Initial import from SVN

1 files changed, 474 insertions, 0 deletions

diff --git a/src/lib/protocols/directconnect.c b/src/lib/protocols/directconnect.c
new file mode 100644
index 000000000..624f57e58
--- /dev/null
+++ b/src/lib/protocols/directconnect.c
@@ -0,0 +1,474 @@
+/*
+ * directconnect.c
+ *
+ * Copyright (C) 2009-2011 by ipoque GmbH
+ * Copyright (C) 2011-15 - ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocols.h"
+#ifdef NDPI_PROTOCOL_DIRECTCONNECT
+
+//#define NDPI_DEBUG_DIRECTCONNECT
+//#define NDPI_DIRECTCONNECT_PORT_DEBUG
+//#define NDPI_DEBUG_DIRECTCONNECT_CONN
+
+
+#define DIRECT_CONNECT_TYPE_HUB  0
+#define DIRECT_CONNECT_TYPE_PEER 1
+#define DIRECT_CONNECT_ADC_PEER  2
+
+static u_int32_t skip_unknown_headers(const u_int8_t * payload, u_int32_t payload_len, u_int32_t pos)
+{
+  u_int32_t i = pos;
+  while (i < payload_len && payload[i] != 0x0a)
+    i++;
+
+  i++;
+  return i;
+
+}
+
+static u_int16_t parse_binf_message(struct ndpi_detection_module_struct
+				    *ndpi_struct, const u_int8_t * payload, int payload_len)
+{
+  u_int32_t i = 4;
+  u_int16_t bytes_read = 0;
+  u_int16_t ssl_port = 0;
+  while (i < payload_len) {
+    i = skip_unknown_headers(payload, payload_len, i);
+    if ((i + 30) < payload_len) {
+      if (memcmp(&payload[i], "DCTM", 4) == 0) {
+	if (memcmp(&payload[i + 15], "ADCS", 4) == 0) {
+	  ssl_port = ntohs_ndpi_bytestream_to_number(&payload[i + 25], 5, &bytes_read);
+	  NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		   NDPI_LOG_DEBUG, "directconnect ssl port parsed %d", ssl_port);
+
+	}
+      }
+    } else {
+      break;
+    }
+
+  }
+  return ssl_port;
+}
+
+static void ndpi_int_directconnect_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
+						  struct ndpi_flow_struct *flow,
+						  const u_int8_t connection_type)
+{
+
+  struct ndpi_packet_struct *packet = &flow->packet;
+	
+  struct ndpi_id_struct *src = flow->src;
+  struct ndpi_id_struct *dst = flow->dst;
+
+  ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_REAL_PROTOCOL);
+
+  if (src != NULL) {
+    src->directconnect_last_safe_access_time = packet->tick_timestamp;
+    if (connection_type == DIRECT_CONNECT_TYPE_PEER) {
+      if (packet->tcp != NULL
+	  && flow->setup_packet_direction != packet->packet_direction && src->detected_directconnect_port == 0) {
+	src->detected_directconnect_port = packet->tcp->source;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "directconnect tcp PORT %u for src\n", ntohs(src->detected_directconnect_port));
+      }
+      if (packet->udp != NULL && src->detected_directconnect_udp_port == 0) {
+	src->detected_directconnect_udp_port = packet->udp->source;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "directconnect udp PORT %u for src\n", ntohs(src->detected_directconnect_port));
+
+      }
+    }
+
+  }
+  if (dst != NULL) {
+    dst->directconnect_last_safe_access_time = packet->tick_timestamp;
+    if (connection_type == DIRECT_CONNECT_TYPE_PEER) {
+      if (packet->tcp != NULL
+	  && flow->setup_packet_direction == packet->packet_direction && dst->detected_directconnect_port == 0) {
+	/* DST PORT MARKING CAN LEAD TO PORT MISSDETECTIONS
+	 * seen at large customer http servers, where someone has send faked DC tcp packets
+	 * to the server
+	 */
+
+	/*
+	  dst->detected_directconnect_port = packet->tcp->dest;
+	  NDPI_LOG (NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+	  NDPI_LOG_DEBUG, "directconnect tcp PORT %u for dst\n",
+	  ntohs (dst->detected_directconnect_port));
+	*/
+      }
+    }
+  }
+}
+
+static void ndpi_search_directconnect_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+	
+  struct ndpi_id_struct *src = flow->src;
+  struct ndpi_id_struct *dst = flow->dst;
+
+  if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_DIRECTCONNECT) {
+    if (packet->payload_packet_len >= 40 && memcmp(&packet->payload[0], "BINF", 4) == 0) {
+      u_int16_t ssl_port = 0;
+      ssl_port = parse_binf_message(ndpi_struct, &packet->payload[4], packet->payload_packet_len - 4);
+      if (dst != NULL && ssl_port) {
+	dst->detected_directconnect_ssl_port = ssl_port;
+      }
+      if (src != NULL && ssl_port) {
+	src->detected_directconnect_ssl_port = ssl_port;
+      }
+
+
+    }
+    if ((packet->payload_packet_len >= 38 && packet->payload_packet_len <= 42)
+	&& memcmp(&packet->payload[0], "DCTM", 4) == 0 && memcmp(&packet->payload[15], "ADCS", 4) == 0) {
+      u_int16_t bytes_read = 0;
+      if (dst != NULL) {
+	dst->detected_directconnect_ssl_port =
+	  ntohs_ndpi_bytestream_to_number(&packet->payload[25], 5, &bytes_read);
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "directconnect ssl port parsed %d", ntohs(dst->detected_directconnect_ssl_port));
+      }
+      if (src != NULL) {
+	src->detected_directconnect_ssl_port =
+	  ntohs_ndpi_bytestream_to_number(&packet->payload[25], 5, &bytes_read);
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "directconnect ssl port parsed %d", ntohs(src->detected_directconnect_ssl_port));
+      }
+
+
+    }
+    return;
+
+  }
+  if (src != NULL) {
+    if (src->detected_directconnect_port == packet->tcp->source) {
+      if ((u_int32_t)
+	  (packet->tick_timestamp -
+	   src->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) {
+	ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_REAL_PROTOCOL);
+	src->directconnect_last_safe_access_time = packet->tick_timestamp;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(src->detected_directconnect_port));
+	return;
+      } else {
+	src->detected_directconnect_port = 0;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "resetting src port due to timeout");
+	return;
+      }
+    }
+    if (src->detected_directconnect_ssl_port == packet->tcp->dest) {
+      if ((u_int32_t)
+	  (packet->tick_timestamp -
+	   src->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) {
+	ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_REAL_PROTOCOL);
+	src->directconnect_last_safe_access_time = packet->tick_timestamp;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(src->detected_directconnect_ssl_port));
+	return;
+      } else {
+	src->detected_directconnect_ssl_port = 0;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "resetting src port due to timeout");
+	return;
+      }
+    }
+
+  }
+
+  if (dst != NULL) {
+    if (dst->detected_directconnect_port == packet->tcp->dest) {
+      if ((u_int32_t)
+	  (packet->tick_timestamp -
+	   dst->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) {
+	ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_REAL_PROTOCOL);
+	dst->directconnect_last_safe_access_time = packet->tick_timestamp;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(dst->detected_directconnect_port));
+	return;
+      } else {
+	dst->detected_directconnect_port = 0;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "resetting dst port due to timeout");
+	return;
+      }
+    }
+    if (dst->detected_directconnect_ssl_port == packet->tcp->dest) {
+      if ((u_int32_t)
+	  (packet->tick_timestamp -
+	   dst->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) {
+	ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_REAL_PROTOCOL);
+	dst->directconnect_last_safe_access_time = packet->tick_timestamp;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(dst->detected_directconnect_ssl_port));
+
+	return;
+      } else {
+	dst->detected_directconnect_ssl_port = 0;
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "resetting dst port due to timeout");
+	return;
+      }
+    }
+
+  }
+
+  if (flow->directconnect_stage == 0) {
+
+    if (packet->payload_packet_len > 6) {
+      if (packet->payload[0] == '$'
+	  && packet->payload[packet->payload_packet_len - 1] == '|'
+	  && (memcmp(&packet->payload[1], "Lock ", 5) == 0)) {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "maybe first dc connect to hub  detected\n");
+	flow->directconnect_stage = 1;
+	return;
+      }
+      if (packet->payload_packet_len > 7
+	  && packet->payload[0] == '$'
+	  && packet->payload[packet->payload_packet_len - 1] == '|'
+	  && (memcmp(&packet->payload[1], "MyNick ", 7) == 0)) {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "maybe first dc connect between peers  detected\n");
+	flow->directconnect_stage = 2;
+	return;
+      }
+
+    }
+    if (packet->payload_packet_len >= 11) {
+      /* did not see this pattern in any trace */
+      if (memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0
+	  || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "found directconnect HSUP ADBAS0 E\n");
+	ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB);
+	return;
+	/* did not see this pattern in any trace */
+      } else if (memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 ||
+		 memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "found directconnect CSUP ADBAS0 E\n");
+	ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER);
+	return;
+
+      }
+
+    }
+
+  } else if (flow->directconnect_stage == 1) {
+    if (packet->payload_packet_len >= 11) {
+      /* did not see this pattern in any trace */
+      if (memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0
+	  || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "found directconnect HSUP ADBAS E in second packet\n");
+	ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB);
+
+	return;
+	/* did not see this pattern in any trace */
+      } else if (memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 ||
+		 memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "found directconnect HSUP ADBAS0 E in second packet\n");
+	ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER);
+
+
+	return;
+
+      }
+    }
+    /* get client hello answer or server message */
+    if (packet->payload_packet_len > 6) {
+      if ((packet->payload[0] == '$' || packet->payload[0] == '<')
+	  && packet->payload[packet->payload_packet_len - 1] == '|') {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "second dc detected\n");
+	ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB);
+
+	return;
+      } else {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "second dc not detected\n");
+      }
+
+    }
+  } else if (flow->directconnect_stage == 2) {
+    /* get client hello answer or server message */
+    if (packet->payload_packet_len > 6) {
+      if (packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|') {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "second dc between peers detected\n");
+
+
+	ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER);
+
+	return;
+      } else {
+	NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+		 NDPI_LOG_DEBUG, "second dc between peers not detected\n");
+      }
+    }
+
+  }
+
+
+  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT);
+
+}
+
+static void ndpi_search_directconnect_udp(struct ndpi_detection_module_struct
+					  *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+	
+  struct ndpi_id_struct *src = flow->src;
+  struct ndpi_id_struct *dst = flow->dst;
+  int pos, count = 0;
+
+
+  if (dst != NULL && dst->detected_directconnect_udp_port == packet->udp->dest) {
+    if ((u_int32_t)
+	(packet->tick_timestamp -
+	 dst->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) {
+
+      ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_REAL_PROTOCOL);
+      dst->directconnect_last_safe_access_time = packet->tick_timestamp;
+      NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+	       NDPI_LOG_DEBUG, "marking using dc udp port\n %d", ntohs(dst->detected_directconnect_udp_port));
+      return;
+    } else {
+      dst->detected_directconnect_udp_port = 0;
+      NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+	       NDPI_LOG_DEBUG, "resetting dst udp  port due to timeout");
+      return;
+    }
+  }
+
+  if (packet->payload_packet_len > 58) {
+    if (src != NULL
+	&& NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT)) {
+      if (packet->payload[0] == '$'
+	  && packet->payload[packet->payload_packet_len - 1] == '|'
+	  && memcmp(&packet->payload[1], "SR ", 3) == 0) {
+	pos = packet->payload_packet_len - 2;
+	if (packet->payload[pos] == ')') {
+	  while (pos > 0 && packet->payload[pos] != '(' && count < 21) {
+	    pos--;
+	    count++;
+	  }
+	  if (packet->payload[pos] == '(') {
+	    pos = pos - 44;
+	    if (pos > 2 && memcmp(&packet->payload[pos], "TTH:", 4) == 0) {
+	      NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "dc udp detected\n");
+	      ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER);
+	      return;
+	    }
+	  }
+	}
+	flow->directconnect_stage++;
+
+	if (flow->directconnect_stage < 3) {
+
+
+	  return;
+	}
+
+      }
+
+    }
+    if (dst != NULL
+	&& NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT)) {
+      if (packet->payload[0] == '$'
+	  && packet->payload[packet->payload_packet_len - 1] == '|'
+	  && memcmp(&packet->payload[1], "SR ", 3) == 0) {
+	pos = packet->payload_packet_len - 2;
+	if (packet->payload[pos] == ')') {
+	  while (pos > 0 && packet->payload[pos] != '(' && count < 21) {
+	    pos--;
+	    count++;
+	  }
+	  if (packet->payload[pos] == '(') {
+	    pos = pos - 44;
+	    if (pos > 2 && memcmp(&packet->payload[pos], "TTH:", 4) == 0) {
+	      NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "dc udp detected\n");
+	      ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER);
+	      return;
+	    }
+	  }
+	}
+	flow->directconnect_stage++;
+	if (flow->directconnect_stage < 3)
+	  return;
+
+      }
+    }
+
+  }
+  NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG,
+	   "excluded at stage %d \n", flow->directconnect_stage);
+
+
+
+  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT);
+
+
+}
+
+void ndpi_search_directconnect(struct ndpi_detection_module_struct
+			       *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+  struct ndpi_id_struct *src = flow->src;
+  struct ndpi_id_struct *dst = flow->dst;
+
+
+
+  if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_DIRECTCONNECT) {
+    if (src != NULL && ((u_int32_t)
+			(packet->tick_timestamp -
+			 src->directconnect_last_safe_access_time) <
+			ndpi_struct->directconnect_connection_ip_tick_timeout)) {
+      src->directconnect_last_safe_access_time = packet->tick_timestamp;
+
+    } else if (dst != NULL && ((u_int32_t)
+			       (packet->tick_timestamp -
+				dst->directconnect_last_safe_access_time) <
+			       ndpi_struct->directconnect_connection_ip_tick_timeout)) {
+      dst->directconnect_last_safe_access_time = packet->tick_timestamp;
+    } else {
+      packet->detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN;
+      NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct,
+	       NDPI_LOG_DEBUG, "directconnect: skipping as unknown due to timeout\n");
+    }
+    return;
+  }
+
+  if (packet->tcp != NULL) {
+    ndpi_search_directconnect_tcp(ndpi_struct, flow);
+  } else if (packet->udp != NULL) {
+    ndpi_search_directconnect_udp(ndpi_struct, flow);
+  }
+}
+
+#endif