Merge pull request ntop#255 from emanuele-f/openvpn

Fix openvpn with multiple hard_reset_client not being recognized
ydeng19 · Aug 27, 2016 · 7364fcc · 7364fcc
2 parents 2106024 + 562b90d
commit 7364fcc
Show file tree

Hide file tree

Showing 3 changed files with 18 additions and 9 deletions.
diff --git a/src/lib/protocols/openvpn.c b/src/lib/protocols/openvpn.c
@@ -35,6 +35,7 @@
 #define P_HMAC_160 20                            // (RSA-|DSA-)SHA(1), ..others, SHA1 is openvpn default
 #define P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) (9 + hmac_size)
 #define P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size)  (P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) + 8)
+#define P_HARD_RESET_CLIENT_MAX_COUNT  5
 
 static inline u_int32_t get_packet_id(const u_int8_t * payload, u_int8_t hms) {
   return ntohl(*(u_int32_t*)(payload + P_HARD_RESET_PACKET_ID_OFFSET(hms)));
@@ -57,6 +58,7 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct,
   u_int8_t opcode;
   u_int8_t alen;
   int8_t hmac_size;
+  int8_t failed = 0;
 
   if (packet->payload_packet_len >= 40) {
     // skip openvpn TCP transport packet size
@@ -65,7 +67,7 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct,
 
     opcode = ovpn_payload[0] & P_OPCODE_MASK;
 
-    if (flow->ovpn_counter == 0 && (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 ||
+    if (flow->ovpn_counter < P_HARD_RESET_CLIENT_MAX_COUNT && (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 ||
 				    opcode == P_CONTROL_HARD_RESET_CLIENT_V2)) {
 
       if (check_pkid_and_detect_hmac_size(ovpn_payload) > 0) {
@@ -76,8 +78,8 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct,
 		 flow->ovpn_session_id[0], flow->ovpn_session_id[1], flow->ovpn_session_id[2], flow->ovpn_session_id[3],
 		 flow->ovpn_session_id[4], flow->ovpn_session_id[5], flow->ovpn_session_id[6], flow->ovpn_session_id[7]);
       }
-    } else if (flow->ovpn_counter == 1 && (opcode == P_CONTROL_HARD_RESET_SERVER_V1 ||
-					   opcode == P_CONTROL_HARD_RESET_SERVER_V2)) {
+    } else if (flow->ovpn_counter >= 1 && flow->ovpn_counter <= P_HARD_RESET_CLIENT_MAX_COUNT &&
+            (opcode == P_CONTROL_HARD_RESET_SERVER_V1 || opcode == P_CONTROL_HARD_RESET_SERVER_V2)) {
 
       hmac_size = check_pkid_and_detect_hmac_size(ovpn_payload);
 
@@ -87,16 +89,22 @@ void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct,
 
         if (memcmp(flow->ovpn_session_id, session_remote, 8) == 0)
           ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENVPN, NDPI_PROTOCOL_UNKNOWN);
-        else
+        else {
           NDPI_LOG(NDPI_PROTOCOL_OPENVPN, ndpi_struct, NDPI_LOG_DEBUG,
 		   "key mismatch: %02x%02x%02x%02x%02x%02x%02x%02x\n",
 		   session_remote[0], session_remote[1], session_remote[2], session_remote[3],
 		   session_remote[4], session_remote[5], session_remote[6], session_remote[7]);
-      }
-    } else if (flow->ovpn_counter >= 2)
-      NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OPENVPN);
+          failed = 1;
+        }
+      } else
+        failed = 1;
+    } else
+      failed = 1;
 
     flow->ovpn_counter++;
+
+    if (failed)
+      NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OPENVPN);
   }
 }
 

diff --git a/tests/pcap/openvpn.pcap b/tests/pcap/openvpn.pcap
diff --git a/tests/result/openvpn.pcap.out b/tests/result/openvpn.pcap.out
@@ -1,4 +1,5 @@
-OpenVPN	178	28939	2
+OpenVPN	298	57111	3
 
 	1	UDP 192.168.43.12:41507 <-> 139.59.151.137:13680 [proto: 159/OpenVPN][83 pkts/13559 bytes]
-	2	TCP 192.168.1.77:60140 <-> 46.101.231.218:443 [proto: 159/OpenVPN][95 pkts/15380 bytes]
+	2	UDP 192.168.43.18:13680 <-> 139.59.151.137:13680 [proto: 159/OpenVPN][120 pkts/28172 bytes]
+	3	TCP 192.168.1.77:60140 <-> 46.101.231.218:443 [proto: 159/OpenVPN][95 pkts/15380 bytes]