Skip to content

Commit b5b3ebe

Browse files
IvanNardiIvanNardi
authored
SSH: improve handling of unidirectional flows (#3215)
1 parent 533ae2f commit b5b3ebe

3 files changed

Lines changed: 70 additions & 1 deletion

File tree

‎src/lib/protocols/ssh.c‎

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,17 @@ static void ssh_analyse_cipher(struct ndpi_detection_module_struct *ndpi_struct,
216216
/* ************************************************************************ */
217217

218218
static int search_ssh_again(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
219+
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
220+
221+
if(packet->payload_packet_len == 0 ||
222+
packet->tcp_retransmission) {
223+
#ifdef SSH_DEBUG
224+
printf("[SSH] Ack or retransmission %d/%d. Skip\n",
225+
packet->payload_packet_len, packet->tcp_retransmission);
226+
#endif
227+
return(1); /* Keep working */
228+
}
229+
219230
ndpi_search_ssh_tcp(ndpi_struct, flow);
220231

221232
if((flow->protos.ssh.hassh_client[0] != '\0')
@@ -599,7 +610,7 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
599610
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
600611

601612
#ifdef SSH_DEBUG
602-
printf("[SSH] %s()\n", __FUNCTION__);
613+
printf("[SSH] %s() stage %d\n", __FUNCTION__, flow->l4.tcp.ssh_stage);
603614
#endif
604615

605616
if(flow->l4.tcp.ssh_stage <= 1) {
@@ -642,6 +653,19 @@ static void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct
642653

643654
flow->l4.tcp.ssh_stage++;
644655
return;
656+
} else {
657+
/* Unexpected msg. Check if this is an unidirectional flow with
658+
* banner + key exchange only in one direction */
659+
if(flow->l4.tcp.ssh_stage == 1 &&
660+
(flow->packet_direction_counter[0] == 0 || flow->packet_direction_counter[1] == 0)) {
661+
#ifdef SSH_DEBUG
662+
printf("[SSH] Check if this is an unidirectional flow\n");
663+
#endif
664+
flow->l4.tcp.ssh_stage++;
665+
ndpi_search_ssh_tcp(ndpi_struct, flow); /* Recursion */
666+
return;
667+
}
668+
645669
}
646670
} else if(packet->payload_packet_len > 5) {
647671
u_int8_t msgcode = *(packet->payload + 5);

‎tests/cfgs/default/pcap/ssh_pq.pcap‎

15.4 KB
Binary file not shown.

‎tests/cfgs/default/result/ssh_pq.pcap.out‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
Guessed flow protos: 1
2+
3+
DPI Packets (TCP): 58 (8.29 pkts/flow)
4+
Confidence Match by port : 1 (flows)
5+
Confidence DPI : 6 (flows)
6+
Num dissector calls: 6 (0.86 diss/flow)
7+
LRU cache ookla: 0/0/0 (insert/search/found)
8+
LRU cache bittorrent: 0/3/0 (insert/search/found)
9+
LRU cache stun: 0/0/0 (insert/search/found)
10+
LRU cache tls_cert: 0/0/0 (insert/search/found)
11+
LRU cache mining: 0/1/0 (insert/search/found)
12+
LRU cache msteams: 0/0/0 (insert/search/found)
13+
LRU cache fpc_dns: 0/7/0 (insert/search/found)
14+
Automa host: 0/0 (search/found)
15+
Automa domain: 0/0 (search/found)
16+
Automa tls cert: 0/0 (search/found)
17+
Automa risk mask: 0/0 (search/found)
18+
Automa common alpns: 0/0 (search/found)
19+
Patricia risk mask: 12/0 (search/found)
20+
Patricia risk mask IPv6: 0/0 (search/found)
21+
Patricia risk: 0/0 (search/found)
22+
Patricia risk IPv6: 0/0 (search/found)
23+
Patricia protocols: 14/0 (search/found)
24+
Patricia protocols IPv6: 0/0 (search/found)
25+
Hash malicious ja4: 0/0 (search/found)
26+
Hash malicious sha1: 0/0 (search/found)
27+
Hash TCP fingerprints: 6/0 (search/found)
28+
Hash public domain suffix: 0/0 (search/found)
29+
Hash ja4 custom protos: 0/0 (search/found)
30+
Hash fp custom protos: 0/0 (search/found)
31+
Hash url custom protos: 0/0 (search/found)
32+
33+
SSH 85 12780 7
34+
35+
Acceptable 85 12780 7
36+
37+
RemoteAccess 85 12780 7
38+
39+
1 TCP 192.168.16.213:58639 <-> 192.168.16.5:22 [proto: 92/SSH][Stack: SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: RemoteAccess/12][Breed: Acceptable][11 pkts/2011 bytes <-> 11 pkts/2203 bytes][Goodput ratio: 63/67][0.11 sec][Hostname/SNI: SSH-2.0-OpenSSH_6.1][bytes ratio: -0.046 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 7/7 39/41 12/13][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 183/200 1026/770 270/223][Risk: ** SSH Obsolete Cli Vers/Cipher **** SSH Obsolete Ser Vers/Cipher **][Risk Score: 150][Risk Info: Found cipher arcfour128;Found cipher arcfour128][TCP Fingerprint: 2_64_14600_2e3cee914fc1/Unknown][HASSH-C: D6593B3202A30B2AA9793A00F8647A0A][Server: SSH-1.99-OpenSSH_4.3][HASSH-S: 500033A73A293E7C36743693D0D4596B][Plen Bins: 31,15,15,0,15,0,0,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
40+
2 TCP 192.168.1.10:52347 <-> 192.168.1.20:22 [proto: 92/SSH][Stack: SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: RemoteAccess/12][Breed: Acceptable][8 pkts/1133 bytes <-> 7 pkts/1015 bytes][Goodput ratio: 62/63][0.14 sec][Hostname/SNI: SSH-2.0-OpenSSH_9.7-PQC][bytes ratio: 0.055 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 10/10 18/20 30/30 9/10][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 142/145 730/666 223/213][Risk: ** SSH Obsolete Cli Vers/Cipher **** SSH Obsolete Ser Vers/Cipher **** Malicious Fingerprint **][Risk Score: 250][Risk Info: Massive scanner detected][TCP Fingerprint: 2_64_64240_e3b0c44298fc/Unknown][HASSH-C: CF9CACDD957AD59F08E20EDEAC7E184E][Server: SSH-2.0-OpenSSH_9.8-PQC][HASSH-S: 9CCEFCEF20384A8AA990E37D957C6322][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
41+
3 TCP 192.168.1.10:52345 <-> 192.168.1.20:22 [proto: 92/SSH][Stack: SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: RemoteAccess/12][Breed: Acceptable][8 pkts/1133 bytes <-> 7 pkts/971 bytes][Goodput ratio: 62/61][0.01 sec][Hostname/SNI: SSH-2.0-OpenSSH_9.7-PQC][bytes ratio: 0.077 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/1 2/2 3/3 1/1][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 142/139 730/626 223/199][Risk: ** SSH Obsolete Cli Vers/Cipher **** SSH Obsolete Ser Vers/Cipher **** Malicious Fingerprint **][Risk Score: 250][Risk Info: Massive scanner detected][TCP Fingerprint: 2_64_64240_e3b0c44298fc/Unknown][HASSH-C: CF9CACDD957AD59F08E20EDEAC7E184E][Server: SSH-2.0-OpenSSH_9.3][HASSH-S: B32FE6141B7246CB7202461655BD909F][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,0,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
42+
4 TCP 192.168.1.10:52346 <-> 192.168.1.20:22 [proto: 92/SSH][Stack: SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 10][cat: RemoteAccess/12][Breed: Acceptable][8 pkts/1097 bytes <-> 7 pkts/999 bytes][Goodput ratio: 61/62][0.07 sec][Hostname/SNI: SSH-2.0-OpenSSH_9.3][bytes ratio: 0.047 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/5 9/10 15/15 4/5][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 137/143 698/650 212/207][Risk: ** SSH Obsolete Cli Vers/Cipher **** SSH Obsolete Ser Vers/Cipher **** Malicious Fingerprint **][Risk Score: 250][Risk Info: Massive scanner detected][TCP Fingerprint: 2_64_64240_e3b0c44298fc/Unknown][HASSH-C: CDC5758B151788B53E6218FA01BDF5BD][Server: SSH-2.0-OpenSSH_9.7-PQC][HASSH-S: 50A21EE9B40048EE308B3E3EA33B22D2][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
43+
5 TCP 192.168.1.10:52348 -> 192.168.1.20:22 [proto: 92/SSH][Stack: SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 8][cat: RemoteAccess/12][Breed: Acceptable][8 pkts/1025 bytes -> 0 pkts/0 bytes][Goodput ratio: 58/0][0.03 sec][Hostname/SNI: SSH-2.0-OpenSSH_9.3][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 4/0 6/0 2/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 128/0 626/0 188/0][Risk: ** SSH Obsolete Cli Vers/Cipher **** Malicious Fingerprint **** Unidirectional Traffic **][Risk Score: 210][Risk Info: No server to client traffic;Massive scanner detected][TCP Fingerprint: 2_64_64240_e3b0c44298fc/Unknown][HASSH-C: B32FE6141B7246CB7202461655BD909F][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
44+
6 TCP 192.168.1.20:22 -> 192.168.1.10:52349 [proto: 92/SSH][Stack: SSH][IP: 0/Unknown][Encrypted][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 7][cat: RemoteAccess/12][Breed: Acceptable][7 pkts/971 bytes -> 0 pkts/0 bytes][Goodput ratio: 61/0][0.04 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 3/0 6/0 9/0 3/0][Pkt Len c2s/s2c min/avg/max/stddev: 54/0 139/0 626/0 199/0][Risk: ** SSH Obsolete Ser Vers/Cipher **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No client to server traffic][Server: SSH-2.0-OpenSSH_9.3][HASSH-S: B32FE6141B7246CB7202461655BD909F][Plen Bins: 50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
45+
7 TCP 192.168.1.126:33336 -> 1.1.1.1:22 [proto: 92/SSH][Stack: SSH][IP: 0/Unknown][Encrypted][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 3][cat: RemoteAccess/12][Breed: Acceptable][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][2.08 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TCP Fingerprint: 2_64_64240_d876f498b09e/Unknown][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

0 commit comments

Comments
 (0)