Stefan Meinecke
7cc9dc90be
probes: fix msrdp length truncation, teamspeak match, unaligned reads
...
- is_msrdp_protocol() stored the 16-bit TPKT length in a char, so a
packet claiming length 263 (0x0107) but carrying only 7 bytes
compared 7 == 7 and matched - any sufficiently short packet whose
declared length low byte equals its size is accepted as RDP.
Keep the declared length in a uint16_t. Verified with a harness:
{0x03 0x00 0x01 0x07 ...} no longer matches.
- is_teamspeak_protocol() used strncmp(p, "TS3INIT1", len): for the
first datagram of a real TS3 client (len > 8) this compares the
string literal's terminating NUL against packet byte 8, which is a
version field, so it could never match real traffic (and reads
past the literal for len > 9). Use a fixed 8-byte memcmp prefix.
- is_openvpn_protocol() and is_wireguard_protocol() dereferenced the
packet buffer through uint16_t*/uint32_t* casts; the buffer is not
aligned, which is UB and traps on strict-alignment targets (ARM).
Use memcpy() instead, as already done elsewhere in this file.
2026-10-18 11:44:36 +02:00
Yves Rutschle
dc70cc0d3b
verbose_packet now dumps UDP packets as well ( fix #527 )
2026-03-15 22:12:00 +01:00
Yves Rutschle
6f3dcfb365
Merge branch 'proxyprotocol'
2025-09-10 15:31:43 +02:00
Yves Rűtschlé
dcb2cc928a
import main branch for endpoint tracking
2025-08-29 20:44:15 +02:00
yrutschle
829a7299e1
remove obsolete debug statement
2025-08-26 22:18:21 +02:00
Yves Rűtschlé
0baf23df95
fix probing on partial reception
2025-08-17 10:31:18 +02:00
Adrian Bunk
cd9b85fd4f
Add a missing change in the second part of the CVE-2025-46806 fix
2025-06-19 22:34:30 +02:00
Yves Rutschle
bd9ed060e4
fix memory leak in regex probe ( fix #500 )
2025-06-19 22:31:02 +02:00
Yves Rutschle
071e7500a2
new test framework, with test classes for robustness and probe tests. Not all tests are ported yet.
2025-06-15 16:02:02 +02:00
Yves Rutschle
204305a88f
fix unaligned read in OpenVPN UDP probe
2025-05-25 11:27:26 +02:00
Yves Rutschle
ad1f5d68e9
fix potential parsing of undefined data is syslog probe and make probe more robust
2025-05-09 17:08:30 +02:00
Yves Rutschle
8298daf686
change magic numbers for constants
2025-05-06 22:12:29 +02:00
Yves Rutschle
9522799421
preliminary receive proxyprotocol support
2025-04-15 22:16:03 +02:00
Sergey Ponomarev
d0a016221c
probe.c: Fix Function 'memcmp' is called without explicitly comparing result
2024-04-13 20:25:18 +02:00
Yves Rutschle
1fb888bbf2
remove magic numbers with correct sizeof
2023-08-31 15:18:22 +02:00
Yves Rutschle
1f0cab2aee
Merge pull request #342 from utoni/fix/ovpn-probe-read-overflow
...
fix possible buffer overflow
2023-08-31 15:15:50 +02:00
Yves Rűtschlé
5cba44f5fa
Add built-in MSRDP support
2022-09-11 21:51:06 +02:00
Toni Uhlig
b19f8a6046
fix possible format string exploit if packet dumping enabled
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com >
2022-09-10 12:53:57 +02:00
Toni Uhlig
b971f3edcd
add wireguard probe
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com >
2022-08-26 12:27:44 +02:00
Toni Uhlig
c7ddee0409
fix possible buffer overflow
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com >
2022-08-19 20:17:59 +02:00
Yves Rutschle
fb8fe57bd8
Merge pull request #341 from utoni/add/teamspeak-probe
...
add teamspeak3 (voice only) probe
2022-08-19 18:03:12 +02:00
Toni Uhlig
4cf3749e73
add teamspeak3 (voice only) probe
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com >
2022-08-14 10:42:58 +02:00
Toni Uhlig
aa17061e26
add openvpn udp probe
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com >
2022-08-11 17:22:44 +02:00
Yves Rűtschlé
8b604a3db7
defensive programming against inconsistent configuration ( fix #336 more)
2022-07-24 17:50:13 +02:00
yrutschle
f6fe735171
sort target protocols as TCP or UDP, so only appropriate probes are called by the listeners
2022-05-05 17:45:40 +02:00
yrutschle
caa62875c1
remove --verbose option
2021-09-27 13:28:21 +02:00
yrutschle
6ea7d48f86
migrate tls.c and probe.c to new log system
2021-09-26 16:55:31 +02:00
yrutschle
e5f16b93ce
hexdump writes to parametrable msg_info
2021-09-19 21:54:47 +02:00
yrutschle
a43385b8db
remove hardcoded quick50 and teamspeak. to be replaced with a generalised regex setup to come in next version
2021-08-13 18:03:59 +02:00
yrutschle
63f9c4a582
added syslog probe ( fixes #34 )
2021-08-04 15:29:05 +02:00
yrutschle
4584e719e1
added hardcoded probe for Teamspeak3
2021-08-01 22:01:59 +02:00
yrutschle
75e426c80f
added hardcoded probe for QUICK50
2021-08-01 21:35:24 +02:00
yrutschle
ce23f202b7
use pcre2 api directly
2021-07-31 23:12:55 +02:00
yrutschle
37d2756703
move to PCRE for conf file
2021-07-23 22:36:20 +02:00
yrutschle
9ff9723278
precised size types to ssize_t instead of int
2021-02-08 22:50:53 +01:00
yrutschle
1e33455fe7
don't try to probe a connection that's finished (should fix #284 )
2020-12-02 22:49:19 +01:00
yrutschle
09597bfa42
refactor: make probe_buffer hexdump input
2020-11-29 10:42:58 +01:00
yrutschle
fccaa5fa9f
refactor: separate probe reading from socket from probe on buffer, so we can call probe on buffer independantly
2020-11-11 22:05:45 +01:00
yrutschle
e67d6ff905
removed obsolete support for . Use instead
2020-07-30 09:45:50 +02:00
yrutschle
588883eb42
Fix on-timeout setting so it is no longer ignored (issue #253 )
2019-12-27 18:26:16 +01:00
yrutschle
a7b4462c6e
Added 'minlength' option
2019-02-03 14:45:14 +01:00
yrutschle
ad0adfb0e1
re-integrate command line support
2018-12-07 08:32:36 +01:00
yrutschle
33ab9d535d
code cleanup and adaptation of regex probe
2018-12-04 23:11:04 +01:00
yrutschle
e7ce929020
config file now read to struct with c2s; command line no longer works
2018-11-29 11:56:33 +01:00
yrutschle
80ad31aec0
refactoring: replace magic constants with symbols
2018-11-04 22:25:16 +01:00
yrutschle
aa77922ffd
turn ssl setting from command line to tls (ssl no longer exists)
2018-09-30 21:34:22 +02:00
yrutschle
f480eb6c7d
refactoring: simpler TLS extension parsing algorithm
2018-09-28 13:58:33 +02:00
yrutschle
6d6ea50066
Merge branch 'master' of https://github.com/yrutschle/sslh
2018-09-23 21:57:16 +02:00
yrutschle
0003680137
remove old tls and ssl targets, only use alpn/sni probe also for TLS with no extensions
2018-09-23 12:07:06 +02:00
Oleg Oshmyan
e8f0d3ea53
Fix HTTP method probing
2018-09-22 15:50:40 +03:00
Stefan Meinecke
Yves Rutschle
Adrian Bunk
Sergey Ponomarev
Yves Rutschle
Toni Uhlig
Oleg Oshmyan