Merge remote-tracking branch 'upstream/dev' into dev

4 files changed, 121 insertions, 176 deletions

diff --git a/src/lib/protocols/coap.c b/src/lib/protocols/coap.c
index 8089c8159..cddf31b7e 100644
--- a/src/lib/protocols/coap.c
+++ b/src/lib/protocols/coap.c
@@ -25,78 +25,117 @@
 #include "ndpi_protocols.h"
 #ifdef NDPI_PROTOCOL_COAP
 
+#define CON     0
+#define NO_CON  1
+#define ACK     2
+#define RST     3
+
+struct ndpi_coap_hdr
+{
+#if defined(__BIG_ENDIAN__)
+  u_int8_t version:2, type:2, tkl:4;
+#elif defined(__LITTLE_ENDIAN__)
+  u_int8_t tkl:4, type:2, version:2;
+#endif
+  u_int8_t code;
+  u_int16_t message_id; //if needed, remember to convert in host number
+};
+
+
+/**
+   VALUE OF -CODE- FIELD
+
+   [0]   = "Empty",
+   [1]   = "GET",
+   [2]   = "POST",
+   [3]   = "PUT",
+   [4]   = "DELETE",
+   [65]  = "2.01 Created",
+   [66]  = "2.02 Deleted",
+   [67]  = "2.03 Valid",
+   [68]  = "2.04 Changed",
+   [69]  = "2.05 Content",
+   [128] = "4.00 Bad Request",
+   [129] = "4.01 Unauthorized",
+   [130] = "4.02 Bad Option",
+   [131] = "4.03 Forbidden",
+   [132] = "4.04 Not Found",
+   [133] = "4.05 Method Not Allowed",
+   [134] = "4.06 Not Acceptable",
+   [140] = "4.12 Precondition Failed",
+   [141] = "4.13 Request Entity Too Large",
+   [143] = "4.15 Unsupported Content-Format",
+   [160] = "5.00 Internal Server Error",
+   [161] = "5.01 Not Implemented",
+   [162] = "5.02 Bad Gateway",
+   [163] = "5.03 Service Unavailable",
+   [164] = "5.04 Gateway Timeout",
+   [165] = "5.05 Proxying Not Supported"
+**/
+  
+
 /**
  * Entry point when protocol is identified.
  */
 static void ndpi_int_coap_add_connection (struct ndpi_detection_module_struct *ndpi_struct,
-			      struct ndpi_flow_struct *flow)
+					  struct ndpi_flow_struct *flow)
 {
-  // not sure if this is accurate but coap runs on top of udp and should be connectionless
   ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_COAP,NDPI_PROTOCOL_UNKNOWN);
-  NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "CoAP found.\n");
 }
+
 /**
  * Dissector function that searches CoAP headers
  */
 void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct,
 		       struct ndpi_flow_struct *flow)
 {
-	struct ndpi_packet_struct *packet = &flow->packet;
-	if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
-		return;
-	}
-	NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "CoAP detection...\n");
-	// searching for request
-	NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> COAP header: %04x%04x%04x%04x [len: %u]\n",
-			packet->payload[0], packet->payload[1], packet->payload[2], packet->payload[3], packet->payload_packet_len);
-	// check if we have version bits
-	if (packet->payload_packet_len < 4) {
-		NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap .. mandatory header not found!\n");
-		NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
-		return;
-	}
-	// since this is always unsigned we could have spared the 0xF0 logical AND
-	// vt = version and type (version is mandatory 1; type is either 0,1,2,3 )
-	u_int8_t vt = (u_int8_t) ((packet->payload[0] & 0xF0) >> 4);
-	if ((vt == 4) || (vt == 5) || (vt == 6) || (vt == 7)) {
-		NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Continuing Coap detection \n");
-		// search for values 9 to 15 in the token length
-		u_int8_t tkl = (u_int8_t) ((packet->payload[0] & 0x0F));
-		if ((tkl >= 9) && (tkl <= 15)) {
-			NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap .. invalid token length found!\n");
-			NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
-			return;
-		}
-		u_int8_t class = (u_int8_t) ((packet->payload[1] & 0xE0) >> 5);
-		u_int8_t detail = (u_int8_t) ((packet->payload[1] & 0x1F));
-		if ((class == 0) && (detail == 0) && (tkl == 0) && (packet->payload_packet_len == 4)) {
-			NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found ... empty message\n");
-			ndpi_int_coap_add_connection(ndpi_struct,flow);
-			return;
-		}
-		if ((class == 0) && ((detail == 1) || (detail == 2 ) || (detail == 3 ) || (detail == 4 ))) {
-			// we should probably search for options as well and payload for deeper inspection
-			NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found ... req message\n");
-			ndpi_int_coap_add_connection(ndpi_struct,flow);
-			return;
-		}
-		if ((class == 2) || (class == 4) || (class == 5)) {
-			// we should probably search for options as well and payload for deeper inspection
-			NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found ... resp message\n");
-			ndpi_int_coap_add_connection(ndpi_struct,flow);
-			return;
-		}
+  struct ndpi_packet_struct *packet = &flow->packet;
+  struct ndpi_coap_hdr * h = (struct ndpi_coap_hdr*) packet->payload;
+	
+  if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
+    return;
+  }
+
+  // search for udp packet
+  if(packet->udp != NULL) {
+    
+    // header too short
+    if(packet->payload_packet_len < 4) {
+      
+      NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "excluding Coap\n");
+      NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
+      return;
+    }
+    
+    NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "calculating coap over udp.\n");
+
+    // check values in header
+    if(h->version == 1) {
+      if(h->type == CON || h->type == NO_CON || h->type == ACK || h->type == RST ) {
+	if(h->tkl == 0 || h->tkl < 8) {
+	  if((h->code >= 0 && h->code <= 5) || (h->code >= 65 && h->code <= 69) ||
+	     (h->code >= 128  && h->code <= 134) || (h->code >= 140 && h->code <= 143) ||
+	     (h->code >= 160 && h->code <= 165)) {
+	       
+	    NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found...\n");
+	    ndpi_int_coap_add_connection(ndpi_struct,flow);
+	    return;
+	  }
 	}
-	NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap ...\n");
-	NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
-	return;
+      }
+    } 
+  }
+  
+  NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap ...\n");
+  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
+  return;
 
 }
 /**
  * Entry point for the ndpi library
  */
 void init_coap_dissector (struct ndpi_detection_module_struct *ndpi_struct,
-		     u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+			  u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
 {
   ndpi_set_bitmask_protocol_detection ("COAP", ndpi_struct, detection_bitmask, *id,
 				       NDPI_PROTOCOL_COAP,
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index c975465ea..503761137 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -114,11 +114,17 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
     int off = sizeof(struct ndpi_dns_packet_header) + 1;
     while((flow->packet.payload[off] != '\0'))
     {
-      flow->host_server_name[j] = flow->packet.payload[off];
-      if(flow->host_server_name[j] < ' ')
-	flow->host_server_name[j] = '.';
-      off++;
-      j++;
+      if(off < flow->packet.payload_packet_len)
+      {
+	flow->host_server_name[j] = flow->packet.payload[off];
+	if(j < strlen(flow->host_server_name))
+	{
+	  if(flow->host_server_name[j] < ' ')
+	    flow->host_server_name[j] = '.';
+	  j++;
+	}
+	off++;
+      }
     }
     flow->host_server_name[j] = '\0';
 
diff --git a/src/lib/protocols/dropbox.c b/src/lib/protocols/dropbox.c
index ec546d356..63a1f5531 100644
--- a/src/lib/protocols/dropbox.c
+++ b/src/lib/protocols/dropbox.c
@@ -25,6 +25,10 @@
 #include "ndpi_api.h"
 
 #ifdef NDPI_PROTOCOL_DROPBOX
+
+#define DB_LSP_PORT 17500
+
+
 static void ndpi_int_dropbox_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
 					    struct ndpi_flow_struct *flow,
 					    u_int8_t due_to_correlation)
@@ -40,12 +44,25 @@ static void ndpi_check_dropbox(struct ndpi_detection_module_struct *ndpi_struct,
   u_int32_t payload_len = packet->payload_packet_len;
 
   if(packet->udp != NULL) {
-    u_int16_t dropbox_port = htons(17500);
+
+    u_int16_t dropbox_port = htons(DB_LSP_PORT);
 
     if((packet->udp->source == dropbox_port)
        && (packet->udp->dest == dropbox_port)) {
       if(payload_len > 2) {
-	if(strncmp((const char *)packet->payload, "{\"", 2) == 0) {
+	if(strncmp((const char *)packet->payload, "{\"host_int\"", 11) == 0) {
+	  
+	  NDPI_LOG(NDPI_PROTOCOL_DROPBOX, ndpi_struct, NDPI_LOG_DEBUG, "Found dropbox.\n");
+	  ndpi_int_dropbox_add_connection(ndpi_struct, flow, 0);
+	  return;
+	}
+      }
+    }
+    if((packet->udp->dest == dropbox_port)) {
+      if(payload_len > 2) {
+	char * p = (char *) packet->payload;
+	while(*p++ != '{');
+	if(strncmp(p,"\"messageType\"", 13) == 0) {
 	  NDPI_LOG(NDPI_PROTOCOL_DROPBOX, ndpi_struct, NDPI_LOG_DEBUG, "Found dropbox.\n");
 	  ndpi_int_dropbox_add_connection(ndpi_struct, flow, 0);
 	  return;
diff --git a/src/lib/protocols/winmx.c b/src/lib/protocols/winmx.c
deleted file mode 100644
index 31d4b1ed6..000000000
--- a/src/lib/protocols/winmx.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * winmx.c
- *
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
- * 
- */
-
-
-#include "ndpi_protocols.h"
-
-#ifdef NDPI_PROTOCOL_WINMX
-
-
-static void ndpi_int_winmx_add_connection(struct ndpi_detection_module_struct
-					  *ndpi_struct, struct ndpi_flow_struct *flow);
-
-static void ndpi_int_winmx_add_connection(struct ndpi_detection_module_struct
-					  *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WINMX, NDPI_PROTOCOL_UNKNOWN);
-}
-
-
-void ndpi_search_winmx_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  struct ndpi_packet_struct *packet = &flow->packet;
-	
-  //      struct ndpi_id_struct         *src=ndpi_struct->src;
-  //      struct ndpi_id_struct         *dst=ndpi_struct->dst;
-
-
-  if (flow->l4.tcp.winmx_stage == 0) {
-    if (packet->payload_packet_len == 1 || (packet->payload_packet_len > 1 && packet->payload[0] == 0x31)) {
-      return;
-    }
-    /* did not see this pattern in any trace that we have */
-    if (((packet->payload_packet_len) == 4)
-	&& (memcmp(packet->payload, "SEND", 4) == 0)) {
-
-      NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "maybe WinMX Send\n");
-      flow->l4.tcp.winmx_stage = 1;
-      return;
-    }
-
-    if (((packet->payload_packet_len) == 3)
-	&& (memcmp(packet->payload, "GET", 3) == 0)) {
-      NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "found winmx by GET\n");
-      ndpi_int_winmx_add_connection(ndpi_struct, flow);
-      return;
-    }
-
-
-    if (packet->payload_packet_len == 149 && packet->payload[0] == '8') {
-      NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "maybe WinMX\n");
-      if (get_u_int32_t(packet->payload, 17) == 0
-	  && get_u_int32_t(packet->payload, 21) == 0
-	  && get_u_int32_t(packet->payload, 25) == 0
-	  && get_u_int16_t(packet->payload, 39) == 0 && get_u_int16_t(packet->payload, 135) == htons(0x7edf)
-	  && get_u_int16_t(packet->payload, 147) == htons(0xf792)) {
-
-	NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG,
-		 "found winmx by pattern in first packet\n");
-	ndpi_int_winmx_add_connection(ndpi_struct, flow);
-	return;
-      }
-    }
-    /* did not see this pattern in any trace that we have */
-  } else if (flow->l4.tcp.winmx_stage == 1) {
-    if (packet->payload_packet_len > 10 && packet->payload_packet_len < 1000) {
-      u_int16_t left = packet->payload_packet_len - 1;
-      while (left > 0) {
-	if (packet->payload[left] == ' ') {
-	  NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "found winmx in second packet\n");
-	  ndpi_int_winmx_add_connection(ndpi_struct, flow);
-	  return;
-	} else if (packet->payload[left] < '0' || packet->payload[left] > '9') {
-	  break;
-	}
-	left--;
-      }
-    }
-  }
-
-  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_WINMX);
-}
-
-
-void init_winmx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
-  ndpi_set_bitmask_protocol_detection("WinMX", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_WINMX,
-				      ndpi_search_winmx_tcp,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
-				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-				      ADD_TO_DETECTION_BITMASK);
-
-  *id += 1;
-}
-
-#endif