Merge pull request #861 from havup/dev

pull request with s7comm

4 files changed, 68 insertions, 0 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index d2190afc1..ee71038cc 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -278,6 +278,7 @@ typedef enum {
   NDPI_PROTOCOL_BLOOMBERG             = 246,
   NDPI_PROTOCOL_CAPWAP                = 247,
   NDPI_PROTOCOL_ZABBIX                = 248,
+  NDPI_PROTOCOL_S7COMM                = 249,
 
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 2cae4b203..a5113acf5 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -216,4 +216,5 @@ void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_dnp3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_104_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 #endif /* __NDPI_PROTOCOLS_H__ */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 8ab7ad520..8a24e506d 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1782,6 +1782,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    ndpi_build_default_ports(ports_a, 10050, 0, 0, 0, 0) /* TCP */,
 			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */
 			    );
+     ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_S7COMM,
+          1 /* no subprotocol */, no_master,
+          no_master, "s7comm", NDPI_PROTOCOL_CATEGORY_NETWORK,
+          ndpi_build_default_ports(ports_a, 102, 0, 0, 0, 0) /* TCP */,
+          ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */
+          );
 
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -3525,6 +3531,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
 
   /* Targus Getdata */
   init_targus_getdata_dissector(ndpi_str, &a, detection_bitmask);
+  
+  /* S7 comm */
+  init_s7comm_dissector(ndpi_str, &a, detection_bitmask);
 
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main_init.c"
diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c
new file mode 100644
index 000000000..8a522a2c7
--- /dev/null
+++ b/src/lib/protocols/s7comm.c
@@ -0,0 +1,57 @@
+/*

+ * s7comm.c

+ *

+ * Copyright (C) 2011-20 - ntop.org

+ * 

+ * This file is part of nDPI, an open source deep packet inspection

+ * library based on the OpenDPI and PACE technology by ipoque GmbH

+ *

+ * nDPI is free software: you can redistribute it and/or modify

+ * it under the terms of the GNU Lesser General Public License as published by

+ * the Free Software Foundation, either version 3 of the License, or

+ * (at your option) any later version.

+ *

+ * nDPI is distributed in the hope that it will be useful,

+ * but WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+ * GNU Lesser General Public License for more details.

+ *

+ * You should have received a copy of the GNU Lesser General Public License

+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.

+ * 

+ */

+#include "ndpi_protocol_ids.h"

+#include "ndpi_api.h"

+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_S7COMM

+

+void ndpi_search_s7comm_tcp(struct ndpi_detection_module_struct *ndpi_struct,

+                            struct ndpi_flow_struct *flow) {

+  struct ndpi_packet_struct *packet = &flow->packet;

+  NDPI_LOG_DBG(ndpi_struct, "search S7\n");

+  u_int16_t s7comm_port = htons(102); 

+  if(packet->tcp) {

+    

+    if((packet->payload[0]==0x03)&&(packet->payload[1]==0x00)&&((packet->tcp->dest == s7comm_port) || (packet->tcp->source == s7comm_port))) {

+      NDPI_LOG_INFO(ndpi_struct, "found S7\n");

+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_S7COMM, NDPI_PROTOCOL_UNKNOWN);

+

+      return;

+      

+    }

+  }

+

+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);

+   

+}

+

+void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct,

+                           u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {

+      

+  ndpi_set_bitmask_protocol_detection("S7COMM", ndpi_struct, detection_bitmask, *id,

+                              NDPI_PROTOCOL_S7COMM,

+                              ndpi_search_s7comm_tcp,                            NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,

+                              SAVE_DETECTION_BITMASK_AS_UNKNOWN,

+                              ADD_TO_DETECTION_BITMASK);

+  *id += 1;

+}

+