Added AMQP (Advanced Message Queueing Protocol)

7 files changed, 100 insertions, 6 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 5afa63c92..dfb39af8d 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -1,7 +1,7 @@
 /*
  * ndpi_protocol_ids.h
  *
- * Copyright (C) 2016 - ntop.org
+ * Copyright (C) 2011-17 - ntop.org
  *
  * This file is part of nDPI, an open source deep packet inspection
  * library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -228,10 +228,7 @@
 #define NDPI_PROTOCOL_WHATSAPP_VOICE 	 189
 #define NDPI_PROTOCOL_EAQ 	 190
 #define NDPI_PROTOCOL_OOKLA      191
-
-/* 192 is free */
-#define NDPI_PROTOCOL_FREE_192   192
-
+#define NDPI_PROTOCOL_AMQP       192
 #define NDPI_PROTOCOL_KAKAOTALK 	 193 /* KakaoTalk Chat (no voice call) */
 #define NDPI_PROTOCOL_KAKAOTALK_VOICE 	 194 /* KakaoTalk Voice */
 #define NDPI_PROTOCOL_TWITCH 	 195 /* Edoardo Dominici <edoaramis@gmail.com> */
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index edf4ca3dc..b3b4092b4 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -202,6 +202,7 @@ void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i
 void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_armagetron_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_amqp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_battlefield_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_bgp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 987975c47..3770c9cfc 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -21,6 +21,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
 		     protocols/applejuice.c \
 		     protocols/armagetron.c \
 		     protocols/ayiya.c \
+		     protocols/amqp.c \
 		     protocols/battlefield.c \
 		     protocols/bgp.c \
 		     protocols/bittorrent.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2250928c4..9a2c5d7a5 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1611,9 +1611,13 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    no_master, "Ookla", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),   /* TCP */
 			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0));  /* UDP */
+    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AMQP,
+			    no_master,
+			    no_master, "AMQP", NDPI_PROTOCOL_CATEGORY_RPC,
+			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),   /* TCP */
+			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0));  /* UDP */
 
     /* To be removed as soon as we define new protocols */
-    ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_192);
     ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_197);
     ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_208);
     ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_209);
@@ -2687,6 +2691,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* BITTORRENT */
   init_bittorrent_dissector(ndpi_struct, &a, detection_bitmask);
 
+  /* AMQP */
+  init_amqp_dissector(ndpi_struct, &a, detection_bitmask);
+
   /* ----------------------------------------------------------------- */
 
 
diff --git a/src/lib/protocols/amqp.c b/src/lib/protocols/amqp.c
new file mode 100644
index 000000000..72bbc0a38
--- /dev/null
+++ b/src/lib/protocols/amqp.c
@@ -0,0 +1,83 @@
+/*
+ * amqp.c
+ *
+ * Copyright (C) 2011-17 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocols.h"
+#ifdef NDPI_PROTOCOL_AMQP
+
+PACK_ON
+struct amqp_header {
+	u_int8_t ptype;
+	u_int16_t channel;
+	u_int32_t length;
+	u_int16_t class_id, method;
+} PACK_OFF;
+
+static void ndpi_int_amqp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
+					 struct ndpi_flow_struct *flow/* , */
+					 /* ndpi_protocol_type_t protocol_type */) {
+	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AMQP, NDPI_PROTOCOL_UNKNOWN);
+}
+
+void ndpi_search_amqp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+	struct ndpi_packet_struct *packet = &flow->packet;
+
+	NDPI_LOG(NDPI_PROTOCOL_AMQP, ndpi_struct, NDPI_LOG_DEBUG, "search amqp.  \n");
+
+	if (packet->tcp != NULL) {
+		if(packet->payload_packet_len > sizeof(struct amqp_header)) {
+			struct amqp_header *h = (struct amqp_header*)packet->payload;
+
+			if(h->ptype <= 3) {
+				u_int32_t length = htonl(h->length);
+
+				if(((length+8) >= packet->payload_packet_len)
+				   && (length < 32768) /* Upper bound */) {					
+					u_int16_t class_id = htons(h->class_id);
+				
+					if((class_id >= 10) /* Connection */
+					   && (class_id <= 110) /* Tunnel */) {
+						u_int16_t method = htons(h->method);
+
+						if(method <= 120 /* Method basic NACK */) {
+							NDPI_LOG(NDPI_PROTOCOL_AMQP, ndpi_struct, NDPI_LOG_DEBUG, "found amqp over tcp.  \n");
+							ndpi_int_amqp_add_connection(ndpi_struct, flow);
+							return;
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+
+void init_amqp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+	ndpi_set_bitmask_protocol_detection("AMQP", ndpi_struct, detection_bitmask, *id,
+					    NDPI_PROTOCOL_AMQP,
+					    ndpi_search_amqp,
+					    NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD,
+					    SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+					    ADD_TO_DETECTION_BITMASK);
+
+	*id += 1;
+}
+
+#endif
diff --git a/tests/pcap/amqp.pcap b/tests/pcap/amqp.pcap
new file mode 100644
index 000000000..30633f1ed
--- /dev/null
+++ b/tests/pcap/amqp.pcap
diff --git a/tests/result/amqp.pcap.out b/tests/result/amqp.pcap.out
new file mode 100644
index 000000000..200394193
--- /dev/null
+++ b/tests/result/amqp.pcap.out
@@ -0,0 +1,5 @@
+AMQP	160	23514	3
+
+	1	TCP 127.0.0.1:44205 <-> 127.0.1.1:5672 [proto: 192/AMQP][108 pkts/14423 bytes]
+	2	TCP 127.0.0.1:44204 <-> 127.0.1.1:5672 [proto: 192/AMQP][22 pkts/5026 bytes]
+	3	TCP 127.0.0.1:44206 <-> 127.0.1.1:5672 [proto: 192/AMQP][30 pkts/4065 bytes]