Pull request #3844: appid: Added fallback check for encrypted appid before port check...

Merge in SNORT/snort3 from ~OSTEPANO/snort3:ssl_fallback_to_encrypted_appid to master

Squashed commit of the following:

commit 32a0e9b13a63fe5ccf2c9b74ca1e264b846b4f6b
Author: Oleksandr Stepanov <ostepano@cisco.com>
Date:   Wed May 10 08:59:16 2023 -0400

    appid: Added logic to check for encrypted appid before assigning SSL service based on port

diff --git a/src/network_inspectors/appid/detector_plugins/detector_smtp.cc b/src/network_inspectors/appid/detector_plugins/detector_smtp.cc
index 0439e6971ac86368f5fd072ec399ea27e9be740f..45e7f6b4907b2083d851a04a21f6a0bd8e3ed3db 100644 (file)
--- a/src/network_inspectors/appid/detector_plugins/detector_smtp.cc
+++ b/src/network_inspectors/appid/detector_plugins/detector_smtp.cc
@@ -797,11 +797,7 @@ int SmtpServiceDetector::validate(AppIdDiscoveryArgs& args)
         {
             if (!(dd->client.flags & CLIENT_FLAG_STARTTLS_SUCCESS))
                 goto fail;
-            else if (args.asd.get_session_flags(APPID_SESSION_CLIENT_DETECTED))
-            {
-                args.asd.clear_session_flags(APPID_SESSION_CONTINUE);
-                return APPID_SUCCESS;
-            }
+            
             goto inprocess;
         }
         if (!fd->code)

diff --git a/src/network_inspectors/appid/service_plugins/service_ssl.cc b/src/network_inspectors/appid/service_plugins/service_ssl.cc
index f5aa165d1c38c916a4107064b7980949b2f7de73..e8e05877963eb9998a7d12307246012a2f14c3af 100644 (file)
--- a/src/network_inspectors/appid/service_plugins/service_ssl.cc
+++ b/src/network_inspectors/appid/service_plugins/service_ssl.cc
@@ -692,7 +692,6 @@ AppId getSslServiceAppId(short srcPort)
         return APP_ID_HTTPS;
     case 448:
         return APP_ID_DDM_SSL;
-    case 25:
     case 465:
         return APP_ID_SMTPS;
     case 563:

diff --git a/src/network_inspectors/appid/tp_appid_utils.cc b/src/network_inspectors/appid/tp_appid_utils.cc
index a2719e557359baf4286f9730f7963c095f46e608..3f24dcc84d9f32ecb98a97a07c353efdce9ca2b4 100644 (file)
--- a/src/network_inspectors/appid/tp_appid_utils.cc
+++ b/src/network_inspectors/appid/tp_appid_utils.cc
@@ -691,7 +691,14 @@ bool do_tp_discovery(ThirdPartyAppIdContext& tp_appid_ctxt, AppIdSession& asd, I
             portAppId = getSslServiceAppId(serverPort);
             if (tp_app_id == APP_ID_SSL)
             {
-                tp_app_id = portAppId;
+                if (asd.encrypted.service_id > 0)
+                {
+                    tp_app_id = asd.encrypted.service_id;
+                }
+                else
+                {
+                    tp_app_id = portAppId;
+                }
                 //SSL policy determines IMAPS/POP3S etc before appId sees first server
                 // packet
                 asd.set_port_service_id(portAppId);