diff options
| -rw-r--r-- | src/lib/protocols/ciscovpn.c | 82 | ||||
| -rw-r--r-- | src/lib/protocols/http.c | 7 |
2 files changed, 56 insertions, 33 deletions
diff --git a/src/lib/protocols/ciscovpn.c b/src/lib/protocols/ciscovpn.c index 02e22bf2c..43acb7b53 100644 --- a/src/lib/protocols/ciscovpn.c +++ b/src/lib/protocols/ciscovpn.c @@ -1,6 +1,22 @@ /* * ciscovpn.c - * Copyright (C) 2013 by Remy Mudingay <mudingay@ill.fr> + * + * Copyright (C) 2013-20 - ntop.org + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + * Dissector developed by Remy Mudingay <mudingay@ill.fr> * */ @@ -10,12 +26,15 @@ #include "ndpi_api.h" +/* ****************************************************************** */ static void ndpi_int_ciscovpn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CISCOVPN, NDPI_PROTOCOL_UNKNOWN); } +/* ****************************************************************** */ + void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; @@ -42,22 +61,20 @@ void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, stru packet->payload[2] == 0x00 && packet->payload[3] == 0x00) ) - ) - - { - /* This is a good query 17010000*/ - NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); - ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); - return; - } + ) { + /* This is a good query 17010000*/ + NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); + ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); + return; + } else if(((tsport == 443 || tdport == 443) || - (tsport == 80 || tdport == 80)) && + (tsport == 80 || tdport == 80)) && (packet->payload_packet_len >= 5) && ((packet->payload[0] == 0x17 && - packet->payload[1] == 0x03 && - packet->payload[2] == 0x03 && - packet->payload[3] == 0x00 && - packet->payload[4] == 0x3A))) + packet->payload[1] == 0x03 && + packet->payload[2] == 0x03 && + packet->payload[3] == 0x00 && + packet->payload[4] == 0x3A))) { /* TLS signature of Cisco AnyConnect 0X170303003A */ NDPI_LOG_INFO(ndpi_struct, "found CISCO Anyconnect VPN\n"); @@ -65,13 +82,13 @@ void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, stru return; } else if(((tsport == 8009 || tdport == 8009) || - (tsport == 8008 || tdport == 8008)) && + (tsport == 8008 || tdport == 8008)) && (packet->payload_packet_len >= 5) && ((packet->payload[0] == 0x17 && - packet->payload[1] == 0x03 && - packet->payload[2] == 0x03 && - packet->payload[3] == 0x00 && - packet->payload[4] == 0x69))) + packet->payload[1] == 0x03 && + packet->payload[2] == 0x03 && + packet->payload[3] == 0x00 && + packet->payload[4] == 0x69))) { /* TCP signature of Cisco AnyConnect 0X1703030069 */ NDPI_LOG_INFO(ndpi_struct, "found CISCO Anyconnect VPN\n"); @@ -95,25 +112,26 @@ void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, stru /* This is a good query fe577e2b */ NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); - } - else if( - ( - (usport == 443 || udport == 443) - && - (packet->payload_packet_len >= 5) && - (packet->payload[0] == 0x17 && - packet->payload[1] == 0x01 && - packet->payload[2] == 0x00 && - packet->payload[3] == 0x00 && - packet->payload[4] == 0x01) - ) - ) + } else if( + ( + (usport == 443 || udport == 443) + && + (packet->payload_packet_len >= 5) && + (packet->payload[0] == 0x17 && + packet->payload[1] == 0x01 && + packet->payload[2] == 0x00 && + packet->payload[3] == 0x00 && + packet->payload[4] == 0x01) + ) + ) { NDPI_LOG_INFO(ndpi_struct, "found CISCOVPN\n"); ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); return; } + if(flow->num_processed_pkts > 10) + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); } diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index 4ae455ee1..0e3e0d413 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -197,7 +197,7 @@ static void ndpi_int_http_add_connection(struct ndpi_detection_module_struct *nd if((flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) || (http_protocol != NDPI_PROTOCOL_HTTP)) flow->guessed_host_protocol_id = http_protocol; - ndpi_int_reset_protocol(flow); + // ndpi_int_reset_protocol(flow); ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, NDPI_PROTOCOL_HTTP); /* This is necessary to inform the core to call this dissector again */ @@ -339,6 +339,11 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ flow->http.method = ndpi_http_str2method((const char*)flow->packet.http_method.ptr, flow->packet.http_method.len); } + if(packet->server_line.ptr != NULL && (packet->server_line.len > 7)) { + if(strncmp((const char *)packet->server_line.ptr, "ntopng ", 7) == 0) + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NTOP, NDPI_PROTOCOL_HTTP); + } + if(packet->user_agent_line.ptr != NULL && packet->user_agent_line.len != 0) { /** Format examples: |