git ssb

0+

cel / sslh



Tree: 3550cbe77c3429d32f849c2a7074896719055a0c

Files: 3550cbe77c3429d32f849c2a7074896719055a0c / probe.c

9686 bytesRaw
1/*
2# probe.c: Code for probing protocols
3#
4# Copyright (C) 2007-2012  Yves Rutschle
5# 
6# This program is free software; you can redistribute it
7# and/or modify it under the terms of the GNU General Public
8# License as published by the Free Software Foundation; either
9# version 2 of the License, or (at your option) any later
10# version.
11# 
12# This program is distributed in the hope that it will be
13# useful, but WITHOUT ANY WARRANTY; without even the implied
14# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
15# PURPOSE.  See the GNU General Public License for more
16# details.
17# 
18# The full text for the General Public License is here:
19# http://www.gnu.org/licenses/gpl.html
20*/
21
22#define _GNU_SOURCE
23#include <stdio.h>
24#include <regex.h>
25#include <ctype.h>
26#include "probe.h"
27
28
29
30static int is_ssh_protocol(const char *p, int len, struct proto*);
31static int is_openvpn_protocol(const char *p, int len, struct proto*);
32static int is_tinc_protocol(const char *p, int len, struct proto*);
33static int is_xmpp_protocol(const char *p, int len, struct proto*);
34static int is_http_protocol(const char *p, int len, struct proto*);
35static int is_tls_protocol(const char *p, int len, struct proto*);
36static int is_true(const char *p, int len, struct proto* proto) { return 1; }
37
38/* Table of protocols that have a built-in probe
39 */
40static struct proto builtins[] = {
41    /* description   service  saddr   probe  */
42    { "ssh",         "sshd",   NULL,   is_ssh_protocol},
43    { "openvpn",     NULL,     NULL,   is_openvpn_protocol },
44    { "tinc",        NULL,     NULL,   is_tinc_protocol },
45    { "xmpp",        NULL,     NULL,   is_xmpp_protocol },
46    { "http",        NULL,     NULL,   is_http_protocol },
47    { "ssl",         NULL,     NULL,   is_tls_protocol },
48    { "tls",         NULL,     NULL,   is_tls_protocol },
49    { "anyprot",     NULL,     NULL,   is_true }
50};
51
52static struct proto *protocols;
53static char* on_timeout = "ssh";
54
55struct proto*  get_builtins(void) {
56    return builtins;
57}
58
59int get_num_builtins(void) {
60    return ARRAY_SIZE(builtins);
61}
62
63/* Sets the protocol name to connect to in case of timeout */
64void set_ontimeout(const char* name)
65{
66    int res = asprintf(&on_timeout, "%s", name);
67    CHECK_RES_DIE(res, "asprintf");
68}
69
70/* Returns the protocol to connect to in case of timeout; 
71 * if not found, return the first protocol specified 
72 */
73struct proto* timeout_protocol(void) 
74{
75    struct proto* p = get_first_protocol();
76    for (; p && strcmp(p->description, on_timeout); p = p->next);
77    if (p) return p;
78    return get_first_protocol();
79}
80
81/* returns the first protocol (caller can then follow the *next pointers) */
82struct proto* get_first_protocol(void)
83{
84    return protocols;
85}
86
87void set_protocol_list(struct proto* prots)
88{
89    protocols = prots;
90}
91
92/* From http://grapsus.net/blog/post/Hexadecimal-dump-in-C */
93#define HEXDUMP_COLS 16
94void hexdump(const char *mem, unsigned int len)
95{
96    unsigned int i, j;
97
98    for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++)
99    {
100        /* print offset */
101        if(i % HEXDUMP_COLS == 0)
102            printf("0x%06x: ", i);
103
104        /* print hex data */
105        if(i < len)
106            printf("%02x ", 0xFF & mem[i]);
107        else /* end of block, just aligning for ASCII dump */
108            printf("   ");
109
110        /* print ASCII dump */
111        if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) {
112            for(j = i - (HEXDUMP_COLS - 1); j <= i; j++) {
113                if(j >= len) /* end of block, not really printing */
114                    putchar(' ');
115                else if(isprint(mem[j])) /* printable char */
116                    putchar(0xFF & mem[j]);        
117                else /* other char */
118                    putchar('.');
119            }
120            putchar('\n');
121        }
122    }
123}
124
125/* Is the buffer the beginning of an SSH connection? */
126static int is_ssh_protocol(const char *p, int len, struct proto *proto)
127{
128    if (len < 4)
129        return PROBE_AGAIN;
130
131    return !strncmp(p, "SSH-", 4);
132}
133
134/* Is the buffer the beginning of an OpenVPN connection?
135 *
136 * Code inspired from OpenVPN port-share option; however, OpenVPN code is
137 * wrong: users using pre-shared secrets have non-initialised key_id fields so
138 * p[3] & 7 should not be looked at, and also the key_method can be specified
139 * to 1 which changes the opcode to P_CONTROL_HARD_RESET_CLIENT_V1.
140 * See:
141 * http://www.fengnet.com/book/vpns%20illustrated%20tunnels%20%20vpnsand%20ipsec/ch08lev1sec5.html
142 * and OpenVPN ssl.c, ssl.h and options.c
143 */
144static int is_openvpn_protocol (const char*p,int len, struct proto *proto)
145{
146    int packet_len;
147
148    if (len < 2)
149        return PROBE_AGAIN;
150
151    packet_len = ntohs(*(uint16_t*)p);
152    return packet_len == len - 2;
153}
154
155/* Is the buffer the beginning of a tinc connections?
156 * (protocol is undocumented, but starts with "0 " in 1.0.15)
157 * */
158static int is_tinc_protocol( const char *p, int len, struct proto *proto)
159{
160    if (len < 2)
161        return PROBE_AGAIN;
162
163    return !strncmp(p, "0 ", 2);
164}
165
166/* Is the buffer the beginning of a jabber (XMPP) connections?
167 * (Protocol is documented (http://tools.ietf.org/html/rfc6120) but for lazy
168 * clients, just checking first frame containing "jabber" in xml entity)
169 * */
170static int is_xmpp_protocol( const char *p, int len, struct proto *proto)
171{
172    /* sometimes the word 'jabber' shows up late in the initial string,
173       sometimes after a newline. this makes sure we snarf the entire preamble
174       and detect it. (fixed for adium/pidgin) */
175    if (len < 50)
176        return PROBE_AGAIN;
177
178    return memmem(p, len, "jabber", 6) ? 1 : 0;
179}
180
181static int probe_http_method(const char *p, int len, const char *opt)
182{
183    if (len < strlen(opt))
184        return PROBE_AGAIN;
185
186    return !strncmp(p, opt, len);
187}
188
189/* Is the buffer the beginning of an HTTP connection?  */
190static int is_http_protocol(const char *p, int len, struct proto *proto)
191{
192    int res;
193    /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */
194    if (memmem(p, len, "HTTP", 4))
195        return PROBE_MATCH;
196
197#define PROBE_HTTP_METHOD(opt) if ((res = probe_http_method(p, len, opt)) != PROBE_NEXT) return res
198
199    /* Otherwise it could be HTTP/1.0 without version: check if it's got an
200     * HTTP method (RFC2616 5.1.1) */
201    PROBE_HTTP_METHOD("OPTIONS");
202    PROBE_HTTP_METHOD("GET");
203    PROBE_HTTP_METHOD("HEAD");
204    PROBE_HTTP_METHOD("POST");
205    PROBE_HTTP_METHOD("PUT");
206    PROBE_HTTP_METHOD("DELETE");
207    PROBE_HTTP_METHOD("TRACE");
208    PROBE_HTTP_METHOD("CONNECT");
209
210#undef PROBE_HTTP_METHOD
211
212    return PROBE_NEXT;
213}
214
215static int is_tls_protocol(const char *p, int len, struct proto *proto)
216{
217    if (len < 3)
218        return PROBE_AGAIN;
219
220    /* TLS packet starts with a record "Hello" (0x16), followed by version
221     * (0x03 0x00-0x03) (RFC6101 A.1)
222     * This means we reject SSLv2 and lower, which is actually a good thing (RFC6176)
223     */
224    return p[0] == 0x16 && p[1] == 0x03 && ( p[2] >= 0 && p[2] <= 0x03);
225}
226
227static int regex_probe(const char *p, int len, struct proto *proto)
228{
229    regex_t **probe = proto->data;
230    regmatch_t pos = { 0, len };
231
232    for (; *probe && regexec(*probe, p, 0, &pos, REG_STARTEND); probe++)
233        /* try them all */;
234
235    return (*probe != NULL);
236}
237
238/* 
239 * Read the beginning of data coming from the client connection and check if
240 * it's a known protocol. 
241 * Return PROBE_AGAIN if not enough data, or PROBE_MATCH if it succeeded in
242 * which case cnx->proto is set to the appropriate protocol.
243 */
244int probe_client_protocol(struct connection *cnx)
245{
246    char buffer[BUFSIZ];
247    struct proto *p;
248    int n;
249
250    n = read(cnx->q[0].fd, buffer, sizeof(buffer));
251    /* It's possible that read() returns an error, e.g. if the client
252     * disconnected between the previous call to select() and now. If that
253     * happens, we just connect to the default protocol so the caller of this
254     * function does not have to deal with a specific  failure condition (the
255     * connection will just fail later normally). */
256    if (n > 0) {
257        int res = PROBE_NEXT;
258
259        defer_write(&cnx->q[1], buffer, n);
260
261        for (p = cnx->proto; p && res == PROBE_NEXT; p = p->next) {
262            if (! p->probe) continue;
263            if (verbose) fprintf(stderr, "probing for %s\n", p->description);
264
265            cnx->proto = p;
266            res = p->probe(cnx->q[1].begin_deferred_data, cnx->q[1].deferred_data_size, p);
267        }
268        if (res != PROBE_NEXT)
269            return res;
270    }
271
272    if (verbose) 
273        fprintf(stderr, 
274                "all probes failed, connecting to first protocol: %s\n", 
275                protocols->description);
276
277    /* If none worked, return the first one affected (that's completely
278     * arbitrary) */
279    cnx->proto = protocols;
280    return PROBE_MATCH;
281}
282
283/* Returns the structure for specified protocol or NULL if not found */
284static struct proto* get_protocol(const char* description)
285{
286    int i;
287
288    for (i = 0; i < ARRAY_SIZE(builtins); i++) {
289        if (!strcmp(builtins[i].description, description)) {
290            return &builtins[i];
291        }
292    }
293    return NULL;
294}
295
296/* Returns the probe for specified protocol:
297 * parameter is the description in builtins[], or "regex" 
298 * */
299T_PROBE* get_probe(const char* description) {
300    struct proto* p = get_protocol(description);
301
302    if (p)
303        return p->probe;
304
305    /* Special case of "regex" probe (we don't want to set it in builtins
306     * because builtins is also used to build the command-line options and
307     * regexp is not legal on the command line)*/
308    if (!strcmp(description, "regex"))
309        return regex_probe;
310
311    return NULL;
312}
313
314
315

Built with git-ssb-web