Merge branch 'dev' into wireguard

Conflicts:
	src/include/ndpi_protocols.h
	src/lib/ndpi_main.c

Get upstream developments.

4 files changed, 208 insertions, 5 deletions

diff --git a/src/lib/protocols/amazon_video.c b/src/lib/protocols/amazon_video.c
new file mode 100644
index 000000000..41356d9ad
--- /dev/null
+++ b/src/lib/protocols/amazon_video.c
@@ -0,0 +1,81 @@
+/*
+ * amazon_video.c
+ *
+ * Copyright (C) 2018 by ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_AMAZON_VIDEO
+
+#include "ndpi_api.h"
+
+static void ndpi_check_amazon_video(struct ndpi_detection_module_struct *ndpi_struct,
+				  struct ndpi_flow_struct *flow) {
+
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search Amazon Prime\n");
+
+  if((packet->tcp != NULL) &&
+      (packet->payload[0] == 0xFE &&
+       packet->payload[1] == 0xED &&
+       packet->payload[2] == 0xFA &&
+       packet->payload[3] == 0xCE))
+    {
+      NDPI_LOG_INFO(ndpi_struct, "found Amazon Video on TCP\n");
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AMAZON_VIDEO, NDPI_PROTOCOL_UNKNOWN);
+      return;
+    }
+  else if((packet->udp != NULL) &&
+	   (packet->payload[0] == 0xDE &&
+	    packet->payload[1] == 0xAD &&
+	    packet->payload[2] == 0xBE &&
+	    packet->payload[3] == 0xEF))
+    {
+      NDPI_LOG_INFO(ndpi_struct, "found Amazon Video on UDP\n");
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AMAZON_VIDEO, NDPI_PROTOCOL_UNKNOWN);
+    } else {
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+  }
+}
+
+void ndpi_search_amazon_video(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search amazon_video\n");
+
+  /* skip marked packets */
+  if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_AMAZON_VIDEO)
+    ndpi_check_amazon_video(ndpi_struct, flow);
+}
+
+
+void init_amazon_video_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("AMAZON_VIDEO", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_AMAZON_VIDEO,
+				      ndpi_search_amazon_video,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+  *id += 1;
+}
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index b53bed73d..202b3d939 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -30,6 +30,8 @@
 
 #define MAX_NUM_STUN_PKTS     8
 
+// #define DEBUG_STUN 1
+
 struct stun_packet_header {
   u_int16_t msg_type, msg_len;
   u_int32_t cookie;
@@ -46,6 +48,17 @@ typedef enum {
   NDPI_IS_NOT_STUN
 } ndpi_int_stun_t;
 
+
+static int is_google_ip_address(u_int32_t host) {
+  if(
+     ((host & 0xFFFF0000 /* 255.255.0.0 */) == 0x4A7D0000 /* 74.125.0.0/16 */)
+     || ((host & 0xFFFF0000 /* 255.255.0.0 */) == 0x42660000 /* 66.102.0.0/16 */)
+     )
+    return(1);
+  else
+    return(0);
+}
+
 static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *ndpi_struct,
 					   struct ndpi_flow_struct *flow,
 					   const u_int8_t * payload,
@@ -87,10 +100,15 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 
   if(msg_type == 0x01 /* Binding Request */) {
     flow->protos.stun_ssl.stun.num_binding_requests++;
-    if((msg_len == 0)  && (flow->guessed_host_protocol_id == NDPI_PROTOCOL_GOOGLE)) {
+    if((msg_len == 0) && (flow->guessed_host_protocol_id == NDPI_PROTOCOL_GOOGLE)) {
       flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO;
     }
   }
+
+  if((msg_len == 0) && (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN)) {
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    return(NDPI_IS_NOT_STUN);
+  }
   
   flow->protos.stun_ssl.stun.num_udp_pkts++;
 
@@ -199,9 +217,16 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	  }
 	  break;
 
+	case 0xFF03:
+	  can_this_be_whatsapp_voice = 0;
+	  flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO;
+	  break;
+	  
 	default:
 	  /* This means this STUN packet cannot be confused with whatsapp voice */
-	  /* printf("==> %04X\n", attribute); */
+#ifdef DEBUG_STUN
+	  printf("==> %04X\n", attribute);
+#endif
 	  can_this_be_whatsapp_voice = 0;
 	  break;
 	}
@@ -223,8 +248,18 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 
  udp_stun_found:
   if(can_this_be_whatsapp_voice) {
+    struct ndpi_packet_struct *packet = &flow->packet;
+    
     flow->protos.stun_ssl.stun.num_processed_pkts++;
-    flow->guessed_host_protocol_id = NDPI_PROTOCOL_WHATSAPP_VOICE;
+#ifdef DEBUG_STUN
+    printf("==>> NDPI_PROTOCOL_WHATSAPP_VOICE\n");
+#endif
+
+    if((ntohs(packet->udp->source) == 3478) || (ntohs(packet->udp->dest) == 3478))
+      flow->guessed_host_protocol_id = NDPI_PROTOCOL_WHATSAPP_VOICE;
+    else
+      flow->guessed_host_protocol_id = (is_google_ip_address(ntohl(packet->iph->saddr)) || is_google_ip_address(ntohl(packet->iph->daddr)))
+					? NDPI_PROTOCOL_HANGOUT_DUO : NDPI_PROTOCOL_WHATSAPP_VOICE;
     return((flow->protos.stun_ssl.stun.num_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN);
   } else {
     /*
@@ -243,7 +278,12 @@ void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct n
 
   NDPI_LOG_DBG(ndpi_struct, "search stun\n");
 
-  if(packet->payload == NULL) return;
+  if(packet->payload == NULL)
+    return;
+  else if(packet->iphv6 != NULL) {
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    return;
+  }
 
   if(packet->tcp) {
     /* STUN may be encapsulated in TCP packets */
diff --git a/src/lib/protocols/targus_getdata.c b/src/lib/protocols/targus_getdata.c
new file mode 100644
index 000000000..4ee53e8ff
--- /dev/null
+++ b/src/lib/protocols/targus_getdata.c
@@ -0,0 +1,77 @@
+/*
+ * targus_getdata.c
+ *
+ * Copyright (C) 2018 by ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_TARGUS_GETDATA
+
+#include "ndpi_api.h"
+
+static void ndpi_check_targus_getdata(struct ndpi_detection_module_struct *ndpi_struct,
+				  struct ndpi_flow_struct *flow) {
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  if(packet->iph) {
+    u_int16_t targus_getdata_port       = ntohs(5201);
+    u_int16_t complex_link_port         = ntohs(5001);
+
+    if(((packet->tcp != NULL) && ((packet->tcp->dest == targus_getdata_port)
+                             || (packet->tcp->source == targus_getdata_port)
+                             || (packet->tcp->dest == complex_link_port)
+                             || (packet->tcp->source == complex_link_port)))
+      || ((packet->udp != NULL) && ((packet->udp->dest == targus_getdata_port)
+                                || (packet->udp->source == targus_getdata_port)
+                                || (packet->udp->dest == complex_link_port)
+                                || (packet->udp->source == complex_link_port)))) {
+
+      NDPI_LOG_INFO(ndpi_struct, "found targus getdata used for speedtest\n");
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TARGUS_GETDATA, NDPI_PROTOCOL_UNKNOWN);
+      return;
+    }
+  }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void ndpi_search_targus_getdata(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search targus getdata\n");
+
+  /* skip marked packets */
+  if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_TARGUS_GETDATA)
+    ndpi_check_targus_getdata(ndpi_struct, flow);
+}
+
+
+void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("TARGUS_GETDATA", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_TARGUS_GETDATA,
+				      ndpi_search_targus_getdata,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+  *id += 1;
+}
diff --git a/src/lib/protocols/xbox.c b/src/lib/protocols/xbox.c
index 5d1f64d43..768bb7322 100644
--- a/src/lib/protocols/xbox.c
+++ b/src/lib/protocols/xbox.c
@@ -80,6 +80,11 @@ void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct n
       NDPI_LOG_DBG(ndpi_struct, "maybe xbox\n");
       flow->l4.udp.xbox_stage++;
       return;
+    } else if ((dport == 3075 || dport == 3076 || dport == 3077 || dport == 3078) ||
+          (sport == 3075 || sport == 3076 || sport == 3077 || sport == 3078)) {
+	ndpi_int_xbox_add_connection(ndpi_struct, flow);
+	NDPI_LOG_INFO(ndpi_struct, "found xbox udp port connection detected\n");
+	return;
     }
 
     /* exclude here all non matched udp traffic, exclude here tcp only if http has been excluded, because xbox could use http */
@@ -96,7 +101,7 @@ void init_xbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
   ndpi_set_bitmask_protocol_detection("Xbox", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_XBOX,
 				      ndpi_search_xbox,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
 				      NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);