aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--configure.ac2
-rw-r--r--src/include/ndpi_protocol_ids.h5
-rw-r--r--src/include/ndpi_protocols.h1
-rw-r--r--src/include/ndpi_typedefs.h9
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_main.c14
-rw-r--r--src/lib/protocols/eaq.c68
7 files changed, 92 insertions, 8 deletions
diff --git a/configure.ac b/configure.ac
index 59a45f5f9..3c310a1d4 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-AC_INIT([libndpi], [1.6.0])
+AC_INIT([libndpi], [1.6.1])
AC_CONFIG_MACRO_DIR([m4])
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 29578b043..209707481 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -236,9 +236,10 @@
#define NDPI_SERVICE_VIBER NDPI_PROTOCOL_VIBER /* Tomasz Bujlow <tomasz@skatnet.dk> */
#define NDPI_SERVICE_YAHOO NDPI_PROTOCOL_YAHOO /* Tomasz Bujlow <tomasz@skatnet.dk> */
#define NDPI_SERVICE_PANDORA 187
+#define NDPI_PROTOCOL_EAQ 190
-/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE (NDPI_PROTOCOL_WHATSAPP_VOICE) */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL 189
+/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL 190
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 4fc0516d8..f5cd3271a 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -178,5 +178,6 @@ void ndpi_search_twitter(struct ndpi_detection_module_struct *ndpi_struct, struc
void ndpi_search_vhua(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_telegram(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
+void ndpi_search_eaq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
#endif /* __NDPI_PROTOCOLS_INCLUDE_FILE__ */
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index a75b7c4cb..c35064b88 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -373,23 +373,18 @@ struct ndpi_flow_tcp_struct {
#ifdef NDPI_PROTOCOL_MAIL_IMAP
u_int32_t mail_imap_stage:3;
#endif
-
#ifdef NDPI_PROTOCOL_SKYPE
u_int8_t skype_packet_id;
#endif
-
#ifdef NDPI_PROTOCOL_CITRIX
u_int8_t citrix_packet_id;
#endif
-
#ifdef NDPI_PROTOCOL_LOTUS_NOTES
u_int8_t lotus_notes_packet_id;
#endif
-
#ifdef NDPI_PROTOCOL_TEAMVIEWER
u_int8_t teamviewer_stage;
#endif
-
#ifdef NDPI_PROTOCOL_ZMQ
u_int8_t prev_zmq_pkt_len;
u_char prev_zmq_pkt[10];
@@ -439,6 +434,10 @@ struct ndpi_flow_udp_struct {
#ifdef NDPI_PROTOCOL_TEAMVIEWER
u_int8_t teamviewer_stage;
#endif
+#ifdef NDPI_PROTOCOL_EAQ
+ u_int8_t eaq_pkt_id;
+ u_int32_t eaq_sequence;
+#endif
}
#if !defined(WIN32)
__attribute__ ((__packed__))
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 86aeb6c68..e6db045bc 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -39,6 +39,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/dns.c \
protocols/dofus.c \
protocols/dropbox.c \
+ protocols/eaq.c \
protocols/edonkey.c \
protocols/fasttrack.c \
protocols/fiesta.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index af417f44f..b7e02721b 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1466,6 +1466,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "Quic",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 443, 80, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_EAQ,
+ no_master,
+ no_master, "EAQ",
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 6000, 0, 0, 0, 0) /* UDP */);
custom_master[0] = NDPI_PROTOCOL_HTTP, custom_master[1] = NDPI_PROTOCOL_UNKNOWN;
custom_master1[0] = NDPI_PROTOCOL_DNS, custom_master1[1] = NDPI_PROTOCOL_UNKNOWN;
@@ -3537,6 +3542,15 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
ADD_TO_DETECTION_BITMASK);
#endif
+#ifdef NDPI_PROTOCOL_EAQ
+ ndpi_set_bitmask_protocol_detection("EAQ", ndpi_struct, detection_bitmask, a++,
+ NDPI_PROTOCOL_EAQ,
+ ndpi_search_quic,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+#endif
+
ndpi_struct->callback_buffer_size = a;
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG,
diff --git a/src/lib/protocols/eaq.c b/src/lib/protocols/eaq.c
new file mode 100644
index 000000000..0fe47ab6f
--- /dev/null
+++ b/src/lib/protocols/eaq.c
@@ -0,0 +1,68 @@
+/*
+ * eaq.c
+ *
+ * Copyright (C) 2015 - ntop.org
+ *
+ * This module is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This module is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License.
+ * If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_api.h"
+
+#define EAQ_DEFAULT_PORT 6000
+#define EAQ_DEFAULT_SIZE 16
+
+#ifdef NDPI_PROTOCOL_EAQ
+static void ndpi_int_eaq_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow) {
+ ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_EAQ, NDPI_REAL_PROTOCOL);
+}
+
+
+void ndpi_search_eaq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+ u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
+ unsigned char *vers;
+ int ver_offs;
+
+ if((packet->payload_packet_len != EAQ_DEFAULT_SIZE)
+ || ((sport != EAQ_DEFAULT_PORT) && (dport != EAQ_DEFAULT_PORT))) {
+ exclude_eaq:
+ NDPI_LOG(NDPI_PROTOCOL_EAQ, ndpi_struct, NDPI_LOG_DEBUG, "Exclude eaq.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_EAQ);
+ return;
+ }
+
+ if(packet->udp != NULL) {
+ u_int32_t seq = (packet->payload[0] * 1000) + (packet->payload[1] * 100) + (packet->payload[2] * 10) + packet->payload[3];
+
+ if(flow->l4.udp.eaq_pkt_id == 0)
+ flow->l4.udp.eaq_sequence = seq;
+ else {
+ if((flow->l4.udp.eaq_sequence == seq) || ((flow->l4.udp.eaq_sequence+1) == seq)) {
+ ; /* Looks good */
+ } else
+ goto exclude_eaq;
+ }
+
+ if(++flow->l4.udp.eaq_pkt_id == 4) {
+ /* We have collected enough packets so we assume it's EAQ */
+ NDPI_LOG(NDPI_PROTOCOL_EAQ, ndpi_struct, NDPI_LOG_DEBUG, "found eaq.\n");
+ ndpi_int_eaq_add_connection(ndpi_struct, flow);
+ }
+ } else
+ goto exclude_eaq;
+}
+#endif
Powered by cgit, Themed by Ted Yin.