Added capwap support

5 files changed, 156 insertions, 13 deletions

diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index ea0abe173..b42eff4c4 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -210,6 +210,7 @@ void init_memcached_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 void init_nest_log_sink_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_ookla_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_modbus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_capwap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_line_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2c05d8f84..25d81c142 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1770,7 +1770,9 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    1 /* no subprotocol */, no_master,
 			    no_master, "CAPWAP", NDPI_PROTOCOL_CATEGORY_NETWORK,
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			    ndpi_build_default_ports(ports_b, 0,   0, 0, 0, 0) /* UDP */);
+			    // ndpi_build_default_ports(ports_b, 5246, 5247, 0, 0, 0) /* UDP */
+			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */
+			    );
 
     /* calling function for host and content matched protocols */
     init_string_based_protocols(ndpi_str);
@@ -3242,9 +3244,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* TEAMSPEAK */
   init_teamspeak_dissector(ndpi_str, &a, detection_bitmask);
 
-  /* VIBER */
-  init_viber_dissector(ndpi_str, &a, detection_bitmask);
-
   /* TOR */
   init_tor_dissector(ndpi_str, &a, detection_bitmask);
 
@@ -3356,8 +3355,14 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
   /* MODBUS */
   init_modbus_dissector(ndpi_str, &a, detection_bitmask);
 
+  /* CAPWAP */
+  init_capwap_dissector(ndpi_str, &a, detection_bitmask);
+
   /*** Put false-positive sensitive protocols at the end ***/
 
+  /* VIBER */
+  init_viber_dissector(ndpi_str, &a, detection_bitmask);
+
   /* SKYPE */
   init_skype_dissector(ndpi_str, &a, detection_bitmask);
 
diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c
index e33f0c7dc..bea7622a0 100644
--- a/src/lib/protocols/bittorrent.c
+++ b/src/lib/protocols/bittorrent.c
@@ -376,19 +376,32 @@ static void ndpi_int_search_bittorrent_tcp(struct ndpi_detection_module_struct *
   return;
 }
 
+static u_int8_t is_port(u_int16_t a, u_int16_t b, u_int16_t what) {
+  return(((what == a) || (what == b)) ? 1 : 0);
+}
+  
 void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
   char *bt_proto = NULL;
 
   /* This is broadcast */
-  if(packet->iph
-     && (((packet->iph->saddr == 0xFFFFFFFF) || (packet->iph->daddr == 0xFFFFFFFF))
-	 || (packet->udp
-	     && ((ntohs(packet->udp->source) == 3544) /* teredo.c */
-		 || (ntohs(packet->udp->dest) == 3544))))) {
-    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    return;
+  if(packet->iph) {
+
+    if((packet->iph->saddr == 0xFFFFFFFF) || (packet->iph->daddr == 0xFFFFFFFF))
+      goto exclude_bt;
+
+    
+    if(packet->udp) {
+      u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
+
+      if(is_port(sport, dport, 3544) /* teredo */
+	 || is_port(sport, dport, 5246) || is_port(sport, dport, 5247)/* CAPWAP */) {
+      exclude_bt:
+	NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+	return;
+      }
+    }
   }
 
   if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_BITTORRENT) {
@@ -397,8 +410,8 @@ void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, st
     if((packet->tcp != NULL)
 	&& (packet->tcp_retransmission == 0 || packet->num_retried_bytes)) {
       ndpi_int_search_bittorrent_tcp(ndpi_struct, flow);
-    }
-    else if(packet->udp != NULL) {
+    } else if(packet->udp != NULL) {
+      /* UDP */
       char *bt_search = "BT-SEARCH * HTTP/1.1\r\n";
 
       if((ntohs(packet->udp->source) < 1024)
diff --git a/src/lib/protocols/capwap.c b/src/lib/protocols/capwap.c
new file mode 100644
index 000000000..bfad1a593
--- /dev/null
+++ b/src/lib/protocols/capwap.c
@@ -0,0 +1,123 @@
+/*
+ * capwap.c
+ *
+ * Copyright (C) 2019 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_CAPWAP
+
+#include "ndpi_api.h"
+
+#define NDPI_CAPWAP_CONTROL_PORT 5246
+#define NDPI_CAPWAP_DATA_PORT    5247
+
+
+static void ndpi_int_capwap_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
+					   struct ndpi_flow_struct *flow) {
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CAPWAP, NDPI_PROTOCOL_UNKNOWN);
+}
+
+/* ************************************************** */
+
+static void ndpi_search_setup_capwap(struct ndpi_detection_module_struct *ndpi_struct,
+				     struct ndpi_flow_struct *flow) {
+  struct ndpi_packet_struct *packet = &flow->packet;
+  u_int16_t sport, dport;
+   
+  if(!packet->iph) {
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    return;
+  }
+
+  sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
+  
+  if((dport == NDPI_CAPWAP_CONTROL_PORT)
+     && (packet->iph->daddr == 0xFFFFFFFF)
+     && (packet->payload_packet_len >= 16)
+     && (packet->payload[0] == 0x0)
+     && (packet->payload[8] == 6 /* Mac len */)
+     )
+    goto capwap_found;
+  
+  if(((sport == NDPI_CAPWAP_CONTROL_PORT) || (dport == NDPI_CAPWAP_CONTROL_PORT))
+     && ((packet->payload[0] == 0x0) || (packet->payload[0] == 0x1))
+     ) {
+    u_int16_t msg_len, offset, to_add;
+
+    if(packet->payload[0] == 0x0)
+      offset = 13, to_add = 13;
+    else
+      offset = 15, to_add = 17;
+
+    msg_len = ntohs(*(u_int16_t*)&packet->payload[offset]);
+
+    if((msg_len+to_add) == packet->payload_packet_len)
+      goto capwap_found;
+  }
+  
+  if(
+     (((dport == NDPI_CAPWAP_DATA_PORT) && (packet->iph->daddr != 0xFFFFFFFF)) || (sport == NDPI_CAPWAP_DATA_PORT))
+     && (packet->payload_packet_len >= 16)
+     && (packet->payload[0] == 0x0)
+     ) {
+    u_int8_t is_80211_data = (packet->payload[9] & 0x0C) >> 2;
+
+      
+    if((sport == NDPI_CAPWAP_DATA_PORT) && (is_80211_data == 2 /* IEEE 802.11 Data */))
+      goto capwap_found;
+    else if(dport == NDPI_CAPWAP_DATA_PORT) {
+      u_int16_t msg_len = ntohs(*(u_int16_t*)&packet->payload[13]);
+      
+      if((packet->payload[8] == 1 /* Mac len */)
+	 || (packet->payload[8] == 6 /* Mac len */)
+	 || (packet->payload[8] == 4 /* Wireless len */)
+	 || ((msg_len+15) == packet->payload_packet_len))
+	goto capwap_found;	 
+    }
+  }
+  
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+  return;
+
+ capwap_found:
+  ndpi_int_capwap_add_connection(ndpi_struct, flow);
+}
+
+void ndpi_search_capwap(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &flow->packet;
+
+  if(packet->udp && (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN))
+    ndpi_search_setup_capwap(ndpi_struct, flow);
+}
+
+
+void init_capwap_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+			   u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("CAPWAP", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_CAPWAP,
+				      ndpi_search_capwap,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}
diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 890a20cb9..e758fd5b8 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -58,6 +58,7 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
 	if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d)) ||
 	   ((payload_len >= 16)
 	    && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */
+	    && (packet->payload[0] != 0x0)  /* Avoid invalid CAPWAP detection */
 	    && (packet->payload[2] == 0x02))) {
 
 	  if(is_port(sport, dport, 8801))