aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorToni <matzeton@googlemail.com>2022-05-29 13:12:13 +0200
committerGitHub <noreply@github.com>2022-05-29 13:12:13 +0200
commit33f9729ee4881f92afad662008a3d378aee2887d (patch)
treee4bffc3eacdc19c23d60c9538e2806d8e8940399 /src
parentcfd23e88198716d8d5b3625a7da586536701349f (diff)
Added MPEG-DASH dissector. Fixes #1223. (#1555)
* Improved HTTP POST detection * Refactored subprotocol detection Signed-off-by: lns <matzeton@googlemail.com>
Diffstat (limited to 'src')
5 files changed, 152 insertions, 27 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 8a8808c01..b34a5392c 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -319,6 +319,7 @@ typedef enum {
NDPI_PROTOCOL_EDGECAST = 288,
NDPI_PROTOCOL_CACHEFLY = 289,
NDPI_PROTOCOL_SOFTETHER = 290,
+ NDPI_PROTOCOL_MPEGDASH = 291,
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 0f0103e49..841506a65 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -225,6 +225,7 @@ void init_toca_boca_dissector(struct ndpi_detection_module_struct *ndpi_struct,
void init_sd_rtn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_raknet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_xiaomi_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_mpegdash_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
/* ndpi_main.c */
extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index d6f6037ff..6fcfbb13f 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -986,6 +986,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
NDPI_PROTOCOL_MAPLESTORY, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_WORLDOFWARCRAFT,
NDPI_PROTOCOL_THUNDER, NDPI_PROTOCOL_IRC,
NDPI_PROTOCOL_IPP,
+ NDPI_PROTOCOL_MPEGDASH,
NDPI_PROTOCOL_RTSP,
NDPI_PROTOCOL_MATCHED_BY_CONTENT,
NDPI_PROTOCOL_NO_MORE_SUBPROTOCOLS); /* NDPI_PROTOCOL_HTTP can have (content-matched) subprotocols */
@@ -1892,6 +1893,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"Softether", NDPI_PROTOCOL_CATEGORY_VPN,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MPEGDASH,
+ "MpegDash", NDPI_PROTOCOL_CATEGORY_MEDIA,
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -4378,6 +4383,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
/* Xiaomi */
init_xiaomi_dissector(ndpi_str, &a, detection_bitmask);
+ /* MpegDash */
+ init_mpegdash_dissector(ndpi_str, &a, detection_bitmask);
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
#endif
@@ -5037,6 +5045,47 @@ void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_str,
/* ************************************************ */
+static u_int32_t check_ndpi_subprotocols(struct ndpi_detection_module_struct * const ndpi_str,
+ struct ndpi_flow_struct * const flow,
+ NDPI_SELECTION_BITMASK_PROTOCOL_SIZE const ndpi_selection_packet,
+ NDPI_PROTOCOL_BITMASK detection_bitmask,
+ u_int16_t detected_protocol)
+{
+ u_int32_t num_calls = 0;
+
+ if (detected_protocol == NDPI_PROTOCOL_UNKNOWN)
+ {
+ return num_calls;
+ }
+
+ for (u_int32_t a = 0; a < ndpi_str->proto_defaults[detected_protocol].subprotocol_count; a++)
+ {
+ u_int16_t subproto_id = ndpi_str->proto_defaults[detected_protocol].subprotocols[a];
+ if (subproto_id == (uint16_t)NDPI_PROTOCOL_MATCHED_BY_CONTENT ||
+ subproto_id == flow->detected_protocol_stack[0] ||
+ subproto_id == flow->detected_protocol_stack[1])
+ {
+ continue;
+ }
+
+ u_int16_t subproto_index = ndpi_str->proto_defaults[subproto_id].protoIdx;
+ if ((ndpi_str->callback_buffer[subproto_index].ndpi_selection_bitmask & ndpi_selection_packet) ==
+ ndpi_str->callback_buffer[subproto_index].ndpi_selection_bitmask &&
+ NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask,
+ ndpi_str->callback_buffer[subproto_index].excluded_protocol_bitmask) == 0 &&
+ NDPI_BITMASK_COMPARE(ndpi_str->callback_buffer[subproto_index].detection_bitmask,
+ detection_bitmask) != 0)
+ {
+ ndpi_str->callback_buffer[subproto_index].func(ndpi_str, flow);
+ num_calls++;
+ }
+ }
+
+ return num_calls;
+}
+
+/* ************************************************ */
+
static u_int32_t check_ndpi_detection_func(struct ndpi_detection_module_struct * const ndpi_str,
struct ndpi_flow_struct * const flow,
NDPI_SELECTION_BITMASK_PROTOCOL_SIZE const ndpi_selection_packet,
@@ -5094,33 +5143,10 @@ static u_int32_t check_ndpi_detection_func(struct ndpi_detection_module_struct *
}
}
- /* Check for subprotocols. */
- for (a = 0; a < ndpi_str->proto_defaults[flow->detected_protocol_stack[0]].subprotocol_count; a++)
- {
- u_int16_t subproto_id = ndpi_str->proto_defaults[flow->detected_protocol_stack[0]].subprotocols[a];
- if (subproto_id == (uint16_t)NDPI_PROTOCOL_MATCHED_BY_CONTENT)
- {
- continue;
- }
-
- u_int16_t subproto_index = ndpi_str->proto_defaults[subproto_id].protoIdx;
- if ((func != ndpi_str->proto_defaults[subproto_id].func) &&
- (ndpi_str->callback_buffer[subproto_index].ndpi_selection_bitmask & ndpi_selection_packet) ==
- ndpi_str->callback_buffer[subproto_index].ndpi_selection_bitmask &&
- NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask,
- ndpi_str->callback_buffer[subproto_index].excluded_protocol_bitmask) == 0 &&
- NDPI_BITMASK_COMPARE(ndpi_str->callback_buffer[subproto_index].detection_bitmask,
- detection_bitmask) != 0)
- {
- ndpi_str->callback_buffer[subproto_index].func(ndpi_str, flow);
- num_calls++;
- }
-
- if (flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN)
- {
- break; /* Stop after the first detected subprotocol. */
- }
- }
+ num_calls += check_ndpi_subprotocols(ndpi_str, flow, ndpi_selection_packet, detection_bitmask,
+ flow->detected_protocol_stack[0]);
+ num_calls += check_ndpi_subprotocols(ndpi_str, flow, ndpi_selection_packet, detection_bitmask,
+ flow->detected_protocol_stack[1]);
return num_calls;
}
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 6351e50aa..cdb2d97bf 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -1047,6 +1047,7 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
ndpi_parse_packet_line_info(ndpi_struct, flow);
check_content_type_and_change_protocol(ndpi_struct, flow);
ndpi_validate_http_content(ndpi_struct, flow);
+ ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_CATEGORY_WEB);
return;
}
diff --git a/src/lib/protocols/mpegdash.c b/src/lib/protocols/mpegdash.c
new file mode 100644
index 000000000..bc6fc8d44
--- /dev/null
+++ b/src/lib/protocols/mpegdash.c
@@ -0,0 +1,96 @@
+/*
+ * mpegdash.c
+ *
+ * Copyright (C) 2022 - ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_MPEGDASH
+
+#include "ndpi_api.h"
+
+
+static void ndpi_int_mpegdash_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id,
+ NDPI_PROTOCOL_MPEGDASH, NDPI_CONFIDENCE_DPI);
+}
+
+void ndpi_search_mpegdash_http(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct *packet = &ndpi_struct->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search MpegDash\n");
+
+ if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_HTTP &&
+ flow->detected_protocol_stack[1] != NDPI_PROTOCOL_HTTP)
+ {
+ if (flow->packet_counter > 2)
+ {
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ }
+ return;
+ }
+
+ if (packet->parsed_lines == 0)
+ {
+ ndpi_parse_packet_line_info(ndpi_struct, flow);
+ }
+
+ if (packet->parsed_lines > 0)
+ {
+ if (LINE_ENDS(packet->line[0], "RTSP/1.0") != 0 ||
+ LINE_ENDS(packet->line[0], ".mp4 HTTP/1.1") != 0 ||
+ LINE_ENDS(packet->line[0], ".m4s HTTP/1.1") != 0)
+ {
+ ndpi_int_mpegdash_add_connection(ndpi_struct, flow);
+ return;
+ }
+
+ for (size_t i = 0; i < packet->parsed_lines && packet->line[i].len > 0; ++i)
+ {
+ if ((LINE_STARTS(packet->line[i], "Content-Type:") != 0 &&
+ LINE_ENDS(packet->line[i], "video/mp4") != 0) ||
+ LINE_STARTS(packet->line[i], "DASH") != 0)
+ {
+ ndpi_int_mpegdash_add_connection(ndpi_struct, flow);
+ return;
+ }
+ }
+ }
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
+}
+
+void init_mpegdash_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("MpegDash", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_MPEGDASH,
+ ndpi_search_mpegdash_http,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
Powered by cgit, Themed by Ted Yin.