diff options
| -rw-r--r-- | src/include/ndpi_protocol_ids.h | 2 | ||||
| -rw-r--r-- | src/include/ndpi_protocols.h | 2 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 9 | ||||
| -rw-r--r-- | src/lib/protocols/wireguard.c | 109 |
4 files changed, 118 insertions, 4 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index b2fdbed77..4ceb61112 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -240,7 +240,7 @@ typedef enum { NDPI_PROTOCOL_GITHUB = 203, NDPI_PROTOCOL_BJNP = 204, NDPI_PROTOCOL_LINE = 205, /* https://en.wikipedia.org/wiki/Line_(software) */ - NDPI_PROTOCOL_FREE206 = 206, /* Free */ + NDPI_PROTOCOL_WIREGUARD = 206, NDPI_PROTOCOL_SMPP = 207, /* Damir Franusic <df@release14.org> */ NDPI_PROTOCOL_DNSCRYPT = 208, NDPI_PROTOCOL_TINC = 209, /* William Guglielmo <william@deselmo.com> */ diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 96f6a898e..7991660a9 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -205,6 +205,7 @@ void ndpi_search_csgo(struct ndpi_detection_module_struct *ndpi_struct, struct n void ndpi_search_ajp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_memcached(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_nest_log_sink(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); +void ndpi_search_wireguard(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); /* --- INIT FUNCTIONS --- */ void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); @@ -365,5 +366,6 @@ void init_nest_log_sink_dissector(struct ndpi_detection_module_struct *ndpi_stru void init_ookla_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_modbus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_line_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); #endif /* __NDPI_PROTOCOLS_H__ */ diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index d1aa34b6c..266e7e816 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1006,11 +1006,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp no_master, "Line", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE206, + ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WIREGUARD, 0 /* can_have_a_subprotocol */, no_master, - no_master, "Free206", NDPI_PROTOCOL_CATEGORY_MEDIA, + no_master, "WireGuard", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, - ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_build_default_ports(ports_b, 51820, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_PPSTREAM, 0 /* can_have_a_subprotocol */, no_master, no_master, "PPStream", NDPI_PROTOCOL_CATEGORY_VIDEO, @@ -3253,6 +3253,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n /* Nest Log Sink */ init_nest_log_sink_dissector(ndpi_struct, &a, detection_bitmask); + /* WireGuard VPN */ + init_wireguard_dissector(ndpi_struct, &a, detection_bitmask); + /* ----------------------------------------------------------------- */ ndpi_struct->callback_buffer_size = a; diff --git a/src/lib/protocols/wireguard.c b/src/lib/protocols/wireguard.c new file mode 100644 index 000000000..3c8b457fd --- /dev/null +++ b/src/lib/protocols/wireguard.c @@ -0,0 +1,109 @@ +/* + * wireguard.c + * + * Copyright (C) 2019 - ntop.org + * Copyright (C) 2019 - Yağmur Oymak + * + * This file is part of nDPI, an open source deep packet inspection + * library based on the OpenDPI and PACE technology by ipoque GmbH + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_WIREGUARD + +#include "ndpi_api.h" + +/* + * TODO: Detection mechanism can be improved by taking the properties + * of specific message types into account. For example: + * - Handshake messages have a fixed size. + * - Counter field is an integer that is incremented with each packet. + * - Receiver/sender index fields. + * etc. (https://lists.zx2c4.com/pipermail/wireguard/2016-July/000185.html) + * Exploiting these properties may reduce the probability of false positives; + * with the tradeoff of requiring the inspection of multiple packets. + * + * Current approach identifies the protocol with a single packet and + * does not yield false positives in any of the existing tests. + */ + +/* + * See https://www.wireguard.com/protocol/ for protocol reference. + */ +void ndpi_search_wireguard(struct ndpi_detection_module_struct + *ndpi_struct, struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct *packet = &flow->packet; + const u_int8_t *payload = packet->payload; + /* + * The first byte of the payload is the message type. + */ + u_int8_t message_type = payload[0]; + + NDPI_LOG_DBG(ndpi_struct, "search WireGuard\n"); + /* + * A transport packet contains at minimum the following fields: + * u8 message_type + * u8 reserved_zero[3] + * u32 receiver_index + * u64 counter + * u8 encrypted_encapsulated_packet[] + * In the case of a keepalive message, the encapsulated packet will have + * zero length, but will still have a 16 byte poly1305 authentication tag. + * Thus, packet->payload will be at least 32 bytes in size. + * Note that handshake packets have a slightly different structure, but they are larger. + */ + if (packet->payload_packet_len < 32) { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + /* + * The next three bytes after the message type are reserved and set to zero. + */ + if (payload[1] != 0 || payload[2] != 0 || payload[3] != 0) { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + /* + * Message type can have one of the following values: + * 1) Handshake Initiation + * 2) Handshake Response + * 3) Cookie Reply + * 4) Transport Data + */ + if (message_type == 0 || message_type > 4) { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WIREGUARD, NDPI_PROTOCOL_UNKNOWN); + return; +} + +void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) +{ + ndpi_set_bitmask_protocol_detection("WireGuard", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_WIREGUARD, + ndpi_search_wireguard, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} + |