Files: f4d2a8d2adb32056e656a73ce3d1d1d155f81046 / probe.c
11620 bytesRaw
1 | /* |
2 | # probe.c: Code for probing protocols |
3 | # |
4 | # Copyright (C) 2007-2015 Yves Rutschle |
5 | # |
6 | # This program is free software; you can redistribute it |
7 | # and/or modify it under the terms of the GNU General Public |
8 | # License as published by the Free Software Foundation; either |
9 | # version 2 of the License, or (at your option) any later |
10 | # version. |
11 | # |
12 | # This program is distributed in the hope that it will be |
13 | # useful, but WITHOUT ANY WARRANTY; without even the implied |
14 | # warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR |
15 | # PURPOSE. See the GNU General Public License for more |
16 | # details. |
17 | # |
18 | # The full text for the General Public License is here: |
19 | # http://www.gnu.org/licenses/gpl.html |
20 | */ |
21 | |
22 | |
23 | |
24 | |
25 | |
26 | |
27 | |
28 | |
29 | |
30 | |
31 | |
32 | |
33 | |
34 | |
35 | |
36 | static int is_ssh_protocol(const char *p, int len, struct proto*); |
37 | static int is_openvpn_protocol(const char *p, int len, struct proto*); |
38 | static int is_tinc_protocol(const char *p, int len, struct proto*); |
39 | static int is_xmpp_protocol(const char *p, int len, struct proto*); |
40 | static int is_http_protocol(const char *p, int len, struct proto*); |
41 | static int is_tls_protocol(const char *p, int len, struct proto*); |
42 | static int is_adb_protocol(const char *p, int len, struct proto*); |
43 | static int is_true(const char *p, int len, struct proto* proto) { return 1; } |
44 | |
45 | /* Table of protocols that have a built-in probe |
46 | */ |
47 | static struct proto builtins[] = { |
48 | /* description service saddr log_level keepalive probe */ |
49 | { "ssh", "sshd", NULL, 1, 0, is_ssh_protocol}, |
50 | { "openvpn", NULL, NULL, 1, 0, is_openvpn_protocol }, |
51 | { "tinc", NULL, NULL, 1, 0, is_tinc_protocol }, |
52 | { "xmpp", NULL, NULL, 1, 0, is_xmpp_protocol }, |
53 | { "http", NULL, NULL, 1, 0, is_http_protocol }, |
54 | { "ssl", NULL, NULL, 1, 0, is_tls_protocol }, |
55 | { "tls", NULL, NULL, 1, 0, is_tls_protocol }, |
56 | { "adb", NULL, NULL, 1, 0, is_adb_protocol }, |
57 | { "anyprot", NULL, NULL, 1, 0, is_true } |
58 | }; |
59 | |
60 | static struct proto *protocols; |
61 | static char* on_timeout = "ssh"; |
62 | |
63 | struct proto* get_builtins(void) { |
64 | return builtins; |
65 | } |
66 | |
67 | int get_num_builtins(void) { |
68 | return ARRAY_SIZE(builtins); |
69 | } |
70 | |
71 | /* Sets the protocol name to connect to in case of timeout */ |
72 | void set_ontimeout(const char* name) |
73 | { |
74 | int res = asprintf(&on_timeout, "%s", name); |
75 | CHECK_RES_DIE(res, "asprintf"); |
76 | } |
77 | |
78 | /* Returns the protocol to connect to in case of timeout; |
79 | * if not found, return the first protocol specified |
80 | */ |
81 | struct proto* timeout_protocol(void) |
82 | { |
83 | struct proto* p = get_first_protocol(); |
84 | for (; p && strcmp(p->description, on_timeout); p = p->next); |
85 | if (p) return p; |
86 | return get_first_protocol(); |
87 | } |
88 | |
89 | /* returns the first protocol (caller can then follow the *next pointers) */ |
90 | struct proto* get_first_protocol(void) |
91 | { |
92 | return protocols; |
93 | } |
94 | |
95 | void set_protocol_list(struct proto* prots) |
96 | { |
97 | protocols = prots; |
98 | } |
99 | |
100 | /* From http://grapsus.net/blog/post/Hexadecimal-dump-in-C */ |
101 | |
102 | void hexdump(const char *mem, unsigned int len) |
103 | { |
104 | unsigned int i, j; |
105 | |
106 | for(i = 0; i < len + ((len % HEXDUMP_COLS) ? (HEXDUMP_COLS - len % HEXDUMP_COLS) : 0); i++) |
107 | { |
108 | /* print offset */ |
109 | if(i % HEXDUMP_COLS == 0) |
110 | printf("0x%06x: ", i); |
111 | |
112 | /* print hex data */ |
113 | if(i < len) |
114 | printf("%02x ", 0xFF & mem[i]); |
115 | else /* end of block, just aligning for ASCII dump */ |
116 | printf(" "); |
117 | |
118 | /* print ASCII dump */ |
119 | if(i % HEXDUMP_COLS == (HEXDUMP_COLS - 1)) { |
120 | for(j = i - (HEXDUMP_COLS - 1); j <= i; j++) { |
121 | if(j >= len) /* end of block, not really printing */ |
122 | putchar(' '); |
123 | else if(isprint(mem[j])) /* printable char */ |
124 | putchar(0xFF & mem[j]); |
125 | else /* other char */ |
126 | putchar('.'); |
127 | } |
128 | putchar('\n'); |
129 | } |
130 | } |
131 | } |
132 | |
133 | /* Is the buffer the beginning of an SSH connection? */ |
134 | static int is_ssh_protocol(const char *p, int len, struct proto *proto) |
135 | { |
136 | if (len < 4) |
137 | return PROBE_AGAIN; |
138 | |
139 | return !strncmp(p, "SSH-", 4); |
140 | } |
141 | |
142 | /* Is the buffer the beginning of an OpenVPN connection? |
143 | * |
144 | * Code inspired from OpenVPN port-share option; however, OpenVPN code is |
145 | * wrong: users using pre-shared secrets have non-initialised key_id fields so |
146 | * p[3] & 7 should not be looked at, and also the key_method can be specified |
147 | * to 1 which changes the opcode to P_CONTROL_HARD_RESET_CLIENT_V1. |
148 | * See: |
149 | * http://www.fengnet.com/book/vpns%20illustrated%20tunnels%20%20vpnsand%20ipsec/ch08lev1sec5.html |
150 | * and OpenVPN ssl.c, ssl.h and options.c |
151 | */ |
152 | static int is_openvpn_protocol (const char*p,int len, struct proto *proto) |
153 | { |
154 | int packet_len; |
155 | |
156 | if (len < 2) |
157 | return PROBE_AGAIN; |
158 | |
159 | packet_len = ntohs(*(uint16_t*)p); |
160 | return packet_len == len - 2; |
161 | } |
162 | |
163 | /* Is the buffer the beginning of a tinc connections? |
164 | * Protocol is documented here: http://www.tinc-vpn.org/documentation/tinc.pdf |
165 | * First connection starts with "0 " in 1.0.15) |
166 | * */ |
167 | static int is_tinc_protocol( const char *p, int len, struct proto *proto) |
168 | { |
169 | if (len < 2) |
170 | return PROBE_AGAIN; |
171 | |
172 | return !strncmp(p, "0 ", 2); |
173 | } |
174 | |
175 | /* Is the buffer the beginning of a jabber (XMPP) connections? |
176 | * (Protocol is documented (http://tools.ietf.org/html/rfc6120) but for lazy |
177 | * clients, just checking first frame containing "jabber" in xml entity) |
178 | * */ |
179 | static int is_xmpp_protocol( const char *p, int len, struct proto *proto) |
180 | { |
181 | /* sometimes the word 'jabber' shows up late in the initial string, |
182 | sometimes after a newline. this makes sure we snarf the entire preamble |
183 | and detect it. (fixed for adium/pidgin) */ |
184 | if (len < 50) |
185 | return PROBE_AGAIN; |
186 | |
187 | return memmem(p, len, "jabber", 6) ? 1 : 0; |
188 | } |
189 | |
190 | static int probe_http_method(const char *p, int len, const char *opt) |
191 | { |
192 | if (len < strlen(opt)) |
193 | return PROBE_AGAIN; |
194 | |
195 | return !strncmp(p, opt, len); |
196 | } |
197 | |
198 | /* Is the buffer the beginning of an HTTP connection? */ |
199 | static int is_http_protocol(const char *p, int len, struct proto *proto) |
200 | { |
201 | int res; |
202 | /* If it's got HTTP in the request (HTTP/1.1) then it's HTTP */ |
203 | if (memmem(p, len, "HTTP", 4)) |
204 | return PROBE_MATCH; |
205 | |
206 | |
207 | |
208 | /* Otherwise it could be HTTP/1.0 without version: check if it's got an |
209 | * HTTP method (RFC2616 5.1.1) */ |
210 | PROBE_HTTP_METHOD("OPTIONS"); |
211 | PROBE_HTTP_METHOD("GET"); |
212 | PROBE_HTTP_METHOD("HEAD"); |
213 | PROBE_HTTP_METHOD("POST"); |
214 | PROBE_HTTP_METHOD("PUT"); |
215 | PROBE_HTTP_METHOD("DELETE"); |
216 | PROBE_HTTP_METHOD("TRACE"); |
217 | PROBE_HTTP_METHOD("CONNECT"); |
218 | |
219 | |
220 | |
221 | return PROBE_NEXT; |
222 | } |
223 | |
224 | static int is_sni_alpn_protocol(const char *p, int len, struct proto *proto) |
225 | { |
226 | int valid_tls; |
227 | |
228 | valid_tls = parse_tls_header(proto->data, p, len); |
229 | |
230 | if(valid_tls < 0) |
231 | return -1 == valid_tls ? PROBE_AGAIN : PROBE_NEXT; |
232 | |
233 | /* There *was* a valid match */ |
234 | return PROBE_MATCH; |
235 | } |
236 | |
237 | static int is_tls_protocol(const char *p, int len, struct proto *proto) |
238 | { |
239 | if (len < 3) |
240 | return PROBE_AGAIN; |
241 | |
242 | /* TLS packet starts with a record "Hello" (0x16), followed by version |
243 | * (0x03 0x00-0x03) (RFC6101 A.1) |
244 | * This means we reject SSLv2 and lower, which is actually a good thing (RFC6176) |
245 | */ |
246 | return p[0] == 0x16 && p[1] == 0x03 && ( p[2] >= 0 && p[2] <= 0x03); |
247 | } |
248 | |
249 | static int is_adb_protocol(const char *p, int len, struct proto *proto) |
250 | { |
251 | if (len < 30) |
252 | return PROBE_AGAIN; |
253 | |
254 | /* The initial ADB host->device packet has a command type of CNXN, and a |
255 | * data payload starting with "host:". Note that current versions of the |
256 | * client hardcode "host::" (with empty serialno and banner fields) but |
257 | * other clients may populate those fields. |
258 | * |
259 | * We aren't checking amessage.data_length, under the assumption that |
260 | * a packet >= 30 bytes long will have "something" in the payload field. |
261 | */ |
262 | return !memcmp(&p[0], "CNXN", 4) && !memcmp(&p[24], "host:", 5); |
263 | } |
264 | |
265 | static int regex_probe(const char *p, int len, struct proto *proto) |
266 | { |
267 | |
268 | regex_t **probe = proto->data; |
269 | regmatch_t pos = { 0, len }; |
270 | |
271 | for (; *probe && regexec(*probe, p, 0, &pos, REG_STARTEND); probe++) |
272 | /* try them all */; |
273 | |
274 | return (*probe != NULL); |
275 | |
276 | /* Should never happen as we check when loading config file */ |
277 | fprintf(stderr, "FATAL: regex probe called but not built in\n"); |
278 | exit(5); |
279 | |
280 | } |
281 | |
282 | /* |
283 | * Read the beginning of data coming from the client connection and check if |
284 | * it's a known protocol. |
285 | * Return PROBE_AGAIN if not enough data, or PROBE_MATCH if it succeeded in |
286 | * which case cnx->proto is set to the appropriate protocol. |
287 | */ |
288 | int probe_client_protocol(struct connection *cnx) |
289 | { |
290 | char buffer[BUFSIZ]; |
291 | struct proto *p; |
292 | int n; |
293 | |
294 | n = read(cnx->q[0].fd, buffer, sizeof(buffer)); |
295 | /* It's possible that read() returns an error, e.g. if the client |
296 | * disconnected between the previous call to select() and now. If that |
297 | * happens, we just connect to the default protocol so the caller of this |
298 | * function does not have to deal with a specific failure condition (the |
299 | * connection will just fail later normally). */ |
300 | if (n > 0) { |
301 | int res = PROBE_NEXT; |
302 | |
303 | defer_write(&cnx->q[1], buffer, n); |
304 | |
305 | for (p = cnx->proto; p && res == PROBE_NEXT; p = p->next) { |
306 | if (! p->probe) continue; |
307 | if (verbose) fprintf(stderr, "probing for %s\n", p->description); |
308 | |
309 | cnx->proto = p; |
310 | res = p->probe(cnx->q[1].begin_deferred_data, cnx->q[1].deferred_data_size, p); |
311 | } |
312 | if (res != PROBE_NEXT) |
313 | return res; |
314 | } |
315 | |
316 | if (verbose) |
317 | fprintf(stderr, |
318 | "all probes failed, connecting to first protocol: %s\n", |
319 | protocols->description); |
320 | |
321 | /* If none worked, return the first one affected (that's completely |
322 | * arbitrary) */ |
323 | cnx->proto = protocols; |
324 | return PROBE_MATCH; |
325 | } |
326 | |
327 | /* Returns the structure for specified protocol or NULL if not found */ |
328 | static struct proto* get_protocol(const char* description) |
329 | { |
330 | int i; |
331 | |
332 | for (i = 0; i < ARRAY_SIZE(builtins); i++) { |
333 | if (!strcmp(builtins[i].description, description)) { |
334 | return &builtins[i]; |
335 | } |
336 | } |
337 | return NULL; |
338 | } |
339 | |
340 | /* Returns the probe for specified protocol: |
341 | * parameter is the description in builtins[], or "regex" |
342 | * */ |
343 | T_PROBE* get_probe(const char* description) { |
344 | struct proto* p = get_protocol(description); |
345 | |
346 | if (p) |
347 | return p->probe; |
348 | |
349 | /* Special case of "regex" probe (we don't want to set it in builtins |
350 | * because builtins is also used to build the command-line options and |
351 | * regexp is not legal on the command line)*/ |
352 | if (!strcmp(description, "regex")) |
353 | return regex_probe; |
354 | |
355 | /* Special case of "sni/alpn" probe for same reason as above*/ |
356 | if (!strcmp(description, "sni_alpn")) |
357 | return is_sni_alpn_protocol; |
358 | |
359 | /* Special case of "timeout" is allowed as a probe name in the |
360 | * configuration file even though it's not really a probe */ |
361 | if (!strcmp(description, "timeout")) |
362 | return is_true; |
363 | |
364 | return NULL; |
365 | } |
366 | |
367 | |
368 |
Built with git-ssb-web