git ssb

0+

cel / sslh



Tree: 21f524f71165538dcde9f8de32b9f69385ba0c87

Files: 21f524f71165538dcde9f8de32b9f69385ba0c87 / probe.c

11620 bytesRaw
1/*
2# probe.c: Code for probing protocols
3#
4# Copyright (C) 2007-2015  Yves Rutschle
5# 
6# This program is free software; you can redistribute it
7# and/or modify it under the terms of the GNU General Public
8# License as published by the Free Software Foundation; either
9# version 2 of the License, or (at your option) any later
10# version.
11# 
12# This program is distributed in the hope that it will be
13# useful, but WITHOUT ANY WARRANTY; without even the implied
14# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
15# PURPOSE.  See the GNU General Public License for more
16# details.
17# 
18# The full text for the General Public License is here:
19# http://www.gnu.org/licenses/gpl.html
20*/
21
22#define _GNU_SOURCE
23#include <stdio.h>
24#ifdef ENABLE_REGEX
25#ifdef LIBPCRE
26#include <pcreposix.h>
27#else
28#include <regex.h>
29#endif
30#endif
31#include <ctype.h>
32#include "probe.h"
33
34
35
36static int is_ssh_protocol(const char *p, int len, struct proto*);
37static int is_openvpn_protocol(const char *p, int len, struct proto*);
38static int is_tinc_protocol(const char *p, int len, struct proto*);
39static int is_xmpp_protocol(const char *p, int len, struct proto*);
40static int is_http_protocol(const char *p, int len, struct proto*);
41static int is_tls_protocol(const char *p, int len, struct proto*);
42static int is_adb_protocol(const char *p, int len, struct proto*);
43static int is_true(const char *p, int len, struct proto* proto) { return 1; }
44
45/* Table of protocols that have a built-in probe
46 */
47static struct proto builtins[] = {
48    /* description   service  saddr  log_level  keepalive  probe  */
49    { "ssh",         "sshd",   NULL,  1,        0,         is_ssh_protocol},
50    { "openvpn",     NULL,     NULL,  1,        0,         is_openvpn_protocol },
51    { "tinc",        NULL,     NULL,  1,        0,         is_tinc_protocol },
52    { "xmpp",        NULL,     NULL,  1,        0,         is_xmpp_protocol },
53    { "http",        NULL,     NULL,  1,        0,         is_http_protocol },
54    { "ssl",         NULL,     NULL,  1,        0,         is_tls_protocol },
55    { "tls",         NULL,     NULL,  1,        0,         is_tls_protocol },
56    { "adb",         NULL,     NULL,  1,        0,         is_adb_protocol },
57    { "anyprot",     NULL,     NULL,  1,        0,         is_true }
58};
59
60static struct proto *protocols;
61static char* on_timeout = "ssh";
62
63struct proto*  get_builtins(void) {
64    return builtins;
65}
66
67int get_num_builtins(void) {
68    return ARRAY_SIZE(builtins);
69}
70
71/* Sets the protocol name to connect to in case of timeout */
72void set_ontimeout(const char* name)
73{
74    int res = asprintf(&on_timeout, "%s", name);
75    CHECK_RES_DIE(res, "asprintf");
76}
77
78/* Returns the protocol to connect to in case of timeout; 
79 * if not found, return the first protocol specified 
80 */
81struct proto* timeout_protocol(void) 
82{
83    struct proto* p = get_first_protocol();
84    for (; p && strcmp(p->description, on_timeout); p = p->next);
85    if (p) return p;
86    return get_first_protocol();
87}
88
89/* returns the first protocol (caller can then follow the *next pointers) */
90struct proto* get_first_protocol(void)
91{
92    return protocols;
93}
94
95void set_protocol_list(struct proto* prots)
96{
97    protocols = prots;
98}
99
100/* From http://grapsus.net/blog/post/Hexadecimal-dump-in-C */
101#define HEXDUMP_COLS 16
102void hexdump(const char *mem, unsigned int len)
103{
104    unsigned int i, j;
105
106    for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++)
107    {
108        /* print offset */
109        if(i % HEXDUMP_COLS == 0)
110            printf("0x%06x: ", i);
111
112        /* print hex data */
113        if(i < len)
114            printf("%02x ", 0xFF & mem[i]);
115        else /* end of block, just aligning for ASCII dump */
116            printf("   ");
117
118        /* print ASCII dump */
119        if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) {
120            for(j = i - (HEXDUMP_COLS - 1); j <= i; j++) {
121                if(j >= len) /* end of block, not really printing */
122                    putchar(' ');
123                else if(isprint(mem[j])) /* printable char */
124                    putchar(0xFF & mem[j]);        
125                else /* other char */
126                    putchar('.');
127            }
128            putchar('\n');
129        }
130    }
131}
132
133/* Is the buffer the beginning of an SSH connection? */
134static int is_ssh_protocol(const char *p, int len, struct proto *proto)
135{
136    if (len < 4)
137        return PROBE_AGAIN;
138
139    return !strncmp(p, "SSH-", 4);
140}
141
142/* Is the buffer the beginning of an OpenVPN connection?
143 *
144 * Code inspired from OpenVPN port-share option; however, OpenVPN code is
145 * wrong: users using pre-shared secrets have non-initialised key_id fields so
146 * p[3] & 7 should not be looked at, and also the key_method can be specified
147 * to 1 which changes the opcode to P_CONTROL_HARD_RESET_CLIENT_V1.
148 * See:
149 * http://www.fengnet.com/book/vpns%20illustrated%20tunnels%20%20vpnsand%20ipsec/ch08lev1sec5.html
150 * and OpenVPN ssl.c, ssl.h and options.c
151 */
152static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
153{
154    int packet_len;
155
156    if (len < 2)
157        return PROBE_AGAIN;
158
159    packet_len = ntohs(*(uint16_t*)p);
160    return packet_len == len - 2;
161}
162
163/* Is the buffer the beginning of a tinc connections?
164 * Protocol is documented here: http://www.tinc-vpn.org/documentation/tinc.pdf
165 * First connection starts with "0 " in 1.0.15)
166 * */
167static int is_tinc_protocol( const char *p, int len, struct proto *proto)
168{
169    if (len < 2)
170        return PROBE_AGAIN;
171
172    return !strncmp(p, "0 ", 2);
173}
174
175/* Is the buffer the beginning of a jabber (XMPP) connections?
176 * (Protocol is documented (http://tools.ietf.org/html/rfc6120) but for lazy
177 * clients, just checking first frame containing "jabber" in xml entity)
178 * */
179static int is_xmpp_protocol( const char *p, int len, struct proto *proto)
180{
181    /* sometimes the word 'jabber' shows up late in the initial string,
182       sometimes after a newline. this makes sure we snarf the entire preamble
183       and detect it. (fixed for adium/pidgin) */
184    if (len < 50)
185        return PROBE_AGAIN;
186
187    return memmem(p, len, "jabber", 6) ? 1 : 0;
188}
189
190static int probe_http_method(const char *p, int len, const char *opt)
191{
192    if (len < strlen(opt))
193        return PROBE_AGAIN;
194
195    return !strncmp(p, opt, len);
196}
197
198/* Is the buffer the beginning of an HTTP connection?  */
199static int is_http_protocol(const char *p, int len, struct proto *proto)
200{
201    int res;
202    /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */
203    if (memmem(p, len, "HTTP", 4))
204        return PROBE_MATCH;
205
206#define PROBE_HTTP_METHOD(opt) if ((res = probe_http_method(p, len, opt)) != PROBE_NEXT) return res
207
208    /* Otherwise it could be HTTP/1.0 without version: check if it's got an
209     * HTTP method (RFC2616 5.1.1) */
210    PROBE_HTTP_METHOD("OPTIONS");
211    PROBE_HTTP_METHOD("GET");
212    PROBE_HTTP_METHOD("HEAD");
213    PROBE_HTTP_METHOD("POST");
214    PROBE_HTTP_METHOD("PUT");
215    PROBE_HTTP_METHOD("DELETE");
216    PROBE_HTTP_METHOD("TRACE");
217    PROBE_HTTP_METHOD("CONNECT");
218
219#undef PROBE_HTTP_METHOD
220
221    return PROBE_NEXT;
222}
223
224static int is_sni_alpn_protocol(const char *p, int len, struct proto *proto)
225{
226    int valid_tls;
227
228    valid_tls = parse_tls_header(proto->data, p, len);
229
230    if(valid_tls < 0)
231        return -1 == valid_tls ? PROBE_AGAIN : PROBE_NEXT;
232
233    /* There *was* a valid match */
234    return PROBE_MATCH;
235}
236
237static int is_tls_protocol(const char *p, int len, struct proto *proto)
238{
239    if (len < 3)
240        return PROBE_AGAIN;
241
242    /* TLS packet starts with a record "Hello" (0x16), followed by version
243     * (0x03 0x00-0x03) (RFC6101 A.1)
244     * This means we reject SSLv2 and lower, which is actually a good thing (RFC6176)
245     */
246    return p[0] == 0x16 && p[1] == 0x03 && ( p[2] >= 0 && p[2] <= 0x03);
247}
248
249static int is_adb_protocol(const char *p, int len, struct proto *proto)
250{
251    if (len < 30)
252        return PROBE_AGAIN;
253
254    /* The initial ADB host->device packet has a command type of CNXN, and a
255     * data payload starting with "host:".  Note that current versions of the
256     * client hardcode "host::" (with empty serialno and banner fields) but
257     * other clients may populate those fields.
258     *
259     * We aren't checking amessage.data_length, under the assumption that
260     * a packet >= 30 bytes long will have "something" in the payload field.
261     */
262    return !memcmp(&p[0], "CNXN", 4) && !memcmp(&p[24], "host:", 5);
263}
264
265static int regex_probe(const char *p, int len, struct proto *proto)
266{
267#ifdef ENABLE_REGEX
268    regex_t **probe = proto->data;
269    regmatch_t pos = { 0, len };
270
271    for (; *probe && regexec(*probe, p, 0, &pos, REG_STARTEND); probe++)
272        /* try them all */;
273
274    return (*probe != NULL);
275#else
276    /* Should never happen as we check when loading config file */
277    fprintf(stderr, "FATAL: regex probe called but not built in\n");
278    exit(5);
279#endif
280}
281
282/* 
283 * Read the beginning of data coming from the client connection and check if
284 * it's a known protocol. 
285 * Return PROBE_AGAIN if not enough data, or PROBE_MATCH if it succeeded in
286 * which case cnx->proto is set to the appropriate protocol.
287 */
288int probe_client_protocol(struct connection *cnx)
289{
290    char buffer[BUFSIZ];
291    struct proto *p;
292    int n;
293
294    n = read(cnx->q[0].fd, buffer, sizeof(buffer));
295    /* It's possible that read() returns an error, e.g. if the client
296     * disconnected between the previous call to select() and now. If that
297     * happens, we just connect to the default protocol so the caller of this
298     * function does not have to deal with a specific  failure condition (the
299     * connection will just fail later normally). */
300    if (n > 0) {
301        int res = PROBE_NEXT;
302
303        defer_write(&cnx->q[1], buffer, n);
304
305        for (p = cnx->proto; p && res == PROBE_NEXT; p = p->next) {
306            if (! p->probe) continue;
307            if (verbose) fprintf(stderr, "probing for %s\n", p->description);
308
309            cnx->proto = p;
310            res = p->probe(cnx->q[1].begin_deferred_data, cnx->q[1].deferred_data_size, p);
311        }
312        if (res != PROBE_NEXT)
313            return res;
314    }
315
316    if (verbose) 
317        fprintf(stderr, 
318                "all probes failed, connecting to first protocol: %s\n", 
319                protocols->description);
320
321    /* If none worked, return the first one affected (that's completely
322     * arbitrary) */
323    cnx->proto = protocols;
324    return PROBE_MATCH;
325}
326
327/* Returns the structure for specified protocol or NULL if not found */
328static struct proto* get_protocol(const char* description)
329{
330    int i;
331
332    for (i = 0; i < ARRAY_SIZE(builtins); i++) {
333        if (!strcmp(builtins[i].description, description)) {
334            return &builtins[i];
335        }
336    }
337    return NULL;
338}
339
340/* Returns the probe for specified protocol:
341 * parameter is the description in builtins[], or "regex" 
342 * */
343T_PROBE* get_probe(const char* description) {
344    struct proto* p = get_protocol(description);
345
346    if (p)
347        return p->probe;
348
349    /* Special case of "regex" probe (we don't want to set it in builtins
350     * because builtins is also used to build the command-line options and
351     * regexp is not legal on the command line)*/
352    if (!strcmp(description, "regex"))
353        return regex_probe;
354
355    /* Special case of "sni/alpn" probe for same reason as above*/
356    if (!strcmp(description, "sni_alpn"))
357        return is_sni_alpn_protocol;
358
359    /* Special case of "timeout" is allowed as a probe name in the
360     * configuration file even though it's not really a probe */
361    if (!strcmp(description, "timeout"))
362        return is_true;
363
364    return NULL;
365}
366
367
368

Built with git-ssb-web