positives
* Remove `struct ndpi_packet_struct` from `struct ndpi_flow_struct` (#1319)Ivan Nardi2021-10-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are no real reasons to embed `struct ndpi_packet_struct` (i.e. "packet") in `struct ndpi_flow_struct` (i.e. "flow"). In other words, we can avoid saving dissection information of "current packet" into the "flow" state, i.e. in the flow management table. The nDPI detection module processes only one packet at the time, so it is safe to save packet dissection information in `struct ndpi_detection_module_struct`, reusing always the same "packet" instance and saving a huge amount of memory. Bottom line: we need only one copy of "packet" (for detection module), not one for each "flow". It is not clear how/why "packet" ended up in "flow" in the first place. It has been there since the beginning of the GIT history, but in the original OpenDPI code `struct ipoque_packet_struct` was embedded in `struct ipoque_detection_module_struct`, i.e. there was the same exact situation this commit wants to achieve. Most of the changes in this PR are some boilerplate to update something like "flow->packet" into something like "module->packet" throughout the code. Some attention has been paid to update `ndpi_init_packet()` since we need to reset some "packet" fields before starting to process another packet. There has been one important change, though, in ndpi_detection_giveup(). Nothing changed for the applications/users, but this function can't access "packet" anymore. The reason is that this function can be called "asynchronously" with respect to the data processing, i.e in context where there is no valid notion of "current packet"; for example ndpiReader calls it after having processed all the traffic, iterating the entire session table. Mining LRU stuff seems a bit odd (even before this patch): probably we need to rethink it, as a follow-up.
* Added new risk for clear text credentialsLuca Deri2021-09-10
|
* Compile everything with "-W -Wall -Wno-unused-parameter" flags (#1276)Ivan Nardi2021-08-20
| | | | | | | | | | | | | | | | Fix all the warnings. Getting rid of "-Wno-unused-parameter" is quite complex because some parameters usage depends on compilation variable (i.e. `--enable-debug-messages`). The "-Werror" flag has been added only in Travis builds to avoid breaking the builds to users using uncommon/untested OS/compiler/enviroment. Tested on: * x86_64; Ubuntu 20.04; gcc 7,8,9,10,11; clang 7,8,9,10,11,12 * x86_64; CentOS 7.7; gcc 4.8.5 (with "--disable-gcrypt" flag) * Raspberry 4; Debian 10.10; gcc 8.3.0
* Added check to avoid clases on similar protocols (FTP adn SMTP) on setting ↵Luca Deri2021-08-11
| | | | hostname
* Added extraction of hostname in SMTPLuca Deri2021-08-11
| | | | Fixed mail incalid subprotocol calculation
* Added checks for giving up faster on IRC and SMTPLuca Deri2021-02-09
|
* (C) UpdateLuca Deri2021-01-07
|
* Fix some debug messagesNardi Ivan2020-04-08
|
* Fix memory invalid access in SMTP and leaks in TLSemanuele-f2020-02-13
|
* Fix invalid memory reademanuele-f2020-02-12
|
* Updated (C)Luca Deri2020-01-05
|
* Fixed bug that prevented SMTP email to be dissectedLuca Deri2019-12-09
|
* Code improvementsLuca Deri2019-12-09
|
* Memory fixesLuca Deri2019-11-23
|
* SMTP and SSH dissection fixesLuca Deri2019-10-24
|
* Added extra processing for POP and SMTPLuca Deri2019-10-22
|
* Reworked email metaata extractionLuca Deri2019-10-21
|
* Adedd DTLS check in STUNLuca Deri2019-09-21
| | | | Uodated (C)
* Hardening fixes for packer parsingLuca Deri2019-05-03
|
* Major code cleanupLuca2018-07-21
| | | | Converted some not popular protocols to NDPI_PROTOCOL_GENERIC with category detection
* Refactoring the debugging output.Vitaly Lavrov2017-10-26
| | | | | | | | | | | | | | levels of debug output: 0 - ERROR: Only for errors. 1 - TRACE: Start of each packets and if found protocol. 2 - DEBUG: Start of searching each protocol and excluding protocols. 3 - DEBUG_EXTRA: For all other messages. Added field ndpi_struct->debug_logging for enable debug output of each protocols. Simple macros for debugging output are added: NDPI_LOG_ERR(), NDPI_LOG_INFO(), NDPI_LOG_DBG(), NDPI_LOG_DBG2(), NDPI_EXCLUDE_PROTO()
* Fixed invalid indexes used in SMTP dissector.Luca2015-10-09
| | | | See https://github.com/ntop/nDPI/commit/8c4fada42f8e6dcba42281fdc129e0a32b6050dc#commitcomment-13685139
* Reworked protocol initialization. Work in progress (more cleanup is needed)Luca2015-07-08
|
* Split former protocol into upper and lower protocolLuca2015-07-01
|
* Removed commented codeLuca2015-07-01
| | | | Renamed ndpi_int_add_connection() with ndpi_set_detected_protocol()
* deleted protocol type (real-correlated)Michele Campus2015-06-29
|
* Initial import from SVNLuca Deri2015-04-19
Powered by cgit, Themed by Ted Yin.