Added Line protocol dissection

Add fix for discarding STUN over TCP flows

4 files changed, 103 insertions, 7 deletions

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index b679fe283..9529a8ece 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1001,9 +1001,9 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    no_master, "DNSoverHTTPS", NDPI_PROTOCOL_CATEGORY_NETWORK /* dummy */,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
-    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_205,
+    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_LINE,
 			    0 /* can_have_a_subprotocol */, no_master,
-			    no_master, "Free", NDPI_PROTOCOL_CATEGORY_CUSTOM_1 /* dummy */,
+			    no_master, "Line", NDPI_PROTOCOL_CATEGORY_VOIP,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
     ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FREE_206,
@@ -1016,7 +1016,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    no_master, "PPStream", NDPI_PROTOCOL_CATEGORY_VIDEO,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
-
     ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_XBOX,
 			    0 /* can_have_a_subprotocol */, no_master,
 			    no_master, "Xbox", NDPI_PROTOCOL_CATEGORY_GAME,
@@ -2914,6 +2913,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* VNC */
   init_vnc_dissector(ndpi_struct, &a, detection_bitmask);
 
+  /* LINE */
+  init_line_dissector(ndpi_struct, &a, detection_bitmask);
+
   /* TEAMVIEWER */
   init_teamviewer_dissector(ndpi_struct, &a, detection_bitmask);
 
diff --git a/src/lib/protocols/line.c b/src/lib/protocols/line.c
new file mode 100644
index 000000000..35f6d17af
--- /dev/null
+++ b/src/lib/protocols/line.c
@@ -0,0 +1,70 @@
+/*
+ * line.c
+ *
+ * Copyright (C) 2019 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_LINE
+
+#include "ndpi_api.h"
+
+
+static void ndpi_line_report_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+  /* printf("-> payload_len=%u\n", flow->packet.payload_packet_len); */
+
+  NDPI_LOG_INFO(ndpi_struct, "found line\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_LINE, NDPI_PROTOCOL_LINE);
+}
+
+void ndpi_search_line(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search line\n");
+
+  if(packet->iph) {
+    /* 125.209.252.xxx */
+    if(((ntohl(packet->iph->saddr) & 0xFFFFFF00 /* 255.255.255.0 */) == 0x7DD1FC00)
+       || ((ntohl(packet->iph->daddr) & 0xFFFFFF00 /* 255.255.255.0 */) == 0x7DD1FC00)) {
+      if(
+	 ((packet->payload_packet_len == 110)
+	  && (flow->packet.payload[0] == 0xB6) && (flow->packet.payload[1] == 0x18)
+	  && (flow->packet.payload[2] == 0x00) && (flow->packet.payload[3] == 0x6A))
+	 ||
+	 ((flow->packet.payload[0] == 0xB0) && (flow->packet.payload[1] == 0x78))
+	 ) {
+	ndpi_line_report_protocol(ndpi_struct, flow);
+	return;
+      }
+    }
+  }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+
+void init_line_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("Line", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_LINE,
+				      ndpi_search_line,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
index 0ccc08594..7f41d625f 100644
--- a/src/lib/protocols/rtp.c
+++ b/src/lib/protocols/rtp.c
@@ -71,13 +71,16 @@ static u_int8_t isValidMSRTPType(u_int8_t payloadType) {
   }
 }
 
+/* *************************************************************** */
+
 static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
 			    struct ndpi_flow_struct *flow,
-			    const u_int8_t * payload, const u_int16_t payload_len)
-{
+			    const u_int8_t * payload, const u_int16_t payload_len) {
   NDPI_LOG_DBG(ndpi_struct, "search RTP\n");
+
   if (payload_len < 2)
     return;
+
   //struct ndpi_packet_struct *packet = &flow->packet;
   u_int8_t payloadType, payload_type = payload[1] & 0x7F;
 
@@ -90,6 +93,19 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
 	 /* http://www.iana.org/assignments/rtp-parameters/rtp-parameters.xhtml */
 	 )
      ) {
+    struct ndpi_packet_struct *packet = &flow->packet;
+    
+    if(packet->iph) {
+      /* 125.209.252.xxx */
+      if(((ntohl(packet->iph->saddr) & 0xFFFFFF00 /* 255.255.255.0 */) == 0x7DD1FC00)
+	 || ((ntohl(packet->iph->daddr) & 0xFFFFFF00 /* 255.255.255.0 */) == 0x7DD1FC00)) {
+	if((flow->packet.payload[0] == 0x80) && (flow->packet.payload[1] == 0x78)) {
+	  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_LINE, NDPI_PROTOCOL_LINE);
+	  return;
+	}
+      }
+    }
+
     NDPI_LOG_INFO(ndpi_struct, "Found RTP\n");
     ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTP, NDPI_PROTOCOL_UNKNOWN);
     return;
@@ -114,6 +130,8 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
   NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 }
 
+/* *************************************************************** */
+
 void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
@@ -126,6 +144,8 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
     ndpi_rtp_search(ndpi_struct, flow, packet->payload, packet->payload_packet_len);
 }
 
+/* *************************************************************** */
+
 #if 0
 /* Original (messy) OpenDPI code */
 
@@ -315,6 +335,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
   NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 }
 
+/* *************************************************************** */
 
 void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
@@ -380,10 +401,10 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
 }
 #endif
 
+/* *************************************************************** */
 
 void init_rtp_dissector(struct ndpi_detection_module_struct *ndpi_struct,
-			u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
+			u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
   ndpi_set_bitmask_protocol_detection("RTP", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_RTP,
 				      ndpi_search_rtp,
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 500251a25..d4a122926 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -55,6 +55,9 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
   struct stun_packet_header *h = (struct stun_packet_header*)payload;
   u_int8_t can_this_be_whatsapp_voice = 1;
 
+  /* STUN over TCP does not look good */
+  if(flow->packet.tcp) return(NDPI_IS_NOT_STUN);
+  
   flow->protos.stun_ssl.stun.num_processed_pkts++;
 
   if(payload_length < sizeof(struct stun_packet_header)) {