Skip to content

Commit

Permalink
Detect SMTPs w/ STARTTLS as TLS and dissect client/server hello. Fixes …
Browse files Browse the repository at this point in the history 
…#1630. (#1637)

* FTP needs to get updated as well as it has similiar STARTTLS semantics -> follow-up

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
  • Loading branch information
@utoni
utoni authored Jul 5, 2022
1 parent 388dfb8 commit f4a1739
Show file tree
Hide file tree
Showing 5 changed files with 56 additions and 20 deletions.
8 changes: 5 additions & 3 deletions src/lib/ndpi_main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -8034,7 +8034,9 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
switch(proto) {
case NDPI_PROTOCOL_TLS:
case NDPI_PROTOCOL_DTLS:
if(flow->l4.tcp.tls.certificate_processed) return(0);
if(flow->l4.tcp.tls.certificate_processed ||
(flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 1 &&
flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 1)) return(0);

if(flow->l4.tcp.tls.num_tls_blocks <= ndpi_str->num_tls_blocks_to_follow) {
// printf("*** %u/%u\n", flow->l4.tcp.tls.num_tls_blocks, ndpi_str->num_tls_blocks_to_follow);
Expand All @@ -8058,8 +8060,8 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
case NDPI_PROTOCOL_MAIL_IMAP:
case NDPI_PROTOCOL_MAIL_SMTP:
if(flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0' &&
flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 0 &&
flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 0)
(flow->l4.tcp.ftp_imap_pop_smtp.auth_tls == 1 ||
flow->l4.tcp.ftp_imap_pop_smtp.auth_done == 0))
return(1);
break;

Expand Down
49 changes: 38 additions & 11 deletions src/lib/protocols/mail_smtp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,14 +48,15 @@

/* #define SMTP_DEBUG 1 */

extern int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow);

static void ndpi_int_mail_smtp_add_connection(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow) {
#ifdef SMTP_DEBUG
printf("**** %s()\n", __FUNCTION__);
#endif

flow->guessed_protocol_id = NDPI_PROTOCOL_MAIL_SMTP; /* Avoid SMTPS to be used s sub-protocol */

ndpi_set_detected_protocol(ndpi_struct, flow,
NDPI_PROTOCOL_MAIL_SMTP, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
}
Expand Down Expand Up @@ -299,8 +300,8 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
}
}

if(packet->line[a].len >= 8) {
if((packet->line[a].ptr[0] == 'S' || packet->line[a].ptr[0] == 's')
if(packet->line[a].len >= 8) {
if((packet->line[a].ptr[0] == 'S' || packet->line[a].ptr[0] == 's')
&& (packet->line[a].ptr[1] == 'T' || packet->line[a].ptr[1] == 't')
&& (packet->line[a].ptr[2] == 'A' || packet->line[a].ptr[2] == 'a')
&& (packet->line[a].ptr[3] == 'R' || packet->line[a].ptr[3] == 'r')
Expand All @@ -310,9 +311,9 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
&& (packet->line[a].ptr[7] == 'S' || packet->line[a].ptr[7] == 's')) {
flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_STARTTLS;
flow->l4.tcp.ftp_imap_pop_smtp.auth_tls = 1;
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
}
}
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 0;
}
}

if(packet->line[a].len >= 4) {
if((packet->line[a].ptr[0] == 'D' || packet->line[a].ptr[0] == 'd')
Expand Down Expand Up @@ -381,12 +382,38 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
/* **************************************** */

int ndpi_extra_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
int rc;
struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct * const packet = &ndpi_struct->packet;
int rc = 0;

if (flow->l4.tcp.smtp_command_bitmask & SMTP_BIT_STARTTLS &&
packet->payload_packet_len > 5)
{
uint8_t const * const block = &packet->payload[5];
uint8_t const * const p = &packet->payload[0];
uint16_t const block_len = packet->payload_packet_len - 5;
uint16_t const l = packet->payload_packet_len;

packet->payload = block;
packet->payload_packet_len = block_len;

if (processTLSBlock(ndpi_struct, flow) != 0) {
rc = 1;
}

ndpi_search_mail_smtp_tcp(ndpi_struct, flow);
packet->payload = p;
packet->payload_packet_len = l;

rc = (flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0') ? 1 : 0;
/* STARTTLS may be followed by a 220 - Service ready */
if (rc == 0 && memcmp(packet->payload, "220", 3) != 0)
{
flow->l4.tcp.ftp_imap_pop_smtp.auth_done = 1;
}
} else {
ndpi_search_mail_smtp_tcp(ndpi_struct, flow);
rc = (flow->l4.tcp.ftp_imap_pop_smtp.password[0] == '\0') ? 1 : 0;
}

#ifdef SMTP_DEBUG
printf("**** %s() [rc: %d]\n", __FUNCTION__, rc);
Expand Down
6 changes: 4 additions & 2 deletions src/lib/protocols/tls.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,8 @@
#include "ndpi_encryption.h"

extern char *strptime(const char *s, const char *format, struct tm *tm);
extern int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow);
extern int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow, uint32_t quic_version);
extern int http_process_user_agent(struct ndpi_detection_module_struct *ndpi_struct,
Expand Down Expand Up @@ -839,8 +841,8 @@ int processCertificate(struct ndpi_detection_module_struct *ndpi_struct,

/* **************************************** */

static int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
int processTLSBlock(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
int ret;

Expand Down
4 changes: 2 additions & 2 deletions tests/result/ftp-start-tls.pcap.out
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Guessed flow protos: 0
Guessed flow protos: 1

DPI Packets (TCP): 10 (10.00 pkts/flow)
DPI Packets (TCP): 51 (51.00 pkts/flow)
Confidence DPI : 1 (flows)

FTP_CONTROL 51 7510 1
Expand Down
9 changes: 7 additions & 2 deletions tests/result/smtp-starttls.pcap.out
View file
Original file line number Diff line number Diff line change
@@ -1,8 +1,13 @@
Guessed flow protos: 0

DPI Packets (TCP): 9 (9.00 pkts/flow)
DPI Packets (TCP): 11 (11.00 pkts/flow)
Confidence DPI : 1 (flows)

Google 36 8403 1

1 TCP 10.0.0.1:57406 <-> 173.194.68.26:25 [proto: 3.126/SMTP.Google][ClearText][Confidence: DPI][cat: Email/3][17 pkts/2514 bytes <-> 19 pkts/5889 bytes][Goodput ratio: 55/79][0.48 sec][Hostname/SNI: mx.google.com][bytes ratio: -0.402 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 30/24 156/103 42/26][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 148/310 752/1484 168/444][PLAIN TEXT (x.google.com ESMTP s4)][Plen Bins: 23,18,13,9,4,4,4,0,0,4,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0]
JA3 Host Stats:
IP Address # JA3C
1 10.0.0.1 1


1 TCP 10.0.0.1:57406 <-> 173.194.68.26:25 [proto: 91.126/TLS.Google][Encrypted][Confidence: DPI][cat: Email/3][17 pkts/2514 bytes <-> 19 pkts/5889 bytes][Goodput ratio: 55/79][0.48 sec][Hostname/SNI: mx.google.com][bytes ratio: -0.402 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 30/24 156/103 42/26][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 148/310 752/1484 168/444][Risk: ** Obsolete TLS (v1.1 or older) **][Risk Score: 100][Risk Info: No client to server traffic / TLSv1][TLSv1][JA3C: fab507fe132c544e8a0eb7c394affeae][Plen Bins: 23,18,13,9,4,4,4,0,0,4,0,0,0,0,0,0,0,0,0,0,0,4,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,9,0,0,0]

0 comments on commit f4a1739

Please sign in to comment.