Various ethereum improvements

3 files changed, 75 insertions, 16 deletions

diff --git a/src/lib/protocols/mining.c b/src/lib/protocols/mining.c
index b4361e270..aaedf6c6d 100644
--- a/src/lib/protocols/mining.c
+++ b/src/lib/protocols/mining.c
@@ -1,7 +1,7 @@
 /*
  * mining.c [Bitcoin, Ethereum, ZCash, Monero]
  *
- * Copyright (C) 2018 - ntop.org
+ * Copyright (C) 2018-20 - ntop.org
  *
  * This file is part of nDPI, an open source deep packet inspection
  * library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -24,14 +24,49 @@
 
 #include "ndpi_api.h"
 
+/* ************************************************************************** */
+
+void ndpi_search_mining_udp(struct ndpi_detection_module_struct *ndpi_struct,
+			    struct ndpi_flow_struct *flow) {
+  struct ndpi_packet_struct *packet = &flow->packet;
+  u_int16_t source = ntohs(packet->udp->source);
+  u_int16_t dest = ntohs(packet->udp->dest);
+
+  NDPI_LOG_DBG(ndpi_struct, "search MINING UDP\n");
+
+  // printf("==> %s()\n", __FUNCTION__);
+  /* 
+     Ethereum P2P Discovery Protocol
+     https://github.com/ConsenSys/ethereum-dissectors/blob/master/packet-ethereum-disc.c
+  */
+  if((packet->payload_packet_len > 98)
+     && (packet->payload_packet_len < 1280)
+     && ((source == 30303) || (dest == 30303))
+     && (packet->payload[97] <= 0x04 /* NODES */)
+     ) {
+    if((packet->iph) && ((ntohl(packet->iph->daddr) & 0xFF000000 /* 255.0.0.0 */) == 0xFF000000))
+      ;
+    else if(packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000)
+      ;
+    else {
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN);
+      return;
+    }
+  }
+  
+  ndpi_exclude_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, __FILE__, __FUNCTION__, __LINE__);  
+}
+
+/* ************************************************************************** */
+
 void ndpi_search_mining_tcp(struct ndpi_detection_module_struct *ndpi_struct,
 			    struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
 
-  NDPI_LOG_DBG(ndpi_struct, "search MINING\n");
+  NDPI_LOG_DBG(ndpi_struct, "search MINING TCP\n");
 
   /* Check connection over TCP */
-  if(packet->tcp && (packet->payload_packet_len > 10)) {
+  if(packet->payload_packet_len > 10) {
 
     if(packet->tcp->source == htons(8333)) {
       /*
@@ -44,7 +79,14 @@ void ndpi_search_mining_tcp(struct ndpi_detection_module_struct *ndpi_struct,
       if((*to_match == magic) || (*to_match == magic1)) {
 	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN);
       }
-    } if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
+    }
+
+    if((packet->payload_packet_len > 450)
+       && (packet->payload_packet_len < 600)
+       && (packet->tcp->dest == htons(30303) /* Ethereum port */)
+       && (packet->payload[2] == 0x04)) {
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN);
+    } else if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
 	 && (
 	   ndpi_strnstr((const char *)packet->payload, "\"eth1.0\"", packet->payload_packet_len)
 	   || ndpi_strnstr((const char *)packet->payload, "\"worker\":", packet->payload_packet_len)
@@ -84,6 +126,7 @@ void ndpi_search_mining_tcp(struct ndpi_detection_module_struct *ndpi_struct,
   ndpi_exclude_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, __FILE__, __FUNCTION__, __LINE__);
 }
 
+/* ************************************************************************** */
 
 void init_mining_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 			   u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
@@ -96,5 +139,16 @@ void init_mining_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 				      ADD_TO_DETECTION_BITMASK);
 
   *id += 1;
+
+  /* ************ */
+  
+  ndpi_set_bitmask_protocol_detection("Mining", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_MINING,
+				      ndpi_search_mining_udp,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
 }
 
diff --git a/src/lib/protocols/rtmp.c b/src/lib/protocols/rtmp.c
index 9bf73fecd..6f40ce42d 100644
--- a/src/lib/protocols/rtmp.c
+++ b/src/lib/protocols/rtmp.c
@@ -1,6 +1,7 @@
 /*
  * rtmp.c
  *
+ * Copyright (C) 2020 - ntop.org
  * Copyright (C) 2014 Tomasz Bujlow <tomasz@skatnet.dk>
  * 
  * The signature is based on the Libprotoident library.
@@ -46,16 +47,16 @@ static void ndpi_check_rtmp(struct ndpi_detection_module_struct *ndpi_struct, st
   }
   
   /* Check if we so far detected the protocol in the request or not. */
-  if (flow->rtmp_stage == 0) {
-     NDPI_LOG_DBG2(ndpi_struct, "RTMP stage 0: \n");
+  if(flow->rtmp_stage == 0) {
+    NDPI_LOG_DBG2(ndpi_struct, "RTMP stage 0: \n");
      
-     if ((payload_len >= 4) && ((packet->payload[0] == 0x03) || (packet->payload[0] == 0x06))) {
-       NDPI_LOG_DBG2(ndpi_struct, "Possible RTMP request detected, we will look further for the response\n");
+    if ((payload_len >= 4) && ((packet->payload[0] == 0x03) || (packet->payload[0] == 0x06))) {
+      NDPI_LOG_DBG2(ndpi_struct, "Possible RTMP request detected, we will look further for the response\n");
        
-       /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */
-       flow->rtmp_stage = packet->packet_direction + 1;
-     }
-     
+      /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */
+      flow->rtmp_stage = packet->packet_direction + 1;
+    } else
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
   } else {
     NDPI_LOG_DBG2(ndpi_struct, "RTMP stage %u: \n", flow->rtmp_stage);
     
@@ -72,7 +73,6 @@ static void ndpi_check_rtmp(struct ndpi_detection_module_struct *ndpi_struct, st
       NDPI_LOG_DBG2(ndpi_struct, "The reply did not seem to belong to RTMP, resetting the stage to 0\n");
       flow->rtmp_stage = 0;
     }
-    
   }
 }
 
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
index 8074779dd..acea41b54 100644
--- a/src/lib/protocols/rtp.c
+++ b/src/lib/protocols/rtp.c
@@ -124,12 +124,17 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
 void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
-
+  u_int16_t source = ntohs(packet->udp->source);
+  u_int16_t dest = ntohs(packet->udp->dest);
+  
+  // printf("==> %s()\n", __FUNCTION__);
+  
   /* printf("*** %s(pkt=%d)\n", __FUNCTION__, flow->packet_counter); */
 
   if((packet->udp != NULL)
-     /* && (ntohs(packet->udp->source) > 1023) */
-     && (ntohs(packet->udp->dest) > 1023))
+     && (source != 30303) && (dest != 30303 /* Avoid to mix it with Ethereum that looks alike */)
+     && (dest > 1023)
+     )
     ndpi_rtp_search(ndpi_struct, flow, packet->payload, packet->payload_packet_len);
 }