From 00857abf2c008b77f3e1d9eba9505b1b22239543 Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Fri, 10 Sep 2021 22:00:04 +0200 Subject: Added new risk for clear text credentials --- src/lib/protocols/ftp_control.c | 7 +++++-- src/lib/protocols/http.c | 7 +++++++ src/lib/protocols/mail_imap.c | 2 ++ src/lib/protocols/mail_pop.c | 6 ++++-- src/lib/protocols/mail_smtp.c | 4 ++++ 5 files changed, 22 insertions(+), 4 deletions(-) (limited to 'src/lib/protocols') diff --git a/src/lib/protocols/ftp_control.c b/src/lib/protocols/ftp_control.c index 7bf35e719..55ea192b0 100644 --- a/src/lib/protocols/ftp_control.c +++ b/src/lib/protocols/ftp_control.c @@ -41,7 +41,8 @@ static void ndpi_int_ftp_control_add_connection(struct ndpi_detection_module_str /* *************************************************************** */ -static int ndpi_ftp_control_check_request(struct ndpi_flow_struct *flow, +static int ndpi_ftp_control_check_request(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow, const u_int8_t *payload, size_t payload_len) { #ifdef FTP_DEBUG @@ -52,6 +53,7 @@ static int ndpi_ftp_control_check_request(struct ndpi_flow_struct *flow, ndpi_user_pwd_payload_copy((u_int8_t*)flow->protos.ftp_imap_pop_smtp.username, sizeof(flow->protos.ftp_imap_pop_smtp.username), 5, payload, payload_len); + ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS); return 1; } @@ -602,7 +604,8 @@ static void ndpi_check_ftp_control(struct ndpi_detection_module_struct *ndpi_str if(flow->ftp_control_stage == 0) { NDPI_LOG_DBG2(ndpi_struct, "FTP_CONTROL stage 0: \n"); - if((payload_len > 0) && ndpi_ftp_control_check_request(flow, packet->payload, payload_len)) { + if((payload_len > 0) && ndpi_ftp_control_check_request(ndpi_struct, + flow, packet->payload, payload_len)) { NDPI_LOG_DBG2(ndpi_struct, "Possible FTP_CONTROL request detected, we will look further for the response..\n"); diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index 1a3e2e357..0da3a16e7 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -625,6 +625,13 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ } } + /* check for authorization line */ + if(packet->authorization_line.ptr != NULL) { + NDPI_LOG_DBG2(ndpi_struct, "Authorization line found %.*s\n", + packet->authorization_line.len, packet->authorization_line.ptr); + ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS); + } + if(packet->content_line.ptr != NULL && packet->content_line.len != 0) { NDPI_LOG_DBG2(ndpi_struct, "Content Type line found %.*s\n", packet->content_line.len, packet->content_line.ptr); diff --git a/src/lib/protocols/mail_imap.c b/src/lib/protocols/mail_imap.c index 7fc50c4b7..5810ec219 100644 --- a/src/lib/protocols/mail_imap.c +++ b/src/lib/protocols/mail_imap.c @@ -162,6 +162,8 @@ void ndpi_search_mail_imap_tcp(struct ndpi_detection_module_struct *ndpi_struct, /* xxxx LOGIN "username" "password" */ char str[256], *item; u_int len = packet->payload_packet_len >= sizeof(str) ? sizeof(str)-1 : packet->payload_packet_len; + + ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS); strncpy(str, (const char*)packet->payload, len); str[len] = '\0'; diff --git a/src/lib/protocols/mail_pop.c b/src/lib/protocols/mail_pop.c index feb2757a2..e522fc187 100644 --- a/src/lib/protocols/mail_pop.c +++ b/src/lib/protocols/mail_pop.c @@ -80,7 +80,8 @@ static int ndpi_int_mail_pop_check_for_client_commands(struct ndpi_detection_mod ndpi_user_pwd_payload_copy((u_int8_t*)flow->protos.ftp_imap_pop_smtp.username, sizeof(flow->protos.ftp_imap_pop_smtp.username), 5, packet->payload, packet->payload_packet_len); - + + ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS); flow->l4.tcp.pop_command_bitmask |= POP_BIT_USER; return 1; } else if((packet->payload[0] == 'P' || packet->payload[0] == 'p') @@ -90,7 +91,8 @@ static int ndpi_int_mail_pop_check_for_client_commands(struct ndpi_detection_mod ndpi_user_pwd_payload_copy((u_int8_t*)flow->protos.ftp_imap_pop_smtp.password, sizeof(flow->protos.ftp_imap_pop_smtp.password), 5, packet->payload, packet->payload_packet_len); - + + ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS); flow->l4.tcp.pop_command_bitmask |= POP_BIT_PASS; return 1; } else if((packet->payload[0] == 'C' || packet->payload[0] == 'c') diff --git a/src/lib/protocols/mail_smtp.c b/src/lib/protocols/mail_smtp.c index 66e4cc0f0..256026c25 100644 --- a/src/lib/protocols/mail_smtp.c +++ b/src/lib/protocols/mail_smtp.c @@ -187,6 +187,8 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, ndpi_free(out); } + + ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS); } else if(flow->protos.ftp_imap_pop_smtp.password[0] == '\0') { /* Password */ u_int8_t buf[48]; @@ -210,6 +212,8 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, ndpi_free(out); } + + ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS); } else { flow->host_server_name[0] = '\0'; NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -- cgit v1.2.3