Merge branch 'dev' into dev

17 files changed, 205 insertions, 38 deletions

diff --git a/src/lib/protocols/attic/ftp.c b/src/lib/protocols/attic/ftp.c
index 29cf55d15..2e06aec9a 100644
--- a/src/lib/protocols/attic/ftp.c
+++ b/src/lib/protocols/attic/ftp.c
@@ -43,6 +43,8 @@ static void ndpi_int_ftp_add_connection(struct ndpi_detection_module_struct *ndp
  */
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
@@ -78,8 +80,11 @@ u_int8_t ndpi_int_check_possible_ftp_command(const struct ndpi_packet_struct *pa
 /**
  * ftp replies are are 3-digit number followed by space or hyphen
  */
+
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
@@ -108,6 +113,8 @@ u_int8_t ndpi_int_check_possible_ftp_reply(const struct ndpi_packet_struct *pack
  */
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/checkmk.c b/src/lib/protocols/checkmk.c
new file mode 100755
index 000000000..50a92c8d5
--- /dev/null
+++ b/src/lib/protocols/checkmk.c
@@ -0,0 +1,83 @@
+/*
+ * checkmk.c
+ *
+ * Copyright (C) 2011-17 - ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ *
+ */
+
+#include "ndpi_protocols.h"
+
+#ifdef NDPI_PROTOCOL_CHECKMK
+
+static void ndpi_int_checkmk_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
+					    struct ndpi_flow_struct *flow)
+{
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CHECKMK, NDPI_PROTOCOL_UNKNOWN);
+}
+
+
+void ndpi_search_checkmk(struct ndpi_detection_module_struct *ndpi_struct,
+			 struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  if (packet->payload_packet_len >= 15) {
+
+    if(packet->payload_packet_len > 128) {
+      /*
+	When we transfer a large data chunk, unless we have observed
+	the initial connection, we need to discard these packets
+	as they are not an indication that this flow is not AFP
+      */
+      return;
+    }
+
+    /*
+     * this will detect the OpenSession command of the Data Stream Interface (DSI) protocol
+     * which is exclusively used by the Apple Filing Protocol (AFP) on TCP/IP networks
+     */
+    if (packet->payload_packet_len >= 15 && packet->payload_packet_len < 100
+        && memcmp(packet->payload, "<<<check_mk>>>", 14) == 0) {
+
+      NDPI_LOG(NDPI_PROTOCOL_CHECKMK, ndpi_struct, NDPI_LOG_DEBUG, "Check_MK: Flow detected.\n");
+      ndpi_int_checkmk_add_connection(ndpi_struct, flow);
+      return;
+    }
+  }
+
+  NDPI_LOG(NDPI_PROTOCOL_CHECKMK, ndpi_struct, NDPI_LOG_DEBUG, "Check_MK excluded.\n");
+  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CHECKMK);
+}
+
+
+void init_checkmk_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+			    u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("CHECKMK", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_CHECKMK,
+				      ndpi_search_checkmk,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+  *id += 1;
+}
+
+
+#endif
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index bf4f9d9b6..7b56c3c02 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -201,6 +201,9 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
 	off++;
       }
 
+	if(is_query && ndpi_struct->dns_dissect_response)
+	  return; /* The response will set the verdict */
+
       flow->host_server_name[j] = '\0';
 
       flow->protos.dns.num_queries = (u_int8_t)dns_header.num_queries,
@@ -220,9 +223,6 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
 #endif
     
       if(flow->packet.detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
-	if(is_query && ndpi_struct->dns_dissect_response)
-	  return; /* The response will set the verdict */
-	
 	/**
 	   Do not set the protocol with DNS if ndpi_match_host_subprotocol() has
 	   matched a subprotocol
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 1d12ea2e9..50eef99ed 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -552,15 +552,15 @@ static void http_bitmask_exclude_other(struct ndpi_flow_struct *flow)
 /*************************************************************************************************/
 
 static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct,
-				struct ndpi_flow_struct *flow) {
-
+				struct ndpi_flow_struct *flow) {       
   struct ndpi_packet_struct *packet = &flow->packet;
   u_int16_t filename_start; /* the filename in the request method line, e.g., "GET filename_start..."*/
 
   packet->packet_lines_parsed_complete = 0;
 
   /* Check if we so far detected the protocol in the request or not. */
-  if(flow->l4.tcp.http_stage == 0) { /* Expected a request */
+  if(flow->l4.tcp.http_stage == 0) {
+    /* Expected a request */
     flow->http_detected = 0;
 
     NDPI_LOG_DBG2(ndpi_struct, "HTTP stage %d: \n", flow->l4.tcp.http_stage);
@@ -578,11 +578,29 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
       }
 
       if((packet->payload_packet_len == 3) && memcmp(packet->payload, "HI\n", 3) == 0) {
-	    /* This looks like Ookla: we don't give up with HTTP yet */
-	    flow->l4.tcp.http_stage = 1;
-	    return;
+	/* This looks like Ookla: we don't give up with HTTP yet */
+        flow->l4.tcp.http_stage = 1;
+	return;
       }
-
+      
+      if((packet->payload_packet_len == 40) && (flow->l4.tcp.http_stage == 0)) {
+        /*
+	  -> QR O06L0072-6L91-4O43-857J-K8OO172L6L51
+	  <- QNUUX 2.5 2017-08-15.1314.4jn12m5
+	  -> MXFWUXJM 31625365
+	*/
+
+        if((packet->payload[2] == ' ')
+	   && (packet->payload[11] == '-')
+	   && (packet->payload[16] == '-')
+	   && (packet->payload[21] == '-')
+	   && (packet->payload[26] == '-')
+	   && (packet->payload[39] == 0x0A)
+		)
+		flow->l4.tcp.http_stage = 1;
+	return;	      
+      }
+      
       if((packet->payload_packet_len == 23) && (memcmp(packet->payload, "<policy-file-request/>", 23) == 0)) {
         /*
           <policy-file-request/>
@@ -757,17 +775,21 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
   } else if((flow->l4.tcp.http_stage == 1) || (flow->l4.tcp.http_stage == 2)) {
 
     NDPI_LOG_DBG2(ndpi_struct, "HTTP stage %u: \n", flow->l4.tcp.http_stage);
-
-
-    if(flow->l4.tcp.http_stage == 1) {
-      if((packet->payload_packet_len > 6) && memcmp(packet->payload, "HELLO ", 6) == 0) {
-        /* This looks like Ookla */
-        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_UNKNOWN);
-        return;
-      } else
-        NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OOKLA);
+    
+    if((packet->payload_packet_len == 34) && (flow->l4.tcp.http_stage == 1)) {
+      if((packet->payload[5] == ' ') && (packet->payload[9] == ' ')) {
+	      ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA);
+	      return;
+      }
     }
-
+    
+    if((packet->payload_packet_len > 6) && memcmp(packet->payload, "HELLO ", 6) == 0) {
+       /* This looks like Ookla */
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_UNKNOWN);
+      return;
+    } else
+	    NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OOKLA);    
+    
     /**
        At first check, if this is for sure a response packet (in another direction. If not, if HTTP is detected do nothing now and return,
        otherwise check the second packet for the HTTP request
@@ -852,7 +874,6 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
     flow->l4.tcp.http_stage = 0;
     return;
   }
-
 }
 
 void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct,
diff --git a/src/lib/protocols/irc.c b/src/lib/protocols/irc.c
index 2cadf0a32..7bdd543c3 100644
--- a/src/lib/protocols/irc.c
+++ b/src/lib/protocols/irc.c
@@ -44,8 +44,11 @@ static void ndpi_int_irc_add_connection(struct ndpi_detection_module_struct *ndp
 }
 
 	
+
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/qq.c b/src/lib/protocols/qq.c
index 7eae869ac..f3b713132 100644
--- a/src/lib/protocols/qq.c
+++ b/src/lib/protocols/qq.c
@@ -85,6 +85,8 @@ static const u_int16_t ndpi_valid_qq_versions[] = {
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
@@ -176,6 +178,8 @@ u_int8_t ndpi_is_valid_qq_packet(const struct ndpi_packet_struct *packet)
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
@@ -429,6 +433,8 @@ static void ndpi_search_qq_udp(struct ndpi_detection_module_struct *ndpi_struct,
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
index 3acf71b61..a61e732d2 100644
--- a/src/lib/protocols/rtp.c
+++ b/src/lib/protocols/rtp.c
@@ -119,6 +119,8 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
 {
   struct ndpi_packet_struct *packet = &flow->packet;
 
+  /* printf("*** %s(pkt=%d)\n", __FUNCTION__, flow->packet_counter); */
+  
   if((packet->udp != NULL)
      && (ntohs(packet->udp->source) > 1023)
      && (ntohs(packet->udp->dest) > 1023))
@@ -154,6 +156,8 @@ static void ndpi_int_rtp_add_connection(struct ndpi_detection_module_struct
 
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
@@ -168,6 +172,8 @@ void init_seq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow
 
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/sip.c b/src/lib/protocols/sip.c
index 4b3790208..5edd377c6 100644
--- a/src/lib/protocols/sip.c
+++ b/src/lib/protocols/sip.c
@@ -38,6 +38,8 @@ static void ndpi_int_sip_add_connection(struct ndpi_detection_module_struct *ndp
 
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/sopcast.c b/src/lib/protocols/sopcast.c
index db507ecc7..3e8009454 100644
--- a/src/lib/protocols/sopcast.c
+++ b/src/lib/protocols/sopcast.c
@@ -46,6 +46,8 @@ static void ndpi_int_sopcast_add_connection(struct ndpi_detection_module_struct
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/ssl.c b/src/lib/protocols/ssl.c
index e57e891e5..adb0e9cf4 100644
--- a/src/lib/protocols/ssl.c
+++ b/src/lib/protocols/ssl.c
@@ -637,7 +637,7 @@ void ndpi_search_ssl_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
       return;
     } else if((packet->payload_packet_len == 4)
 	      && (packet->payload[0] == 'W')
-	      && (packet->payload[1] == 'A')){
+	      && (packet->payload[1] == 'A')) {
       ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN);
       return;
     } else {
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 53f39c4d6..eef6e024e 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -247,10 +247,19 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
     return NDPI_IS_NOT_STUN;
 
  udp_stun_found:
-  if(can_this_be_whatsapp_voice)
+  if(can_this_be_whatsapp_voice) {
     flow->num_stun_udp_pkts++;
 
-  return((flow->num_stun_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN);
+    return((flow->num_stun_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN);
+  } else {
+    /*
+      We cannot immediately say that this is STUN as there are other protocols
+      like GoogleHangout that might be candidates, thus we set the
+      guessed protocol to STUN      
+    */
+    flow->guessed_protocol_id = NDPI_PROTOCOL_STUN;
+    return(NDPI_IS_NOT_STUN);
+  }  
 }
 
 void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
@@ -293,17 +302,23 @@ void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct n
       ndpi_int_stun_add_connection(ndpi_struct,
 				   is_whatsapp ? NDPI_PROTOCOL_WHATSAPP_VOICE : NDPI_PROTOCOL_STUN, flow);
     }
+    
     return;
   }
 
   if(flow->num_stun_udp_pkts >= MAX_NUM_STUN_PKTS) {
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
   }
+
+  if(flow->packet_counter > 0) {
+    /* This might be a RTP stream: let's make sure we check it */
+    NDPI_CLR(&flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP);
+  }
 }
 
 
-void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
+void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+			 NDPI_PROTOCOL_BITMASK *detection_bitmask) {
   ndpi_set_bitmask_protocol_detection("STUN", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_STUN,
 				      ndpi_search_stun,
diff --git a/src/lib/protocols/telnet.c b/src/lib/protocols/telnet.c
index 17618f795..264e83aa1 100644
--- a/src/lib/protocols/telnet.c
+++ b/src/lib/protocols/telnet.c
@@ -41,6 +41,8 @@ static void ndpi_int_telnet_add_connection(struct ndpi_detection_module_struct
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/thunder.c b/src/lib/protocols/thunder.c
index 2818d873d..384436f13 100644
--- a/src/lib/protocols/thunder.c
+++ b/src/lib/protocols/thunder.c
@@ -52,6 +52,8 @@ static void ndpi_int_thunder_add_connection(struct ndpi_detection_module_struct
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
@@ -81,6 +83,8 @@ void ndpi_int_search_thunder_udp(struct ndpi_detection_module_struct
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
@@ -134,6 +138,8 @@ void ndpi_int_search_thunder_tcp(struct ndpi_detection_module_struct
 	
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/tor.c b/src/lib/protocols/tor.c
index 93c4fecca..21fc0cf52 100644
--- a/src/lib/protocols/tor.c
+++ b/src/lib/protocols/tor.c
@@ -21,14 +21,23 @@ static void ndpi_int_tor_add_connection(struct ndpi_detection_module_struct
 
 
 int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
-		    struct ndpi_flow_struct *flow, char *certificate) {
-  
+		    struct ndpi_flow_struct *flow, char *certificate) {  
   int prev_num = 0, numbers_found = 0, num_found = 0, i, len;
   char dummy[48], *dot, *name;
 
-  if((certificate == NULL)
-     || (strlen(certificate) < 6)
-     || (strncmp(certificate, "www.", 4)))
+  if(certificate == NULL)
+    return(0);
+  else
+    len = strlen(certificate);
+
+  /* Check if it ends in .com or .net */
+  if(strcmp(&certificate[len-4], ".com") && strcmp(&certificate[len-4], ".net"))
+    return(0);
+  
+  if((len < 6)
+     || (!strncmp(certificate, "*.", 2))  /* Wildcard certificate */
+     || (strncmp(certificate, "www.", 4)) /* Not starting with www.... */
+     )
     return(0);
 
   // printf("***** [SSL] %s(): %s\n", __FUNCTION__, certificate);
@@ -60,13 +69,12 @@ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
       } else
 	prev_num = 0;
 
-      if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->impossible_bigrams_automa, &name[i])) {
-	ndpi_int_tor_add_connection(ndpi_struct, flow);
-	return(1);
-      }
-
+      
       if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->bigrams_automa, &name[i])) {
 	num_found++;
+      } else if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->impossible_bigrams_automa, &name[i])) {
+	ndpi_int_tor_add_connection(ndpi_struct, flow);
+	return(1);
       }
     }
 
diff --git a/src/lib/protocols/world_of_warcraft.c b/src/lib/protocols/world_of_warcraft.c
index 307f41070..bfcf3f4e1 100644
--- a/src/lib/protocols/world_of_warcraft.c
+++ b/src/lib/protocols/world_of_warcraft.c
@@ -39,6 +39,8 @@ static void ndpi_int_worldofwarcraft_add_connection(struct ndpi_detection_module
 
 #if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/yahoo.c b/src/lib/protocols/yahoo.c
index 3c073482f..1144fb4ef 100644
--- a/src/lib/protocols/yahoo.c
+++ b/src/lib/protocols/yahoo.c
@@ -55,8 +55,10 @@ static u_int8_t ndpi_check_for_YmsgCommand(u_int16_t len, const u_int8_t * ptr)
 }
 
        
-#ifndef WIN32
+#if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif
diff --git a/src/lib/protocols/zattoo.c b/src/lib/protocols/zattoo.c
index 9c212ddde..c3e514dda 100644
--- a/src/lib/protocols/zattoo.c
+++ b/src/lib/protocols/zattoo.c
@@ -28,8 +28,10 @@
 
 #include "ndpi_api.h"
 	
-#ifndef WIN32
+#if !defined(WIN32)
 static inline
+#elif defined(MINGW_GCC)
+__mingw_forceinline static
 #else
 __forceinline static
 #endif