fix and merge mssql and tds in unique dissector mssql_tds due to latest release + minor fixes

4 files changed, 113 insertions, 96 deletions

diff --git a/src/lib/protocols/mssql.c b/src/lib/protocols/mssql.c
deleted file mode 100644
index 51f44df6d..000000000
--- a/src/lib/protocols/mssql.c
+++ /dev/null
@@ -1,68 +0,0 @@
-/*
- * mssql.c
- *
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-
-#include "ndpi_protocols.h"
-
-#ifdef NDPI_PROTOCOL_MSSQL
-
-static void ndpi_int_mssql_add_connection(struct ndpi_detection_module_struct
-					  *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MSSQL, NDPI_PROTOCOL_UNKNOWN);
-}
-
-void ndpi_search_mssql(struct ndpi_detection_module_struct
-		       *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  struct ndpi_packet_struct *packet = &flow->packet;
-
-  NDPI_LOG(NDPI_PROTOCOL_MSSQL, ndpi_struct, NDPI_LOG_DEBUG, "search mssql.\n");
-
-  if (packet->payload_packet_len > 51 && ntohs(get_u_int32_t(packet->payload, 0)) == 0x1201
-      && ntohs(get_u_int16_t(packet->payload, 2)) == packet->payload_packet_len
-      && ntohl(get_u_int32_t(packet->payload, 4)) == 0x00000100 && memcmp(&packet->payload[41], "sqlexpress", 10) == 0) {
-    NDPI_LOG(NDPI_PROTOCOL_MSSQL, ndpi_struct, NDPI_LOG_DEBUG, "found mssql.\n");
-    ndpi_int_mssql_add_connection(ndpi_struct, flow);
-    return;
-  }
-
-  NDPI_LOG(NDPI_PROTOCOL_MSSQL, ndpi_struct, NDPI_LOG_DEBUG, "exclude mssql.\n");
-  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSSQL);
-}
-
-
-void init_mssql_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
-  ndpi_set_bitmask_protocol_detection("MsSQL", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_MSSQL,
-				      ndpi_search_mssql,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
-				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-				      ADD_TO_DETECTION_BITMASK);
-
-  *id += 1;
-}
-
-#endif
diff --git a/src/lib/protocols/mssql_tds.c b/src/lib/protocols/mssql_tds.c
new file mode 100644
index 000000000..73dfe29a0
--- /dev/null
+++ b/src/lib/protocols/mssql_tds.c
@@ -0,0 +1,82 @@
+/*
+ * mssql.c
+ *
+ * Copyright (C) 2016 - ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocols.h"
+
+#ifdef NDPI_PROTOCOL_MSSQL_TDS
+
+struct tds_packet_header {
+  u_int8_t type;
+  u_int8_t status;
+  u_int16_t length;
+  u_int16_t channel;
+  u_int8_t number;
+  u_int8_t window;
+};
+
+static void ndpi_int_mssql_tds_add_connection(struct ndpi_detection_module_struct
+					  *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MSSQL_TDS, NDPI_PROTOCOL_UNKNOWN);
+}
+
+void ndpi_search_mssql_tds(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+  struct tds_packet_header *h = (struct tds_packet_header*) packet->payload;
+
+  if (packet->payload_packet_len < sizeof(struct tds_packet_header)) {
+    NDPI_LOG(NDPI_PROTOCOL_MSSQL_TDS, ndpi_struct, NDPI_LOG_DEBUG, "exclude mssql_tds\n");
+    NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSSQL_TDS);
+    return;
+  }
+  
+  if((h->type >= 1 && h->type <= 8) || (h->type >= 14 && h->type <= 18)) {
+    if(h->status == 0x00 || h->status == 0x01 || h->status == 0x02 || h->status == 0x04 || h->status == 0x08 || h->status == 0x09 || h->status == 0x10) {
+      if(ntohs(h->length) == packet->payload_packet_len && h->window == 0x00) {
+	NDPI_LOG(NDPI_PROTOCOL_MSSQL_TDS, ndpi_struct, NDPI_LOG_DEBUG, "found mssql_tds\n");
+	ndpi_int_mssql_tds_add_connection(ndpi_struct, flow);
+	return;
+      }
+    }
+  }
+  
+  NDPI_LOG(NDPI_PROTOCOL_MSSQL, ndpi_struct, NDPI_LOG_DEBUG, "exclude mssql_tds\n");
+  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSSQL_TDS);
+}
+
+
+void init_mssql_tds_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("MsSQL_TDS", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_MSSQL_TDS,
+				      ndpi_search_mssql_tds,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}
+
+#endif
diff --git a/src/lib/protocols/mysql.c b/src/lib/protocols/mysql.c
index 3cf191744..e500b2976 100644
--- a/src/lib/protocols/mysql.c
+++ b/src/lib/protocols/mysql.c
@@ -39,27 +39,28 @@ void ndpi_search_mysql_tcp(struct ndpi_detection_module_struct *ndpi_struct, str
 	
   //      struct ndpi_id_struct         *src=ndpi_struct->src;
   //      struct ndpi_id_struct         *dst=ndpi_struct->dst;
-
-  if (packet->payload_packet_len > 38	//min length
-      && get_u_int16_t(packet->payload, 0) == packet->payload_packet_len - 4	//first 3 bytes are length
-      && get_u_int8_t(packet->payload, 2) == 0x00	//3rd byte of packet length
-      && get_u_int8_t(packet->payload, 3) == 0x00	//packet sequence number is 0 for startup packet
-      && get_u_int8_t(packet->payload, 5) > 0x30	//server version > 0
-      && get_u_int8_t(packet->payload, 5) < 0x37	//server version < 7
-      && get_u_int8_t(packet->payload, 6) == 0x2e	//dot
-      ) {
-    u_int32_t a;
-    for (a = 7; a + 31 < packet->payload_packet_len; a++) {
-      if (packet->payload[a] == 0x00) {
-	if (get_u_int8_t(packet->payload, a + 13) == 0x00	//filler byte
-	    && get_u_int64_t(packet->payload, a + 19) == 0x0ULL	//13 more
-	    && get_u_int32_t(packet->payload, a + 27) == 0x0	//filler bytes
-	    && get_u_int8_t(packet->payload, a + 31) == 0x0) {
-	  NDPI_LOG(NDPI_PROTOCOL_MYSQL, ndpi_struct, NDPI_LOG_DEBUG, "MySQL detected.\n");
-	  ndpi_int_mysql_add_connection(ndpi_struct, flow);
-	  return;
+  if(packet->tcp) {
+    if (packet->payload_packet_len > 38	//min length
+	&& get_u_int16_t(packet->payload, 0) == packet->payload_packet_len - 4	//first 3 bytes are length
+	&& get_u_int8_t(packet->payload, 2) == 0x00	//3rd byte of packet length
+	&& get_u_int8_t(packet->payload, 3) == 0x00	//packet sequence number is 0 for startup packet
+	&& get_u_int8_t(packet->payload, 5) > 0x30	//server version > 0
+	&& get_u_int8_t(packet->payload, 5) < 0x37	//server version < 7
+	&& get_u_int8_t(packet->payload, 6) == 0x2e	//dot
+	) {
+      u_int32_t a;
+      for (a = 7; a + 31 < packet->payload_packet_len; a++) {
+	if (packet->payload[a] == 0x00) {
+	  if (get_u_int8_t(packet->payload, a + 13) == 0x00	//filler byte
+	      && get_u_int64_t(packet->payload, a + 19) == 0x0ULL	//13 more
+	      && get_u_int32_t(packet->payload, a + 27) == 0x0	//filler bytes
+	      && get_u_int8_t(packet->payload, a + 31) == 0x0) {
+	    NDPI_LOG(NDPI_PROTOCOL_MYSQL, ndpi_struct, NDPI_LOG_DEBUG, "MySQL detected.\n");
+	    ndpi_int_mysql_add_connection(ndpi_struct, flow);
+	    return;
+	  }
+	  break;
 	}
-	break;
       }
     }
   }
diff --git a/src/lib/protocols/ubntac2.c b/src/lib/protocols/ubntac2.c
index 3015f4211..b465e0a30 100644
--- a/src/lib/protocols/ubntac2.c
+++ b/src/lib/protocols/ubntac2.c
@@ -35,14 +35,16 @@ void ndpi_search_ubntac2(struct ndpi_detection_module_struct *ndpi_struct, struc
 
   NDPI_LOG(NDPI_PROTOCOL_UBNTAC2, ndpi_struct, NDPI_LOG_TRACE, "UBNTAC2 detection... plen:%i %i:%i\n", packet->payload_packet_len, ntohs(packet->udp->source), ntohs(packet->udp->dest));
 
-  if (packet->udp != NULL && packet->payload_packet_len >= 135 &&
-      (packet->udp->source == htons(10001) || packet->udp->dest == htons(10001)) &&
-      memcmp(&(packet->payload[36]), "UBNT", 4) == 0) {
-
-    NDPI_LOG(NDPI_PROTOCOL_UBNTAC2, ndpi_struct, NDPI_LOG_DEBUG, "UBNT AirControl 2 request\n");
-
-    ndpi_int_ubntac2_add_connection(ndpi_struct, flow);
-    return;
+  if(packet->udp) {
+    if(packet->payload_packet_len >= 135 &&
+       (packet->udp->source == htons(10001) || packet->udp->dest == htons(10001)) &&
+       memcmp(&(packet->payload[36]), "UBNT", 4) == 0) {
+      
+      NDPI_LOG(NDPI_PROTOCOL_UBNTAC2, ndpi_struct, NDPI_LOG_DEBUG, "UBNT AirControl 2 request\n");
+      
+      ndpi_int_ubntac2_add_connection(ndpi_struct, flow);
+      return;
+    }
   }
 
   NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_UBNTAC2);