Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS: remove ESNI support #2648

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

TLS: remove ESNI support #2648

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 0 additions & 7 deletions example/ndpiReader.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2176,13 +2176,6 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
if(flow->ssh_tls.tls_issuerDN) fprintf(out, "[Issuer: %s]", flow->ssh_tls.tls_issuerDN);
if(flow->ssh_tls.tls_subjectDN) fprintf(out, "[Subject: %s]", flow->ssh_tls.tls_subjectDN);

if(flow->ssh_tls.encrypted_sni.esni) {
char unknown_cipher[8];
fprintf(out, "[ESNI: %s]", flow->ssh_tls.encrypted_sni.esni);
fprintf(out, "[ESNI Cipher: %s]",
ndpi_cipher2str(flow->ssh_tls.encrypted_sni.cipher_suite, unknown_cipher));
}

if(flow->ssh_tls.encrypted_ch.version != 0) {
fprintf(out, "[ECH: version 0x%x]", flow->ssh_tls.encrypted_ch.version);
}
Expand Down
10 changes: 0 additions & 10 deletions example/reader_util.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -546,11 +546,6 @@ static void ndpi_free_flow_tls_data(struct ndpi_flow_info *flow) {
flow->ssh_tls.tls_subjectDN = NULL;
}

if(flow->ssh_tls.encrypted_sni.esni) {
ndpi_free(flow->ssh_tls.encrypted_sni.esni);
flow->ssh_tls.encrypted_sni.esni = NULL;
}

if(flow->ssh_tls.ja4_client_raw) {
ndpi_free(flow->ssh_tls.ja4_client_raw);
flow->ssh_tls.ja4_client_raw = NULL;
Expand Down Expand Up @@ -1563,11 +1558,6 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
if(flow->ndpi_flow->protos.tls_quic.subjectDN)
flow->ssh_tls.tls_subjectDN = strdup(flow->ndpi_flow->protos.tls_quic.subjectDN);

if(flow->ndpi_flow->protos.tls_quic.encrypted_sni.esni) {
flow->ssh_tls.encrypted_sni.esni = strdup(flow->ndpi_flow->protos.tls_quic.encrypted_sni.esni);
flow->ssh_tls.encrypted_sni.cipher_suite = flow->ndpi_flow->protos.tls_quic.encrypted_sni.cipher_suite;
}

flow->ssh_tls.encrypted_ch.version = flow->ndpi_flow->protos.tls_quic.encrypted_ch.version;

if(flow->ndpi_flow->protos.tls_quic.tls_supported_versions) {
Expand Down
5 changes: 0 additions & 5 deletions example/reader_util.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -295,11 +295,6 @@ typedef struct ndpi_flow_info {
sha1_cert_fingerprint[20];
u_int8_t sha1_cert_fingerprint_set;
struct tls_heuristics browser_heuristics;

struct {
u_int16_t cipher_suite;
char *esni;
} encrypted_sni;

struct {
u_int16_t version;
Expand Down
5 changes: 0 additions & 5 deletions src/include/ndpi_typedefs.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1434,11 +1434,6 @@ struct ndpi_flow_struct {

u_int16_t ssl_version, server_names_len;

struct {
u_int16_t cipher_suite;
char *esni;
} encrypted_sni;

struct {
u_int16_t version;
} encrypted_ch;
Expand Down
3 changes: 0 additions & 3 deletions src/lib/ndpi_main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6769,9 +6769,6 @@ void ndpi_free_flow_data(struct ndpi_flow_struct* flow) {
if(flow->protos.tls_quic.subjectDN)
ndpi_free(flow->protos.tls_quic.subjectDN);

if(flow->protos.tls_quic.encrypted_sni.esni)
ndpi_free(flow->protos.tls_quic.encrypted_sni.esni);

if(flow->protos.tls_quic.ja4_client_raw)
ndpi_free(flow->protos.tls_quic.ja4_client_raw);
}
Expand Down
67 changes: 3 additions & 64 deletions src/lib/protocols/tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3108,62 +3108,9 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
if(flow->protos.tls_quic.tls_supported_versions == NULL)
flow->protos.tls_quic.tls_supported_versions = ndpi_strdup(version_str);
}
} else if(extension_id == 65486 /* encrypted server name */ &&
offset+extension_offset+1 < total_len) {
/*
- https://tools.ietf.org/html/draft-ietf-tls-esni-06
- https://blog.cloudflare.com/encrypted-sni/
*/
int e_offset = offset+extension_offset;
int e_sni_len;
int initial_offset = e_offset;
u_int16_t cipher_suite = ntohs(*((u_int16_t*)&packet->payload[e_offset]));

flow->protos.tls_quic.encrypted_sni.cipher_suite = cipher_suite;

e_offset += 2; /* Cipher suite len */

/* Key Share Entry */
e_offset += 2; /* Group */
if(e_offset + 2 < packet->payload_packet_len) {
e_offset += ntohs(*((u_int16_t*)&packet->payload[e_offset])) + 2; /* Lenght */

if((e_offset+4) < packet->payload_packet_len) {
/* Record Digest */
e_offset += ntohs(*((u_int16_t*)&packet->payload[e_offset])) + 2; /* Lenght */

if((e_offset+4) < packet->payload_packet_len) {
e_sni_len = ntohs(*((u_int16_t*)&packet->payload[e_offset]));
e_offset += 2;

if((e_offset+e_sni_len-(int)extension_len-initial_offset) >= 0 &&
e_offset+e_sni_len < packet->payload_packet_len) {
#ifdef DEBUG_ENCRYPTED_SNI
printf("Client TLS [Encrypted Server Name len: %u]\n", e_sni_len);
#endif

if(flow->protos.tls_quic.encrypted_sni.esni == NULL) {
flow->protos.tls_quic.encrypted_sni.esni = (char*)ndpi_malloc(e_sni_len*2+1);

if(flow->protos.tls_quic.encrypted_sni.esni) {
u_int16_t off;
int i;

for(i=e_offset, off=0; i<(e_offset+e_sni_len); i++) {
int rc = sprintf(&flow->protos.tls_quic.encrypted_sni.esni[off], "%02X", packet->payload[i] & 0XFF);

if(rc <= 0) {
break;
} else
off += rc;
}
flow->protos.tls_quic.encrypted_sni.esni[off] = '\0';
}
}
}
}
}
}
} else if(extension_id == 65486 /* encrypted server name */) {
/* ESNI has been superseded by ECH */
ndpi_set_risk(flow, NDPI_TLS_SUSPICIOUS_ESNI_USAGE, NULL);
} else if(extension_id == 65037 /* ECH: latest drafts */) {
#ifdef DEBUG_TLS
printf("Client TLS: ECH version 0x%x\n", extension_id);
Expand Down Expand Up @@ -3332,18 +3279,10 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
ndpi_set_risk(flow, NDPI_TLS_NOT_CARRYING_HTTPS, "No ALPN");
}

/* Suspicious Domain Fronting:
https://github.com/SixGenInc/Noctilucent/blob/master/docs/ */
if(flow->protos.tls_quic.encrypted_sni.esni &&
flow->host_server_name[0] != '\0') {
ndpi_set_risk(flow, NDPI_TLS_SUSPICIOUS_ESNI_USAGE, "Found ESNI w/o SNI");
}

/* Add check for missing SNI */
if(flow->host_server_name[0] == '\0'
&& (flow->protos.tls_quic.ssl_version >= 0x0302) /* TLSv1.1 */
&& !flow->protos.tls_quic.webrtc
&& (flow->protos.tls_quic.encrypted_sni.esni == NULL) /* No ESNI */
) {
/* This is a bit suspicious */
ndpi_set_risk(flow, NDPI_TLS_MISSING_SNI, "SNI should always be present");
Expand Down
6 changes: 3 additions & 3 deletions tests/cfgs/default/result/encrypted_sni.pcap.out
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,6 @@ JA3 Host Stats:
1 192.168.1.12 1


1 TCP 192.168.1.12:49886 -> 104.27.129.77:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/770 bytes -> 0 pkts/0 bytes][Goodput ratio: 93/0][< 1 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2;TLSv1.1;TLSv1][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TLSv1.2][JA3C: 957015a0b1e2500d8777219893a09495][JA4: t13d1813h2_29a2cd9e9f10_0d6ff543c596][ESNI: 9624CB3C4E230827F78CF5BF640D22DEA33FCC598EA6A32D939905586FBE997B9E68661F8956D4893072E19DE24CD1FB88A9F71FC4CC01BAB5C914FDF96A647D671B5E89859BAEEAB122218688496DF4DF0C328C3D5F940B109CEB2A2743D5CBE3594288A229B8C7E2F88303E3FE1A26A89E5001F2BD936890FEF78F06E05ECC063A68BDB8C18DFAC114CF1FECDB8BE1FC2FEECB2315D27998D682B129FD1E3EB5D7985DCBDC452A1082CCC038E0BF69570FEFAC6BC6FB951F89B6792CADA76403C02CEB5DCE1CE6EDDD16D5F7FB6B85D2B92485448DE0088E421E83F1E28B267FBE3B59AE0496FB845213C271D4C5AC5E9E7E5F6A3072445307FCCEB7306710459991C40CC4DC1FC325154C7974DD780371397805456A19AE23EE88475C1DF07697B666][ESNI Cipher: TLS_AES_128_GCM_SHA256][Firefox][PLAIN TEXT (http/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 192.168.1.12:49887 -> 104.16.125.175:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/770 bytes -> 0 pkts/0 bytes][Goodput ratio: 93/0][< 1 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2;TLSv1.1;TLSv1][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TLSv1.2][JA3C: 957015a0b1e2500d8777219893a09495][JA4: t13d1813h2_29a2cd9e9f10_0d6ff543c596][ESNI: B900004E39E84B98F5AE87B0A020EC49FED86F2B488B6AB28BDE9F957621F2774366DE90E65C4CA808668911624685EC4C6DC6C161A97CBE82281BC08427697AA3BE6A40E5F00ACF8B63E329317B0E4E85642D50AB8790E6197DA62D9F5B3239DCC59437797FE768A520C9D471FEABA1375DF61E4A39B09363CB109E7B24A793844896DDD16B6EE7DBE576D767161D782D7BF6FEC453A05A923D8D8E9BEFFC97E8E56C4F1AAB70FE99BC97819E1D908A5F3B3094F4BF25EB7A24A94FDBC3E107A423B8BB341F22900F7BBD87780E30B6ECF393FEB8FBFFEB54C79FA0673FE1AAD17B221D4BFF6450AA0CD4AF513066B66080B602147F3ACB7145A436C5689DA20BACB8BF9BABD851012556EC8F7BB9D74BFAAF25DCF4362A5775607C3CE5C2C29F183969][ESNI Cipher: TLS_AES_128_GCM_SHA256][Firefox][PLAIN TEXT (http/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3 TCP 192.168.1.12:49897 -> 104.22.71.197:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/770 bytes -> 0 pkts/0 bytes][Goodput ratio: 93/0][< 1 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2;TLSv1.1;TLSv1][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][TLSv1.2][JA3C: 957015a0b1e2500d8777219893a09495][JA4: t13d1813h2_29a2cd9e9f10_0d6ff543c596][ESNI: CD69AC727FFAA0EA70A12AA46E71537EB99234B996818C913C72A0AC1184BFA5DD3B617E013E4CA092B2E9CFB78BCD8D33CBAF12A974DFB78E49B8BF9A57997418EF14C87830961E3C8480D2A4BF27D61D911CEF4300924A9F36105748BAED845FF585E40406545BB35C6DAAD7896433EC4DFD6B6F49728DA85D707DB7AC784F55A6658DC6ADE3087B1E46BBBEDFA44F3E8754B31A6BCF8519D291D3629805FA826E43799EA6E33021CF0A83CA05717B00F37D69841934F5B5BF254C6467888A592C38A3007DB3B7D5CBB8DB742B657F8F973C050BAA817AA571393CD8A4BC0B2312460A77DD0510F4BBCE43D53BCF334E4E8C7570255BBD17714403F4B6925434CD67F96FA9E05D700776810EEB5786B1C8188A4D73F8208B614B93284A8093929594BE][ESNI Cipher: TLS_AES_128_GCM_SHA256][Firefox][PLAIN TEXT (http/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
1 TCP 192.168.1.12:49886 -> 104.27.129.77:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/770 bytes -> 0 pkts/0 bytes][Goodput ratio: 93/0][< 1 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2;TLSv1.1;TLSv1][Risk: ** TLS Susp ESNI Usage **** Missing SNI TLS Extn **** Unidirectional Traffic **** ALPN/SNI Mismatch **][Risk Score: 160][Risk Info: No server to client traffic / SNI should always be present / h2][TLSv1.2][JA3C: 957015a0b1e2500d8777219893a09495][JA4: t13d1813h2_29a2cd9e9f10_0d6ff543c596][Firefox][PLAIN TEXT (http/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 192.168.1.12:49887 -> 104.16.125.175:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/770 bytes -> 0 pkts/0 bytes][Goodput ratio: 93/0][< 1 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2;TLSv1.1;TLSv1][Risk: ** TLS Susp ESNI Usage **** Missing SNI TLS Extn **** Unidirectional Traffic **** ALPN/SNI Mismatch **][Risk Score: 160][Risk Info: No server to client traffic / SNI should always be present / h2][TLSv1.2][JA3C: 957015a0b1e2500d8777219893a09495][JA4: t13d1813h2_29a2cd9e9f10_0d6ff543c596][Firefox][PLAIN TEXT (http/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3 TCP 192.168.1.12:49897 -> 104.22.71.197:443 [proto: 91/TLS][IP: 220/Cloudflare][Encrypted][Confidence: DPI][FPC: 91/TLS, Confidence: DPI][DPI packets: 1][cat: Web/5][1 pkts/770 bytes -> 0 pkts/0 bytes][Goodput ratio: 93/0][< 1 sec][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.2;TLSv1.1;TLSv1][Risk: ** TLS Susp ESNI Usage **** Missing SNI TLS Extn **** Unidirectional Traffic **** ALPN/SNI Mismatch **][Risk Score: 160][Risk Info: No server to client traffic / SNI should always be present / h2][TLSv1.2][JA3C: 957015a0b1e2500d8777219893a09495][JA4: t13d1813h2_29a2cd9e9f10_0d6ff543c596][Firefox][PLAIN TEXT (http/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
Loading
Loading