mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-10-29 18:43:48 +00:00
A final(?) effort to reduce memory usage per flow (#1389)
Remove some unused fields and re-organize other ones. In particular: * Update the parameters of `ndpi_ssl_version2str()` function * Zattoo, Thunder: these timestamps aren't really used. * Ftp/mail: these protocols are dissected only over TCP. * Attention must be paid to TLS.Bittorrent flows to avoid invalid read/write to `flow->protos.bittorrent.hash` field. This is the last(?) commit of a long series (see22241a1d,227e586e,730c2360,a8ffcd8b) aiming to reduce library memory consumption. Before, at nDPI 4.0 (more precisly, ata6b10cf7, because memory stats were wrong until that commit): ``` nDPI Memory statistics: nDPI Memory (once): 221.15 KB Flow Memory (per flow): 2.94 KB ``` Now: ``` nDPI Memory statistics: nDPI Memory (once): 231.71 KB Flow Memory (per flow): 1008 B <--------- ``` i.e. memory usage per flow has been reduced by 66%, dropping below the psychological threshold of 1 KB. To further reduce this value, we probably need to look into #1279: let's fight this battle another day.
This commit is contained in:
Ivan Nardi
GitHub
parent
02da143e45
commit
91bb77a880
19 changed files with 167 additions and 213 deletions
|
|
@ -1221,6 +1221,7 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
|
|||
FILE *out = results_file ? results_file : stdout;
|
||||
u_int8_t known_tls;
|
||||
char buf[32], buf1[64];
|
||||
char buf_ver[16];
|
||||
u_int i;
|
||||
|
||||
double dos_ge_score;
|
||||
|
|
@ -1315,7 +1316,7 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
|
|||
(flow->ssh_tls.server_info[0] != '\0') ? flow->ssh_tls.server_info : "");
|
||||
|
||||
fprintf(csv_fp, "%s,%s,%s,%s,%s,",
|
||||
(flow->ssh_tls.ssl_version != 0) ? ndpi_ssl_version2str(flow->ndpi_flow, flow->ssh_tls.ssl_version, &known_tls) : "0",
|
||||
(flow->ssh_tls.ssl_version != 0) ? ndpi_ssl_version2str(buf_ver, sizeof(buf_ver), flow->ssh_tls.ssl_version, &known_tls) : "0",
|
||||
(flow->ssh_tls.ja3_client[0] != '\0') ? flow->ssh_tls.ja3_client : "",
|
||||
(flow->ssh_tls.ja3_client[0] != '\0') ? is_unsafe_cipher(flow->ssh_tls.client_unsafe_cipher) : "0",
|
||||
(flow->ssh_tls.ja3_server[0] != '\0') ? flow->ssh_tls.ja3_server : "",
|
||||
|
|
@ -1481,7 +1482,7 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
|
|||
fprintf(out, "[Risk Score: %u]", ndpi_risk2score(flow->risk, &cli_score, &srv_score));
|
||||
}
|
||||
|
||||
if(flow->ssh_tls.ssl_version != 0) fprintf(out, "[%s]", ndpi_ssl_version2str(flow->ndpi_flow, flow->ssh_tls.ssl_version, &known_tls));
|
||||
if(flow->ssh_tls.ssl_version != 0) fprintf(out, "[%s]", ndpi_ssl_version2str(buf_ver, sizeof(buf_ver), flow->ssh_tls.ssl_version, &known_tls));
|
||||
|
||||
if(flow->ssh_tls.client_hassh[0] != '\0') fprintf(out, "[HASSH-C: %s]", flow->ssh_tls.client_hassh);
|
||||
|
||||
|
|
|
|||
|
|
@ -917,11 +917,12 @@ static void ndpi_process_packet(uint8_t * const args,
|
|||
flow_to_process->ndpi_flow->protos.tls_quic.hello_processed != 0)
|
||||
{
|
||||
uint8_t unknown_tls_version = 0;
|
||||
char buf_ver[16];
|
||||
printf("[%8llu, %d, %4d][TLS-CLIENT-HELLO] version: %s | sni: %s | alpn: %s\n",
|
||||
workflow->packets_captured,
|
||||
reader_thread->array_index,
|
||||
flow_to_process->flow_id,
|
||||
ndpi_ssl_version2str(flow_to_process->ndpi_flow,
|
||||
ndpi_ssl_version2str(buf_ver, sizeof(buf_ver),
|
||||
flow_to_process->ndpi_flow->protos.tls_quic.ssl_version,
|
||||
&unknown_tls_version),
|
||||
flow_to_process->ndpi_flow->host_server_name,
|
||||
|
|
@ -933,12 +934,13 @@ static void ndpi_process_packet(uint8_t * const args,
|
|||
flow_to_process->ndpi_flow->l4.tcp.tls.certificate_processed != 0)
|
||||
{
|
||||
uint8_t unknown_tls_version = 0;
|
||||
char buf_ver[16];
|
||||
printf("[%8llu, %d, %4d][TLS-SERVER-HELLO] version: %s | common-name(s): %.*s | "
|
||||
"issuer: %s | subject: %s\n",
|
||||
workflow->packets_captured,
|
||||
reader_thread->array_index,
|
||||
flow_to_process->flow_id,
|
||||
ndpi_ssl_version2str(flow_to_process->ndpi_flow,
|
||||
ndpi_ssl_version2str(buf_ver, sizeof(buf_ver),
|
||||
flow_to_process->ndpi_flow->protos.tls_quic.ssl_version,
|
||||
&unknown_tls_version),
|
||||
(flow_to_process->ndpi_flow->protos.tls_quic.server_names_len == 0 ?
|
||||
|
|
|
|||
|
|
@ -1078,7 +1078,8 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
|
|||
flow->dhcp_fingerprint = ndpi_strdup(flow->ndpi_flow->protos.dhcp.fingerprint);
|
||||
if(flow->ndpi_flow->protos.dhcp.class_ident[0] != '\0')
|
||||
flow->dhcp_class_ident = ndpi_strdup(flow->ndpi_flow->protos.dhcp.class_ident);
|
||||
} else if(is_ndpi_proto(flow, NDPI_PROTOCOL_BITTORRENT)) {
|
||||
} else if(is_ndpi_proto(flow, NDPI_PROTOCOL_BITTORRENT) &&
|
||||
!is_ndpi_proto(flow, NDPI_PROTOCOL_TLS)) {
|
||||
u_int j;
|
||||
|
||||
if(flow->ndpi_flow->protos.bittorrent.hash[0] != '\0') {
|
||||
|
|
@ -1116,11 +1117,11 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
|
|||
|| /* IMAP */ is_ndpi_proto(flow, NDPI_PROTOCOL_MAIL_IMAP)
|
||||
|| /* POP */ is_ndpi_proto(flow, NDPI_PROTOCOL_MAIL_POP)
|
||||
|| /* SMTP */ is_ndpi_proto(flow, NDPI_PROTOCOL_MAIL_SMTP)) {
|
||||
if(flow->ndpi_flow->ftp_imap_pop_smtp.username[0] != '\0')
|
||||
if(flow->ndpi_flow->l4.tcp.ftp_imap_pop_smtp.username[0] != '\0')
|
||||
snprintf(flow->info, sizeof(flow->info), "User: %s][Pwd: %s%s",
|
||||
flow->ndpi_flow->ftp_imap_pop_smtp.username,
|
||||
flow->ndpi_flow->ftp_imap_pop_smtp.password,
|
||||
flow->ndpi_flow->ftp_imap_pop_smtp.auth_failed ? "][Auth Failed" : "");
|
||||
flow->ndpi_flow->l4.tcp.ftp_imap_pop_smtp.username,
|
||||
flow->ndpi_flow->l4.tcp.ftp_imap_pop_smtp.password,
|
||||
flow->ndpi_flow->l4.tcp.ftp_imap_pop_smtp.auth_failed ? "][Auth Failed" : "");
|
||||
}
|
||||
/* KERBEROS */
|
||||
else if(is_ndpi_proto(flow, NDPI_PROTOCOL_KERBEROS)) {
|
||||
|
|
|
|||
|
|
@ -452,12 +452,6 @@ struct ndpi_id_struct {
|
|||
/* NDPI_PROTOCOL_GNUTELLA */
|
||||
uint32_t gnutella_ts;
|
||||
|
||||
/* NDPI_PROTOCOL_THUNDER */
|
||||
uint32_t thunder_ts;
|
||||
|
||||
/* NDPI_PROTOCOL_ZATTOO */
|
||||
uint32_t zattoo_ts;
|
||||
|
||||
/* NDPI_PROTOCOL_UNENCRYPTED_JABBER */
|
||||
uint32_t jabber_stun_or_ft_ts;
|
||||
|
||||
|
|
@ -497,7 +491,6 @@ struct ndpi_flow_tcp_struct {
|
|||
|
||||
/* NDPI_PROTOCOL_IRC */
|
||||
uint8_t irc_stage;
|
||||
uint8_t irc_port;
|
||||
|
||||
/* NDPI_PROTOCOL_H323 */
|
||||
uint8_t h323_valid_packets;
|
||||
|
|
@ -912,11 +905,7 @@ struct ndpi_detection_module_struct {
|
|||
uint32_t irc_timeout;
|
||||
/* gnutella parameters */
|
||||
uint32_t gnutella_timeout;
|
||||
/* thunder parameters */
|
||||
uint32_t thunder_timeout;
|
||||
/* rstp */
|
||||
uint32_t orb_rstp_ts_timeout;
|
||||
uint32_t zattoo_connection_timeout;
|
||||
uint32_t jabber_stun_timeout;
|
||||
uint32_t jabber_file_transfer_timeout;
|
||||
uint8_t ip_version_limit;
|
||||
|
|
@ -1001,12 +990,11 @@ struct ndpi_flow_struct {
|
|||
*/
|
||||
struct {
|
||||
ndpi_http_method method;
|
||||
char *url, *content_type, *user_agent;
|
||||
uint8_t num_request_headers, num_response_headers;
|
||||
uint8_t request_version; /* 0=1.0 and 1=1.1. Create an enum for this? */
|
||||
uint16_t response_status_code; /* 200, 404, etc. */
|
||||
uint8_t detected_os[32]; /* Via HTTP/QUIC User-Agent */
|
||||
uint8_t nat_ip[24];
|
||||
char *url, *content_type, *user_agent;
|
||||
char *detected_os; /* Via HTTP/QUIC User-Agent */
|
||||
char *nat_ip; /* Via HTTP X-Forwarded-For */
|
||||
|
||||
} http;
|
||||
|
||||
|
|
@ -1049,8 +1037,6 @@ struct ndpi_flow_struct {
|
|||
} kerberos;
|
||||
|
||||
struct {
|
||||
char ssl_version_str[12];
|
||||
uint16_t ssl_version, server_names_len;
|
||||
char *server_names, *alpn, *tls_supported_versions, *issuerDN, *subjectDN;
|
||||
uint32_t notBefore, notAfter;
|
||||
char ja3_client[33], ja3_server[33];
|
||||
|
|
@ -1062,6 +1048,7 @@ struct ndpi_flow_struct {
|
|||
char *esni;
|
||||
} encrypted_sni;
|
||||
ndpi_cipher_weakness server_unsafe_cipher;
|
||||
uint16_t ssl_version, server_names_len;
|
||||
} tls_quic;
|
||||
|
||||
struct {
|
||||
|
|
|
|||
|
|
@ -257,10 +257,6 @@ NDPIDetectionModuleStruct._fields_ = [
|
|||
("protocols_ptree", c_void_p),
|
||||
("irc_timeout", c_uint32),
|
||||
("gnutella_timeout", c_uint32),
|
||||
("battlefield_timeout", c_uint32),
|
||||
("thunder_timeout", c_uint32),
|
||||
("tvants_connection_timeout", c_uint32),
|
||||
("orb_rstp_ts_timeout", c_uint32),
|
||||
("zattoo_connection_timeout", c_uint32),
|
||||
("jabber_stun_timeout", c_uint32),
|
||||
("jabber_file_transfer_timeout", c_uint32),
|
||||
|
|
@ -309,10 +305,7 @@ class NDPIIdStruct(Structure):
|
|||
('irc_ts', c_uint32),
|
||||
('gnutella_ts', c_uint32),
|
||||
('battlefield_ts', c_uint32),
|
||||
('thunder_ts', c_uint32),
|
||||
('rtsp_timer', c_uint32),
|
||||
('oscar_last_safe_access_time', c_uint32),
|
||||
('zattoo_ts', c_uint32),
|
||||
('jabber_stun_or_ft_ts', c_uint32),
|
||||
('directconnect_last_safe_access_time', c_uint32),
|
||||
('detected_directconnect_port', c_uint16),
|
||||
|
|
@ -335,7 +328,6 @@ class NDPIFlowTcpStruct(Structure):
|
|||
('pop_command_bitmask', c_uint16),
|
||||
('wa_matched_so_far', c_uint8),
|
||||
('irc_stage', c_uint8),
|
||||
('irc_port', c_uint8),
|
||||
('h323_valid_packets', c_uint8),
|
||||
('gnutella_msg_id', c_uint8 * 3),
|
||||
('irc_3a_counter', c_uint32, 3),
|
||||
|
|
@ -422,14 +414,13 @@ class L4(Union):
|
|||
class Http(Structure):
|
||||
_fields_ = [
|
||||
("method", c_int),
|
||||
("url", c_char_p),
|
||||
("content_type", c_char_p),
|
||||
("num_request_headers", c_uint8),
|
||||
("num_response_headers", c_uint8),
|
||||
("request_version", c_uint8),
|
||||
("response_status_code", c_uint16),
|
||||
("detected_os", c_char * 32),
|
||||
("nat_ip", c_char * 24),
|
||||
("url", c_char_p),
|
||||
("content_type", c_char_p),
|
||||
("user_agent", c_char_p),
|
||||
("detected_os", c_char_p),
|
||||
("nat_ip", c_char_p),
|
||||
]
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -975,7 +975,7 @@ extern "C" {
|
|||
/* Return a flow info string (summarized). Does only work for DNS/HTTP/TLS/QUIC. */
|
||||
const char* ndpi_get_flow_info(struct ndpi_flow_struct const * const flow,
|
||||
ndpi_protocol const * const l7_protocol);
|
||||
char* ndpi_ssl_version2str(struct ndpi_flow_struct *flow,
|
||||
char* ndpi_ssl_version2str(char *buf, int buf_len,
|
||||
u_int16_t version, u_int8_t *unknown_tls_version);
|
||||
int ndpi_netbios_name_interpret(u_char *in, u_int in_len, u_char *out, u_int out_len);
|
||||
void ndpi_patchIPv6Address(char *str);
|
||||
|
|
|
|||
|
|
@ -489,7 +489,7 @@ struct ndpi_vxlanhdr {
|
|||
|
||||
typedef struct message {
|
||||
u_int8_t *buffer;
|
||||
u_int buffer_len, buffer_used, max_expected;
|
||||
u_int buffer_len, buffer_used;
|
||||
u_int32_t next_seq[2]; /* Directions */
|
||||
} message_t;
|
||||
|
||||
|
|
@ -557,12 +557,6 @@ struct ndpi_id_struct {
|
|||
/* NDPI_PROTOCOL_GNUTELLA */
|
||||
u_int32_t gnutella_ts;
|
||||
|
||||
/* NDPI_PROTOCOL_THUNDER */
|
||||
u_int32_t thunder_ts;
|
||||
|
||||
/* NDPI_PROTOCOL_ZATTOO */
|
||||
u_int32_t zattoo_ts;
|
||||
|
||||
/* NDPI_PROTOCOL_JABBER */
|
||||
u_int32_t jabber_stun_or_ft_ts;
|
||||
|
||||
|
|
@ -593,6 +587,17 @@ struct ndpi_id_struct {
|
|||
/* ************************************************** */
|
||||
|
||||
struct ndpi_flow_tcp_struct {
|
||||
|
||||
/* NDPI_PROTOCOL_MAIL_SMTP */
|
||||
/* NDPI_PROTOCOL_MAIL_POP */
|
||||
/* NDPI_PROTOCOL_MAIL_IMAP */
|
||||
/* NDPI_PROTOCOL_MAIL_FTP */
|
||||
/* TODO: something clever to save memory */
|
||||
struct {
|
||||
u_int8_t auth_found:1, auth_failed:1, auth_tls:1, auth_done:1, _pad:4;
|
||||
char username[32], password[16];
|
||||
} ftp_imap_pop_smtp;
|
||||
|
||||
/* NDPI_PROTOCOL_MAIL_SMTP */
|
||||
u_int16_t smtp_command_bitmask;
|
||||
|
||||
|
|
@ -604,7 +609,6 @@ struct ndpi_flow_tcp_struct {
|
|||
|
||||
/* NDPI_PROTOCOL_IRC */
|
||||
u_int8_t irc_stage;
|
||||
u_int8_t irc_port;
|
||||
|
||||
/* NDPI_PROTOCOL_H323 */
|
||||
u_int8_t h323_valid_packets;
|
||||
|
|
@ -1078,11 +1082,7 @@ struct ndpi_detection_module_struct {
|
|||
u_int32_t irc_timeout;
|
||||
/* gnutella parameters */
|
||||
u_int32_t gnutella_timeout;
|
||||
/* thunder parameters */
|
||||
u_int32_t thunder_timeout;
|
||||
/* rstp */
|
||||
u_int32_t orb_rstp_ts_timeout;
|
||||
u_int32_t zattoo_connection_timeout;
|
||||
u_int32_t jabber_stun_timeout;
|
||||
u_int32_t jabber_file_transfer_timeout;
|
||||
u_int8_t ip_version_limit;
|
||||
|
|
@ -1219,12 +1219,11 @@ struct ndpi_flow_struct {
|
|||
*/
|
||||
struct {
|
||||
ndpi_http_method method;
|
||||
char *url, *content_type /* response */, *request_content_type /* e.g. for POST */, *user_agent;
|
||||
u_int8_t num_request_headers, num_response_headers;
|
||||
u_int8_t request_version; /* 0=1.0 and 1=1.1. Create an enum for this? */
|
||||
u_int16_t response_status_code; /* 200, 404, etc. */
|
||||
u_char detected_os[32]; /* Via HTTP/QUIC User-Agent */
|
||||
u_char nat_ip[24]; /* Via HTTP X-Forwarded-For */
|
||||
char *url, *content_type /* response */, *request_content_type /* e.g. for POST */, *user_agent;
|
||||
char *detected_os; /* Via HTTP/QUIC User-Agent */
|
||||
char *nat_ip; /* Via HTTP X-Forwarded-For */
|
||||
} http;
|
||||
|
||||
/*
|
||||
|
|
@ -1242,16 +1241,6 @@ struct ndpi_flow_struct {
|
|||
u_int16_t num_processed_pkts;
|
||||
} stun;
|
||||
|
||||
/* TODO: something clever to save memory */
|
||||
struct {
|
||||
u_int8_t auth_found:1, auth_failed:1, auth_tls:1, auth_done:1, _pad:4;
|
||||
char username[32], password[16];
|
||||
} ftp_imap_pop_smtp;
|
||||
|
||||
struct {
|
||||
u_int8_t bt_check_performed;
|
||||
} bittorrent;
|
||||
|
||||
union {
|
||||
/* the only fields useful for nDPI and ntopng */
|
||||
struct {
|
||||
|
|
@ -1270,8 +1259,6 @@ struct ndpi_flow_struct {
|
|||
} kerberos;
|
||||
|
||||
struct {
|
||||
char ssl_version_str[12];
|
||||
u_int16_t ssl_version, server_names_len;
|
||||
char *server_names, *alpn, *tls_supported_versions, *issuerDN, *subjectDN;
|
||||
u_int32_t notBefore, notAfter;
|
||||
char ja3_client[33], ja3_server[33];
|
||||
|
|
@ -1287,6 +1274,8 @@ struct ndpi_flow_struct {
|
|||
|
||||
struct tls_heuristics browser_heuristics;
|
||||
|
||||
u_int16_t ssl_version, server_names_len;
|
||||
|
||||
struct {
|
||||
u_int16_t cipher_suite;
|
||||
char *esni;
|
||||
|
|
@ -1311,6 +1300,9 @@ struct ndpi_flow_struct {
|
|||
char version[32];
|
||||
} ubntac2;
|
||||
|
||||
/* In TLS.Bittorent flows there is no hash.
|
||||
Nonetheless, we must pay attention to NOT write to /read from this field
|
||||
with these flows */
|
||||
struct {
|
||||
/* Bittorrent hash */
|
||||
u_char hash[20];
|
||||
|
|
@ -1337,6 +1329,7 @@ struct ndpi_flow_struct {
|
|||
u_int16_t byte_counter[2];
|
||||
/* NDPI_PROTOCOL_BITTORRENT */
|
||||
u_int8_t bittorrent_stage; // can be 0 - 255
|
||||
u_int8_t bt_check_performed : 1;
|
||||
|
||||
/* NDPI_PROTOCOL_DIRECTCONNECT */
|
||||
u_int8_t directconnect_stage:2; // 0 - 1
|
||||
|
|
|
|||
|
|
@ -2377,8 +2377,6 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs
|
|||
|
||||
ndpi_str->irc_timeout = NDPI_IRC_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second;
|
||||
ndpi_str->gnutella_timeout = NDPI_GNUTELLA_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second;
|
||||
ndpi_str->thunder_timeout = NDPI_THUNDER_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second;
|
||||
ndpi_str->zattoo_connection_timeout = NDPI_ZATTOO_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second;
|
||||
ndpi_str->jabber_stun_timeout = NDPI_JABBER_STUN_TIMEOUT * ndpi_str->ticks_per_second;
|
||||
ndpi_str->jabber_file_transfer_timeout = NDPI_JABBER_FT_TIMEOUT * ndpi_str->ticks_per_second;
|
||||
|
||||
|
|
@ -4322,6 +4320,12 @@ void ndpi_free_flow_data(struct ndpi_flow_struct* flow) {
|
|||
if(flow->http.user_agent)
|
||||
ndpi_free(flow->http.user_agent);
|
||||
|
||||
if(flow->http.nat_ip)
|
||||
ndpi_free(flow->http.nat_ip);
|
||||
|
||||
if(flow->http.detected_os)
|
||||
ndpi_free(flow->http.detected_os);
|
||||
|
||||
if(flow->kerberos_buf.pktbuf)
|
||||
ndpi_free(flow->kerberos_buf.pktbuf);
|
||||
|
||||
|
|
@ -4918,12 +4922,12 @@ int ndpi_search_into_bittorrent_cache(struct ndpi_detection_module_struct *ndpi_
|
|||
struct ndpi_flow_struct *flow,
|
||||
/* Parameters below need to be in network byte order */
|
||||
u_int32_t saddr, u_int16_t sport, u_int32_t daddr, u_int16_t dport) {
|
||||
if((!flow->bittorrent.bt_check_performed /* Do the check once */) && ndpi_struct->bittorrent_cache) {
|
||||
if((!flow->bt_check_performed /* Do the check once */) && ndpi_struct->bittorrent_cache) {
|
||||
u_int16_t cached_proto;
|
||||
u_int8_t found = 0;
|
||||
u_int32_t key1, key2;
|
||||
|
||||
flow->bittorrent.bt_check_performed = 1;
|
||||
flow->bt_check_performed = 1;
|
||||
|
||||
/* Check cached communications */
|
||||
key1 = ndpi_bittorrent_hash_funct(saddr, sport), key2 = ndpi_bittorrent_hash_funct(daddr, dport);
|
||||
|
|
@ -7286,9 +7290,9 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
|
|||
case NDPI_PROTOCOL_MAIL_POP:
|
||||
case NDPI_PROTOCOL_MAIL_IMAP:
|
||||
case NDPI_PROTOCOL_MAIL_SMTP:
|
||||
if(flow->ftp_imap_pop_smtp.password[0] == '\0' &&
|
||||
flow->ftp_imap_pop_smtp.auth_tls == 0 &&
|
||||
flow->ftp_imap_pop_smtp.auth_done == 0)
|
||||
if(flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0' &&
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 0 &&
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 0)
|
||||
return(1);
|
||||
break;
|
||||
|
||||
|
|
|
|||
|
|
@ -890,21 +890,24 @@ const char* ndpi_get_flow_info(struct ndpi_flow_struct const * const flow,
|
|||
|
||||
/* ********************************** */
|
||||
|
||||
char* ndpi_ssl_version2str(struct ndpi_flow_struct *flow,
|
||||
char* ndpi_ssl_version2str(char *buf, int buf_len,
|
||||
u_int16_t version, u_int8_t *unknown_tls_version) {
|
||||
|
||||
if(unknown_tls_version)
|
||||
*unknown_tls_version = 0;
|
||||
|
||||
if(buf == NULL || buf_len <= 1)
|
||||
return NULL;
|
||||
|
||||
switch(version) {
|
||||
case 0x0300: return("SSLv3");
|
||||
case 0x0301: return("TLSv1");
|
||||
case 0x0302: return("TLSv1.1");
|
||||
case 0x0303: return("TLSv1.2");
|
||||
case 0x0304: return("TLSv1.3");
|
||||
case 0XFB1A: return("TLSv1.3 (Fizz)"); /* https://engineering.fb.com/security/fizz/ */
|
||||
case 0XFEFF: return("DTLSv1.0");
|
||||
case 0XFEFD: return("DTLSv1.2");
|
||||
case 0x0300: strncpy(buf, "SSLv3", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
case 0x0301: strncpy(buf, "TLSv1", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
case 0x0302: strncpy(buf, "TLSv1.1", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
case 0x0303: strncpy(buf, "TLSv1.2", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
case 0x0304: strncpy(buf, "TLSv1.3", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
case 0XFB1A: strncpy(buf, "TLSv1.3 (Fizz)", buf_len); buf[buf_len - 1] = '\0'; return buf; /* https://engineering.fb.com/security/fizz/ */
|
||||
case 0XFEFF: strncpy(buf, "DTLSv1.0", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
case 0XFEFD: strncpy(buf, "DTLSv1.2", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
case 0x0A0A:
|
||||
case 0x1A1A:
|
||||
case 0x2A2A:
|
||||
|
|
@ -920,22 +923,21 @@ char* ndpi_ssl_version2str(struct ndpi_flow_struct *flow,
|
|||
case 0xCACA:
|
||||
case 0xDADA:
|
||||
case 0xEAEA:
|
||||
case 0xFAFA: return("GREASE");
|
||||
case 0xFAFA: strncpy(buf, "GREASE", buf_len); buf[buf_len - 1] = '\0'; return buf;
|
||||
}
|
||||
|
||||
if((version >= 0x7f00) && (version <= 0x7fff))
|
||||
return("TLSv1.3 (draft)");
|
||||
if((version >= 0x7f00) && (version <= 0x7fff)) {
|
||||
strncpy(buf, "TLSv1.3 (draft)", buf_len);
|
||||
buf[buf_len - 1] = '\0';
|
||||
return buf;
|
||||
}
|
||||
|
||||
if(unknown_tls_version)
|
||||
*unknown_tls_version = 1;
|
||||
|
||||
if(flow != NULL) {
|
||||
snprintf(flow->protos.tls_quic.ssl_version_str,
|
||||
sizeof(flow->protos.tls_quic.ssl_version_str), "TLS (%04X)", version);
|
||||
snprintf(buf, buf_len, "TLS (%04X)", version);
|
||||
|
||||
return(flow->protos.tls_quic.ssl_version_str);
|
||||
} else
|
||||
return("");
|
||||
return buf;
|
||||
}
|
||||
|
||||
/* ***************************************************** */
|
||||
|
|
@ -1261,7 +1263,9 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
ndpi_serialize_string_string(serializer, "user_agent", flow->http.user_agent);
|
||||
if(flow->protos.tls_quic.ssl_version) {
|
||||
u_int8_t unknown_tls_version;
|
||||
char *version = ndpi_ssl_version2str(flow, flow->protos.tls_quic.ssl_version, &unknown_tls_version);
|
||||
char version[16];
|
||||
|
||||
ndpi_ssl_version2str(version, sizeof(version), flow->protos.tls_quic.ssl_version, &unknown_tls_version);
|
||||
|
||||
if(!unknown_tls_version)
|
||||
ndpi_serialize_string_string(serializer, "version", version);
|
||||
|
|
@ -1276,30 +1280,30 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
|
||||
case NDPI_PROTOCOL_MAIL_IMAP:
|
||||
ndpi_serialize_start_of_block(serializer, "imap");
|
||||
ndpi_serialize_string_string(serializer, "user", flow->ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_string_string(serializer, "user", flow->l4.tcp.ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->l4.tcp.ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_end_of_block(serializer);
|
||||
break;
|
||||
|
||||
case NDPI_PROTOCOL_MAIL_POP:
|
||||
ndpi_serialize_start_of_block(serializer, "pop");
|
||||
ndpi_serialize_string_string(serializer, "user", flow->ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_string_string(serializer, "user", flow->l4.tcp.ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->l4.tcp.ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_end_of_block(serializer);
|
||||
break;
|
||||
|
||||
case NDPI_PROTOCOL_MAIL_SMTP:
|
||||
ndpi_serialize_start_of_block(serializer, "smtp");
|
||||
ndpi_serialize_string_string(serializer, "user", flow->ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_string_string(serializer, "user", flow->l4.tcp.ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->l4.tcp.ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_end_of_block(serializer);
|
||||
break;
|
||||
|
||||
case NDPI_PROTOCOL_FTP_CONTROL:
|
||||
ndpi_serialize_start_of_block(serializer, "ftp");
|
||||
ndpi_serialize_string_string(serializer, "user", flow->ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_string_uint32(serializer, "auth_failed", flow->ftp_imap_pop_smtp.auth_failed);
|
||||
ndpi_serialize_string_string(serializer, "user", flow->l4.tcp.ftp_imap_pop_smtp.username);
|
||||
ndpi_serialize_string_string(serializer, "password", flow->l4.tcp.ftp_imap_pop_smtp.password);
|
||||
ndpi_serialize_string_uint32(serializer, "auth_failed", flow->l4.tcp.ftp_imap_pop_smtp.auth_failed);
|
||||
ndpi_serialize_end_of_block(serializer);
|
||||
break;
|
||||
|
||||
|
|
@ -1319,7 +1323,9 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
struct tm a, b, *before = NULL, *after = NULL;
|
||||
u_int i, off;
|
||||
u_int8_t unknown_tls_version;
|
||||
char *version = ndpi_ssl_version2str(flow, flow->protos.tls_quic.ssl_version, &unknown_tls_version);
|
||||
char version[16];
|
||||
|
||||
ndpi_ssl_version2str(version, sizeof(version), flow->protos.tls_quic.ssl_version, &unknown_tls_version);
|
||||
|
||||
if(flow->protos.tls_quic.notBefore)
|
||||
before = gmtime_r((const time_t *)&flow->protos.tls_quic.notBefore, &a);
|
||||
|
|
|
|||
|
|
@ -50,23 +50,23 @@ static int ndpi_ftp_control_check_request(struct ndpi_detection_module_struct *n
|
|||
#endif
|
||||
|
||||
if(ndpi_match_strprefix(payload, payload_len, "USER")) {
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->ftp_imap_pop_smtp.username,
|
||||
sizeof(flow->ftp_imap_pop_smtp.username), 5,
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->l4.tcp.ftp_imap_pop_smtp.username,
|
||||
sizeof(flow->l4.tcp.ftp_imap_pop_smtp.username), 5,
|
||||
payload, payload_len);
|
||||
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if(ndpi_match_strprefix(payload, payload_len, "PASS")) {
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->ftp_imap_pop_smtp.password,
|
||||
sizeof(flow->ftp_imap_pop_smtp.password), 5,
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->l4.tcp.ftp_imap_pop_smtp.password,
|
||||
sizeof(flow->l4.tcp.ftp_imap_pop_smtp.password), 5,
|
||||
payload, payload_len);
|
||||
return 1;
|
||||
}
|
||||
|
||||
if(ndpi_match_strprefix(payload, payload_len, "AUTH") ||
|
||||
ndpi_match_strprefix(payload, payload_len, "auth")) {
|
||||
flow->ftp_imap_pop_smtp.auth_found = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_found = 1;
|
||||
return 1;
|
||||
}
|
||||
/* ***************************************************** */
|
||||
|
|
@ -562,14 +562,14 @@ static int ndpi_ftp_control_check_response(struct ndpi_flow_struct *flow,
|
|||
case '2':
|
||||
case '3':
|
||||
case '6':
|
||||
if(flow->ftp_imap_pop_smtp.auth_found == 1)
|
||||
flow->ftp_imap_pop_smtp.auth_tls = 1;
|
||||
if(flow->l4.tcp.ftp_imap_pop_smtp.auth_found == 1)
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_tls = 1;
|
||||
return(1);
|
||||
break;
|
||||
|
||||
case '4':
|
||||
case '5':
|
||||
flow->ftp_imap_pop_smtp.auth_failed = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_failed = 1;
|
||||
return(1);
|
||||
break;
|
||||
}
|
||||
|
|
@ -632,11 +632,11 @@ static void ndpi_check_ftp_control(struct ndpi_detection_module_struct *ndpi_str
|
|||
|
||||
#ifdef FTP_DEBUG
|
||||
printf("%s() [user: %s][pwd: %s]\n", __FUNCTION__,
|
||||
flow->ftp_imap_pop_smtp.username, flow->ftp_imap_pop_smtp.password);
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.username, flow->l4.tcp.ftp_imap_pop_smtp.password);
|
||||
#endif
|
||||
|
||||
if(flow->ftp_imap_pop_smtp.password[0] == '\0' &&
|
||||
flow->ftp_imap_pop_smtp.auth_tls == 0) /* TODO: any values on dissecting TLS handshake? */
|
||||
if(flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0' &&
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 0) /* TODO: any values on dissecting TLS handshake? */
|
||||
flow->ftp_control_stage = 0;
|
||||
else
|
||||
ndpi_int_ftp_control_add_connection(ndpi_struct, flow);
|
||||
|
|
|
|||
|
|
@ -370,8 +370,9 @@ static void setHttpUserAgent(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
/* Good reference for future implementations:
|
||||
* https://github.com/ua-parser/uap-core/blob/master/regexes.yaml */
|
||||
|
||||
snprintf((char*)flow->http.detected_os,
|
||||
sizeof(flow->http.detected_os), "%s", ua);
|
||||
if(flow->http.detected_os == NULL) {
|
||||
flow->http.detected_os = ndpi_strdup(ua);
|
||||
}
|
||||
}
|
||||
|
||||
/* ************************************************************* */
|
||||
|
|
@ -606,9 +607,14 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
|
|||
if(strlen(flow->host_server_name) > 0) ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
|
||||
|
||||
if(packet->forwarded_line.ptr) {
|
||||
len = ndpi_min(packet->forwarded_line.len, sizeof(flow->http.nat_ip)-1);
|
||||
strncpy((char*)flow->http.nat_ip, (char*)packet->forwarded_line.ptr, len);
|
||||
flow->http.nat_ip[len] = '\0';
|
||||
if(flow->http.nat_ip == NULL) {
|
||||
len = packet->forwarded_line.len;
|
||||
flow->http.nat_ip = ndpi_malloc(len + 1);
|
||||
if(flow->http.nat_ip == NULL) {
|
||||
strncpy(flow->http.nat_ip, (char*)packet->forwarded_line.ptr, len);
|
||||
flow->http.nat_ip[len] = '\0';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
ndpi_http_parse_subprotocol(ndpi_struct, flow);
|
||||
|
|
@ -1074,9 +1080,6 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
|
|||
else
|
||||
flow->http.request_version = 0;
|
||||
|
||||
/* Set the first found headers in request */
|
||||
flow->http.num_request_headers = packet->http_num_headers;
|
||||
|
||||
/* Check for Ookla */
|
||||
if((packet->referer_line.len > 0)
|
||||
&& ndpi_strnstr((const char *)packet->referer_line.ptr, "www.speedtest.net", packet->referer_line.len)) {
|
||||
|
|
@ -1155,9 +1158,6 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
|
|||
|
||||
ndpi_parse_packet_line_info(ndpi_struct, flow);
|
||||
|
||||
// Add more found HTTP request headers.
|
||||
flow->http.num_request_headers+=packet->http_num_headers;
|
||||
|
||||
if(packet->parsed_lines <= 1) {
|
||||
/* wait some packets in case request is split over more than 2 packets */
|
||||
if(flow->packet_counter < 5) {
|
||||
|
|
@ -1213,9 +1213,6 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
|
|||
ndpi_parse_packet_line_info(ndpi_struct, flow);
|
||||
check_content_type_and_change_protocol(ndpi_struct, flow);
|
||||
|
||||
if(packet->packet_direction == 1 /* server -> client */)
|
||||
flow->http.num_response_headers += packet->http_num_headers; /* flow structs are initialized with zeros */
|
||||
|
||||
if(packet->empty_line_position_set != 0 || flow->l4.tcp.http_empty_line_seen == 1) {
|
||||
NDPI_LOG_DBG2(ndpi_struct, "empty line. check_http_payload\n");
|
||||
check_http_payload(ndpi_struct, flow);
|
||||
|
|
|
|||
|
|
@ -177,16 +177,16 @@ void ndpi_search_mail_imap_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
if(user) {
|
||||
char *pwd;
|
||||
|
||||
snprintf(flow->ftp_imap_pop_smtp.username,
|
||||
sizeof(flow->ftp_imap_pop_smtp.username),
|
||||
snprintf(flow->l4.tcp.ftp_imap_pop_smtp.username,
|
||||
sizeof(flow->l4.tcp.ftp_imap_pop_smtp.username),
|
||||
"%s", user);
|
||||
|
||||
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS);
|
||||
|
||||
pwd = strtok_r(NULL, " \"\r\n", &saveptr);
|
||||
if(pwd) {
|
||||
snprintf(flow->ftp_imap_pop_smtp.password,
|
||||
sizeof(flow->ftp_imap_pop_smtp.password),
|
||||
snprintf(flow->l4.tcp.ftp_imap_pop_smtp.password,
|
||||
sizeof(flow->l4.tcp.ftp_imap_pop_smtp.password),
|
||||
"%s", pwd);
|
||||
}
|
||||
}
|
||||
|
|
@ -320,7 +320,7 @@ void ndpi_search_mail_imap_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
|| (flow->l4.tcp.mail_imap_stage == 5)
|
||||
|| (flow->l4.tcp.mail_imap_stage == 7)
|
||||
) {
|
||||
if((flow->ftp_imap_pop_smtp.username[0] != '\0')
|
||||
if((flow->l4.tcp.ftp_imap_pop_smtp.username[0] != '\0')
|
||||
|| (flow->l4.tcp.mail_imap_stage >= 7)) {
|
||||
NDPI_LOG_INFO(ndpi_struct, "found MAIL_IMAP\n");
|
||||
ndpi_int_mail_imap_add_connection(ndpi_struct, flow);
|
||||
|
|
|
|||
|
|
@ -77,8 +77,8 @@ static int ndpi_int_mail_pop_check_for_client_commands(struct ndpi_detection_mod
|
|||
&& (packet->payload[1] == 'S' || packet->payload[1] == 's')
|
||||
&& (packet->payload[2] == 'E' || packet->payload[2] == 'e')
|
||||
&& (packet->payload[3] == 'R' || packet->payload[3] == 'r')) {
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->ftp_imap_pop_smtp.username,
|
||||
sizeof(flow->ftp_imap_pop_smtp.username), 5,
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->l4.tcp.ftp_imap_pop_smtp.username,
|
||||
sizeof(flow->l4.tcp.ftp_imap_pop_smtp.username), 5,
|
||||
packet->payload, packet->payload_packet_len);
|
||||
|
||||
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS);
|
||||
|
|
@ -88,8 +88,8 @@ static int ndpi_int_mail_pop_check_for_client_commands(struct ndpi_detection_mod
|
|||
&& (packet->payload[1] == 'A' || packet->payload[1] == 'a')
|
||||
&& (packet->payload[2] == 'S' || packet->payload[2] == 's')
|
||||
&& (packet->payload[3] == 'S' || packet->payload[3] == 's')) {
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->ftp_imap_pop_smtp.password,
|
||||
sizeof(flow->ftp_imap_pop_smtp.password), 5,
|
||||
ndpi_user_pwd_payload_copy((u_int8_t*)flow->l4.tcp.ftp_imap_pop_smtp.password,
|
||||
sizeof(flow->l4.tcp.ftp_imap_pop_smtp.password), 5,
|
||||
packet->payload, packet->payload_packet_len);
|
||||
|
||||
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS);
|
||||
|
|
@ -182,7 +182,7 @@ void ndpi_search_mail_pop_tcp(struct ndpi_detection_module_struct
|
|||
if(flow->l4.tcp.mail_pop_stage > 0) {
|
||||
NDPI_LOG_INFO(ndpi_struct, "mail_pop identified\n");
|
||||
|
||||
if((flow->ftp_imap_pop_smtp.password[0] != '\0')
|
||||
if((flow->l4.tcp.ftp_imap_pop_smtp.password[0] != '\0')
|
||||
|| (flow->l4.tcp.mail_pop_stage > 3)) {
|
||||
ndpi_int_mail_pop_add_connection(ndpi_struct, flow);
|
||||
popInitExtraPacketProcessing(flow);
|
||||
|
|
@ -222,7 +222,7 @@ int ndpi_extra_search_mail_pop_tcp(struct ndpi_detection_module_struct *ndpi_str
|
|||
|
||||
ndpi_search_mail_pop_tcp(ndpi_struct, flow);
|
||||
|
||||
rc = (flow->ftp_imap_pop_smtp.password[0] == '\0') ? 1 : 0;
|
||||
rc = (flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0') ? 1 : 0;
|
||||
|
||||
#ifdef POP_DEBUG
|
||||
printf("**** %s() [rc: %d]\n", __FUNCTION__, rc);
|
||||
|
|
|
|||
|
|
@ -93,19 +93,19 @@ static void get_credentials_auth_plain(struct ndpi_detection_module_struct *ndpi
|
|||
user_len = i - 1;
|
||||
}
|
||||
if(user_len > 0) {
|
||||
user_len = ndpi_min(user_len, sizeof(flow->ftp_imap_pop_smtp.username) - 1);
|
||||
user_len = ndpi_min(user_len, sizeof(flow->l4.tcp.ftp_imap_pop_smtp.username) - 1);
|
||||
|
||||
memcpy(flow->ftp_imap_pop_smtp.username, out + 1, user_len);
|
||||
flow->ftp_imap_pop_smtp.username[user_len] = '\0';
|
||||
memcpy(flow->l4.tcp.ftp_imap_pop_smtp.username, out + 1, user_len);
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.username[user_len] = '\0';
|
||||
|
||||
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS);
|
||||
|
||||
if(1 + user_len + 1 < out_len) {
|
||||
unsigned int pwd_len;
|
||||
|
||||
pwd_len = ndpi_min(out_len - (1 + user_len + 1), sizeof(flow->ftp_imap_pop_smtp.password) - 1);
|
||||
memcpy(flow->ftp_imap_pop_smtp.password, out + 1 + user_len + 1, pwd_len);
|
||||
flow->ftp_imap_pop_smtp.password[pwd_len] = '\0';
|
||||
pwd_len = ndpi_min(out_len - (1 + user_len + 1), sizeof(flow->l4.tcp.ftp_imap_pop_smtp.password) - 1);
|
||||
memcpy(flow->l4.tcp.ftp_imap_pop_smtp.password, out + 1 + user_len + 1, pwd_len);
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.password[pwd_len] = '\0';
|
||||
}
|
||||
}
|
||||
ndpi_free(out);
|
||||
|
|
@ -182,25 +182,25 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
&& (packet->line[a].ptr[3] == 'O' || packet->line[a].ptr[3] == 'o')
|
||||
&& packet->line[a].ptr[4] == ' ') {
|
||||
flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_HELO_EHLO;
|
||||
flow->ftp_imap_pop_smtp.auth_found = 0;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_found = 0;
|
||||
} else if((packet->line[a].ptr[0] == 'M' || packet->line[a].ptr[0] == 'm')
|
||||
&& (packet->line[a].ptr[1] == 'A' || packet->line[a].ptr[1] == 'a')
|
||||
&& (packet->line[a].ptr[2] == 'I' || packet->line[a].ptr[2] == 'i')
|
||||
&& (packet->line[a].ptr[3] == 'L' || packet->line[a].ptr[3] == 'l')
|
||||
&& packet->line[a].ptr[4] == ' ') {
|
||||
flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_MAIL;
|
||||
flow->ftp_imap_pop_smtp.auth_found = 0;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_found = 0;
|
||||
/* We shouldn't be here if there are credentials */
|
||||
flow->ftp_imap_pop_smtp.auth_done = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
|
||||
} else if((packet->line[a].ptr[0] == 'R' || packet->line[a].ptr[0] == 'r')
|
||||
&& (packet->line[a].ptr[1] == 'C' || packet->line[a].ptr[1] == 'c')
|
||||
&& (packet->line[a].ptr[2] == 'P' || packet->line[a].ptr[2] == 'p')
|
||||
&& (packet->line[a].ptr[3] == 'T' || packet->line[a].ptr[3] == 't')
|
||||
&& packet->line[a].ptr[4] == ' ') {
|
||||
flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_RCPT;
|
||||
flow->ftp_imap_pop_smtp.auth_found = 0;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_found = 0;
|
||||
/* We shouldn't be here if there are credentials */
|
||||
flow->ftp_imap_pop_smtp.auth_done = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
|
||||
} else if((packet->line[a].ptr[0] == 'A' || packet->line[a].ptr[0] == 'a')
|
||||
&& (packet->line[a].ptr[1] == 'U' || packet->line[a].ptr[1] == 'u')
|
||||
&& (packet->line[a].ptr[2] == 'T' || packet->line[a].ptr[2] == 't')
|
||||
|
|
@ -209,7 +209,7 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
#ifdef SMTP_DEBUG
|
||||
printf("%s() AUTH [%.*s]\n", __FUNCTION__, packet->line[a].len, packet->line[a].ptr);
|
||||
#endif
|
||||
flow->ftp_imap_pop_smtp.auth_found = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_found = 1;
|
||||
if(packet->line[a].len >= 6) {
|
||||
if(packet->line[a].ptr[5] == 'L' || packet->line[a].ptr[5] == 'l') {
|
||||
flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_AUTH_LOGIN;
|
||||
|
|
@ -219,7 +219,7 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
/* AUTH PLAIN: username and pwd here */
|
||||
get_credentials_auth_plain(ndpi_struct, flow,
|
||||
packet->line[a].ptr, packet->line[a].len);
|
||||
flow->ftp_imap_pop_smtp.auth_done = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
|
||||
}
|
||||
}
|
||||
} else {
|
||||
|
|
@ -228,9 +228,9 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
printf("%s() => [%.*s]\n", __FUNCTION__, packet->line[a].len, packet->line[a].ptr);
|
||||
#endif
|
||||
|
||||
if(flow->ftp_imap_pop_smtp.auth_found &&
|
||||
if(flow->l4.tcp.ftp_imap_pop_smtp.auth_found &&
|
||||
(flow->l4.tcp.smtp_command_bitmask & SMTP_BIT_AUTH_LOGIN)) {
|
||||
if(flow->ftp_imap_pop_smtp.username[0] == '\0') {
|
||||
if(flow->l4.tcp.ftp_imap_pop_smtp.username[0] == '\0') {
|
||||
/* Username */
|
||||
u_int8_t buf[48];
|
||||
u_char *out;
|
||||
|
|
@ -240,22 +240,22 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
packet->line[a].ptr, packet->line[a].len);
|
||||
|
||||
#ifdef SMTP_DEBUG
|
||||
printf("%s() => [auth: %u] (username) [%s]\n", __FUNCTION__, flow->ftp_imap_pop_smtp.auth_found, buf);
|
||||
printf("%s() => [auth: %u] (username) [%s]\n", __FUNCTION__, flow->l4.tcp.ftp_imap_pop_smtp.auth_found, buf);
|
||||
#endif
|
||||
|
||||
out = ndpi_base64_decode((const u_char*)buf, (size_t)strlen((const char*)buf), &out_len);
|
||||
|
||||
if(out) {
|
||||
size_t len = ndpi_min(out_len, sizeof(flow->ftp_imap_pop_smtp.username) - 1);
|
||||
size_t len = ndpi_min(out_len, sizeof(flow->l4.tcp.ftp_imap_pop_smtp.username) - 1);
|
||||
|
||||
memcpy(flow->ftp_imap_pop_smtp.username, out, len);
|
||||
flow->ftp_imap_pop_smtp.username[len] = '\0';
|
||||
memcpy(flow->l4.tcp.ftp_imap_pop_smtp.username, out, len);
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.username[len] = '\0';
|
||||
|
||||
ndpi_free(out);
|
||||
}
|
||||
|
||||
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS);
|
||||
} else if(flow->ftp_imap_pop_smtp.password[0] == '\0') {
|
||||
} else if(flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0') {
|
||||
/* Password */
|
||||
u_int8_t buf[48];
|
||||
u_char *out;
|
||||
|
|
@ -265,23 +265,23 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
packet->line[a].ptr, packet->line[a].len);
|
||||
|
||||
#ifdef SMTP_DEBUG
|
||||
printf("%s() => [auth: %u] (password) [%s]\n", __FUNCTION__, flow->ftp_imap_pop_smtp.auth_found, buf);
|
||||
printf("%s() => [auth: %u] (password) [%s]\n", __FUNCTION__, flow->l4.tcp.ftp_imap_pop_smtp.auth_found, buf);
|
||||
#endif
|
||||
|
||||
out = ndpi_base64_decode((const u_char*)buf, (size_t)strlen((const char*)buf), &out_len);
|
||||
|
||||
if(out) {
|
||||
size_t len = ndpi_min(out_len, sizeof(flow->ftp_imap_pop_smtp.password) - 1);
|
||||
size_t len = ndpi_min(out_len, sizeof(flow->l4.tcp.ftp_imap_pop_smtp.password) - 1);
|
||||
|
||||
memcpy(flow->ftp_imap_pop_smtp.password, out, len);
|
||||
flow->ftp_imap_pop_smtp.password[len] = '\0';
|
||||
memcpy(flow->l4.tcp.ftp_imap_pop_smtp.password, out, len);
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.password[len] = '\0';
|
||||
|
||||
ndpi_free(out);
|
||||
}
|
||||
|
||||
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS);
|
||||
|
||||
flow->ftp_imap_pop_smtp.auth_done = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
|
||||
} else {
|
||||
flow->host_server_name[0] = '\0';
|
||||
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
|
||||
|
|
@ -302,8 +302,8 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
&& (packet->line[a].ptr[6] == 'L' || packet->line[a].ptr[6] == 'l')
|
||||
&& (packet->line[a].ptr[7] == 'S' || packet->line[a].ptr[7] == 's')) {
|
||||
flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_STARTTLS;
|
||||
flow->ftp_imap_pop_smtp.auth_tls = 1;
|
||||
flow->ftp_imap_pop_smtp.auth_done = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_tls = 1;
|
||||
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -341,7 +341,7 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
|
||||
#ifdef SMTP_DEBUG
|
||||
printf("%s() [bit_count: %u][%s]\n", __FUNCTION__,
|
||||
bit_count, flow->ftp_imap_pop_smtp.password);
|
||||
bit_count, flow->l4.tcp.ftp_imap_pop_smtp.password);
|
||||
#endif
|
||||
|
||||
/* Only if we don't have already set the protocol via hostname matching */
|
||||
|
|
@ -379,7 +379,7 @@ int ndpi_extra_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_st
|
|||
|
||||
ndpi_search_mail_smtp_tcp(ndpi_struct, flow);
|
||||
|
||||
rc = (flow->ftp_imap_pop_smtp.password[0] == '\0') ? 1 : 0;
|
||||
rc = (flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0') ? 1 : 0;
|
||||
|
||||
#ifdef SMTP_DEBUG
|
||||
printf("**** %s() [rc: %d]\n", __FUNCTION__, rc);
|
||||
|
|
|
|||
|
|
@ -32,18 +32,7 @@
|
|||
static void ndpi_int_thunder_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
|
||||
struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */)
|
||||
{
|
||||
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
|
||||
struct ndpi_id_struct *src = flow->src;
|
||||
struct ndpi_id_struct *dst = flow->dst;
|
||||
|
||||
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_THUNDER, NDPI_PROTOCOL_UNKNOWN);
|
||||
|
||||
if (src != NULL) {
|
||||
src->thunder_ts = packet->current_time_ms;
|
||||
}
|
||||
if (dst != NULL) {
|
||||
dst->thunder_ts = packet->current_time_ms;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
|
@ -149,22 +138,6 @@ void ndpi_int_search_thunder_http(struct ndpi_detection_module_struct
|
|||
struct ndpi_id_struct *src = flow->src;
|
||||
struct ndpi_id_struct *dst = flow->dst;
|
||||
|
||||
|
||||
if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_THUNDER) {
|
||||
if (src != NULL && ((u_int32_t)
|
||||
(packet->current_time_ms - src->thunder_ts) < ndpi_struct->thunder_timeout)) {
|
||||
NDPI_LOG_DBG2(ndpi_struct,
|
||||
"thunder : save src connection packet detected\n");
|
||||
src->thunder_ts = packet->current_time_ms;
|
||||
} else if (dst != NULL && ((u_int32_t)
|
||||
(packet->current_time_ms - dst->thunder_ts) < ndpi_struct->thunder_timeout)) {
|
||||
NDPI_LOG_DBG2(ndpi_struct,
|
||||
"thunder : save dst connection packet detected\n");
|
||||
dst->thunder_ts = packet->current_time_ms;
|
||||
}
|
||||
return;
|
||||
}
|
||||
|
||||
if (packet->payload_packet_len > 5
|
||||
&& memcmp(packet->payload, "GET /", 5) == 0 && NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_THUNDER)) {
|
||||
NDPI_LOG_DBG2(ndpi_struct, "HTTP packet detected\n");
|
||||
|
|
|
|||
|
|
@ -2030,6 +2030,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
u_int16_t s_offset = offset+extension_offset;
|
||||
u_int8_t version_len = packet->payload[s_offset];
|
||||
char version_str[256];
|
||||
char buf_ver_tmp[16];
|
||||
size_t version_str_len = 0;
|
||||
version_str[0] = 0;
|
||||
#ifdef DEBUG_TLS
|
||||
|
|
@ -2049,14 +2050,14 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
|
||||
#ifdef DEBUG_TLS
|
||||
printf("Client TLS [TLS version: %s/0x%04X]\n",
|
||||
ndpi_ssl_version2str(flow, tls_version, &unknown_tls_version), tls_version);
|
||||
ndpi_ssl_version2str(buf_ver_tmp, sizeof(buf_ver_tmp), tls_version, &unknown_tls_version), tls_version);
|
||||
#endif
|
||||
|
||||
if((version_str_len+8) < sizeof(version_str)) {
|
||||
int rc = snprintf(&version_str[version_str_len],
|
||||
sizeof(version_str) - version_str_len, "%s%s",
|
||||
(version_str_len > 0) ? "," : "",
|
||||
ndpi_ssl_version2str(flow, tls_version, &unknown_tls_version));
|
||||
ndpi_ssl_version2str(buf_ver_tmp, sizeof(buf_ver_tmp), tls_version, &unknown_tls_version));
|
||||
if(rc <= 0)
|
||||
break;
|
||||
else
|
||||
|
|
|
|||
|
|
@ -47,30 +47,16 @@ u_int8_t ndpi_int_zattoo_user_agent_set(struct ndpi_detection_module_struct *ndp
|
|||
}
|
||||
|
||||
#define ZATTOO_DETECTED \
|
||||
if (src != NULL) \
|
||||
src->zattoo_ts = packet->current_time_ms; \
|
||||
if (dst != NULL) \
|
||||
dst->zattoo_ts = packet->current_time_ms; \
|
||||
\
|
||||
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN)
|
||||
|
||||
void ndpi_search_zattoo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
|
||||
{
|
||||
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
|
||||
struct ndpi_id_struct *src = flow->src;
|
||||
struct ndpi_id_struct *dst = flow->dst;
|
||||
|
||||
u_int16_t i;
|
||||
|
||||
NDPI_LOG_DBG(ndpi_struct, "search ZATTOO\n");
|
||||
|
||||
if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_ZATTOO) {
|
||||
if(src != NULL && ((u_int32_t) (packet->current_time_ms - src->zattoo_ts) < ndpi_struct->zattoo_connection_timeout))
|
||||
src->zattoo_ts = packet->current_time_ms;
|
||||
if (dst != NULL && ((u_int32_t) (packet->current_time_ms - dst->zattoo_ts) < ndpi_struct->zattoo_connection_timeout))
|
||||
dst->zattoo_ts = packet->current_time_ms;
|
||||
return;
|
||||
}
|
||||
/* search over TCP */
|
||||
if(packet->tcp != NULL) {
|
||||
if(packet->payload_packet_len > 50 && memcmp(packet->payload, "GET /frontdoor/fd?brand=Zattoo&v=", 33) == 0) {
|
||||
|
|
|
|||
BIN
tests/pcap/tls_torrent.pcapng
Normal file
BIN
tests/pcap/tls_torrent.pcapng
Normal file
Binary file not shown.
12
tests/result/tls_torrent.pcapng.out
Normal file
12
tests/result/tls_torrent.pcapng.out
Normal file
|
|
@ -0,0 +1,12 @@
|
|||
Guessed flow protos: 0
|
||||
|
||||
DPI Packets (TCP): 7 (7.00 pkts/flow)
|
||||
|
||||
BitTorrent 7 6308 1
|
||||
|
||||
JA3 Host Stats:
|
||||
IP Address # JA3C
|
||||
1 10.10.10.1 1
|
||||
|
||||
|
||||
1 TCP 10.10.10.1:443 <-> 192.168.0.1:58842 [proto: 91.37/TLS.BitTorrent][Encrypted][cat: Download/7][6 pkts/5922 bytes <-> 1 pkts/386 bytes][Goodput ratio: 94/86][0.16 sec][Hostname/SNI: web.utorrent.com][bytes ratio: 0.878 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 32/0 147/0 58/0][Pkt Len c2s/s2c min/avg/max/stddev: 66/386 987/386 1454/386 651/0][Risk: ** TLS (probably) not carrying HTTPS **** Possibly Malicious JA3 Fingerprint **][Risk Score: 60][TLSv1.2][JA3C: fd80fa9c6120cdeea8520510f3c644ac][ServerNames: *.utorrent.com,utorrent.com][JA3S: 6f84bbe9810ec4ea9061cc1a02eaf83c][Issuer: C=US, ST=Arizona, L=Scottsdale, O=GoDaddy.com, Inc., OU=http://certs.godaddy.com/repository/, CN=Go Daddy Secure Certificate Authority - G2][Subject: CN=*.utorrent.com][Certificate SHA-1: E4:8F:E4:15:C7:D0:B7:EA:E6:F6:B1:B4:40:F0:13:D1:5E:7F:64:E8][Firefox][Validity: 2021-09-27 07:16:05 - 2022-09-24 22:26:57][Cipher: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256][Plen Bins: 0,0,0,0,0,0,0,0,0,0,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,20,60,0,0,0,0]
|
||||
Loading…
Add table
Add a link
Reference in a new issue