Added AMQP (Advanced Message Queueing Protocol)

3 files changed, 92 insertions, 1 deletions

diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 987975c47..3770c9cfc 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -21,6 +21,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
 		     protocols/applejuice.c \
 		     protocols/armagetron.c \
 		     protocols/ayiya.c \
+		     protocols/amqp.c \
 		     protocols/battlefield.c \
 		     protocols/bgp.c \
 		     protocols/bittorrent.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2250928c4..9a2c5d7a5 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1611,9 +1611,13 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    no_master, "Ookla", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),   /* TCP */
 			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0));  /* UDP */
+    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AMQP,
+			    no_master,
+			    no_master, "AMQP", NDPI_PROTOCOL_CATEGORY_RPC,
+			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),   /* TCP */
+			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0));  /* UDP */
 
     /* To be removed as soon as we define new protocols */
-    ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_192);
     ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_197);
     ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_208);
     ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_209);
@@ -2687,6 +2691,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* BITTORRENT */
   init_bittorrent_dissector(ndpi_struct, &a, detection_bitmask);
 
+  /* AMQP */
+  init_amqp_dissector(ndpi_struct, &a, detection_bitmask);
+
   /* ----------------------------------------------------------------- */
 
 
diff --git a/src/lib/protocols/amqp.c b/src/lib/protocols/amqp.c
new file mode 100644
index 000000000..72bbc0a38
--- /dev/null
+++ b/src/lib/protocols/amqp.c
@@ -0,0 +1,83 @@
+/*
+ * amqp.c
+ *
+ * Copyright (C) 2011-17 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocols.h"
+#ifdef NDPI_PROTOCOL_AMQP
+
+PACK_ON
+struct amqp_header {
+	u_int8_t ptype;
+	u_int16_t channel;
+	u_int32_t length;
+	u_int16_t class_id, method;
+} PACK_OFF;
+
+static void ndpi_int_amqp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
+					 struct ndpi_flow_struct *flow/* , */
+					 /* ndpi_protocol_type_t protocol_type */) {
+	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AMQP, NDPI_PROTOCOL_UNKNOWN);
+}
+
+void ndpi_search_amqp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+	struct ndpi_packet_struct *packet = &flow->packet;
+
+	NDPI_LOG(NDPI_PROTOCOL_AMQP, ndpi_struct, NDPI_LOG_DEBUG, "search amqp.  \n");
+
+	if (packet->tcp != NULL) {
+		if(packet->payload_packet_len > sizeof(struct amqp_header)) {
+			struct amqp_header *h = (struct amqp_header*)packet->payload;
+
+			if(h->ptype <= 3) {
+				u_int32_t length = htonl(h->length);
+
+				if(((length+8) >= packet->payload_packet_len)
+				   && (length < 32768) /* Upper bound */) {					
+					u_int16_t class_id = htons(h->class_id);
+				
+					if((class_id >= 10) /* Connection */
+					   && (class_id <= 110) /* Tunnel */) {
+						u_int16_t method = htons(h->method);
+
+						if(method <= 120 /* Method basic NACK */) {
+							NDPI_LOG(NDPI_PROTOCOL_AMQP, ndpi_struct, NDPI_LOG_DEBUG, "found amqp over tcp.  \n");
+							ndpi_int_amqp_add_connection(ndpi_struct, flow);
+							return;
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+
+void init_amqp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+	ndpi_set_bitmask_protocol_detection("AMQP", ndpi_struct, detection_bitmask, *id,
+					    NDPI_PROTOCOL_AMQP,
+					    ndpi_search_amqp,
+					    NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD,
+					    SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+					    ADD_TO_DETECTION_BITMASK);
+
+	*id += 1;
+}
+
+#endif