aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/include/ndpi_protocol_ids.h4
-rw-r--r--src/include/ndpi_protocols.h2
-rw-r--r--src/lib/ndpi_main.c24
-rw-r--r--src/lib/protocols/stun.c5
-rw-r--r--src/lib/protocols/tls.c13
-rw-r--r--src/lib/protocols/wsd.c (renamed from src/lib/protocols/upnp.c)28
-rw-r--r--tests/result/dtls.pcap.out4
-rw-r--r--tests/result/upnp.pcap.out6
8 files changed, 43 insertions, 43 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 3371ca071..61490b844 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -59,7 +59,7 @@ typedef enum {
NDPI_PROTOCOL_COAP = 27,
NDPI_PROTOCOL_VMWARE = 28,
NDPI_PROTOCOL_MAIL_SMTPS = 29,
- NDPI_PROTOCOL_FREE_30 = 30, /* Free */
+ NDPI_PROTOCOL_DTLS = 30,
NDPI_PROTOCOL_UBNTAC2 = 31, /* Ubiquity UBNT AirControl = 2 - Thomas Fjellstrom <thomas+ndpi@fjellstrom.ca> */
NDPI_PROTOCOL_KONTIKI = 32,
NDPI_PROTOCOL_OPENFT = 33,
@@ -182,7 +182,7 @@ typedef enum {
NDPI_PROTOCOL_LOTUS_NOTES = 150,
NDPI_PROTOCOL_SAP = 151,
NDPI_PROTOCOL_GTP = 152,
- NDPI_PROTOCOL_UPNP = 153,
+ NDPI_PROTOCOL_WSD = 153,
NDPI_PROTOCOL_LLMNR = 154,
NDPI_PROTOCOL_REMOTE_SCAN = 155,
NDPI_PROTOCOL_SPOTIFY = 156,
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 6683ccec4..3bff4bcbc 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -162,7 +162,7 @@ void init_thunder_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_
void init_tor_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_tvuplayer_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_usenet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
-void init_upnp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_wsd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_veohtv_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_vhua_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_viber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 02d2d5ed8..45caa56ce 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -787,10 +787,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, no_master, "VMware", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS,
ndpi_build_default_ports(ports_a, 903, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 902, 903, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_FREE_30, 0 /* can_have_a_subprotocol */,
- no_master, no_master, "FREE_30", NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK,
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_KONTIKI,
0 /* can_have_a_subprotocol */, no_master, no_master, "Kontiki",
NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
@@ -1064,6 +1060,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "TLS", NDPI_PROTOCOL_CATEGORY_WEB,
ndpi_build_default_ports(ports_a, 443, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DTLS, 1 /* can_have_a_subprotocol */, no_master,
+ no_master, "DTLS", NDPI_PROTOCOL_CATEGORY_WEB,
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SSH, 0 /* can_have_a_subprotocol */,
no_master, no_master, "SSH", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS,
ndpi_build_default_ports(ports_a, 22, 0, 0, 0, 0) /* TCP */,
@@ -1216,18 +1216,17 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
NDPI_PROTOCOL_CATEGORY_COLLABORATIVE,
ndpi_build_default_ports(ports_a, 1352, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(
- ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SAP, 0 /* can_have_a_subprotocol */, no_master, no_master,
+ ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SAP, 0 /* can_have_a_subprotocol */, no_master, no_master,
"SAP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 3201, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */
ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_GTP, 0 /* can_have_a_subprotocol */,
no_master, no_master, "GTP", NDPI_PROTOCOL_CATEGORY_NETWORK,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 2152, 2123, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_UPNP, 0 /* can_have_a_subprotocol */,
- no_master, no_master, "UPnP", NDPI_PROTOCOL_CATEGORY_NETWORK,
- ndpi_build_default_ports(ports_a, 1780, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 1900, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WSD, 0 /* can_have_a_subprotocol */,
+ no_master, no_master, "WSD", NDPI_PROTOCOL_CATEGORY_NETWORK,
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 3702, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TELEGRAM, 0 /* can_have_a_subprotocol */,
no_master, no_master, "Telegram", NDPI_PROTOCOL_CATEGORY_CHAT,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
@@ -2897,7 +2896,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* STARCRAFT */
init_starcraft_dissector(ndpi_str, &a, detection_bitmask);
- /* TLS */
+ /* TLS+DTLS */
init_tls_dissector(ndpi_str, &a, detection_bitmask);
/* STUN */
@@ -3215,9 +3214,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* REDIS */
init_redis_dissector(ndpi_str, &a, detection_bitmask);
- /* UPnP */
- init_upnp_dissector(ndpi_str, &a, detection_bitmask);
-
/* VHUA */
init_vhua_dissector(ndpi_str, &a, detection_bitmask);
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index cc1836a9b..cf7a4d0a4 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -202,9 +202,8 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
total_len = ntohs(*((u_int16_t*) &packet->payload[11])) + 13;
if(payload_length == total_len) {
- /* This is DTLS and the only protocol we know behaves like this is signal */
- flow->guessed_host_protocol_id = NDPI_PROTOCOL_SIGNAL;
- return(NDPI_IS_STUN);
+ flow->guessed_host_protocol_id = NDPI_PROTOCOL_DTLS;
+ return(NDPI_IS_NOT_STUN);
}
}
}
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 1e2027712..9933ca8b2 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -858,7 +858,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct,
// handshake_type = packet->payload[13];
handshake_len = (packet->payload[14] << 16) + (packet->payload[15] << 8) + packet->payload[16];
-
+
if((handshake_len+25) != packet->payload_packet_len)
goto no_dtls;
@@ -871,7 +871,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct,
packet->payload = p;
packet->payload_packet_len = p_len; /* Restore */
- ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS);
+ ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DTLS);
return(1); /* Keep working */
}
@@ -895,6 +895,9 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
printf("[TLS] %s()\n", __FUNCTION__);
#endif
+ if((flow->packet.udp != NULL) && (protocol == NDPI_PROTOCOL_TLS))
+ protocol = NDPI_PROTOCOL_DTLS;
+
if((flow->detected_protocol_stack[0] == protocol)
|| (flow->detected_protocol_stack[1] == protocol)) {
if(!flow->check_extra_packets)
@@ -907,7 +910,7 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
else
protocol = ndpi_tls_refine_master_protocol(ndpi_struct, flow, protocol);
- ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_TLS);
+ ndpi_set_detected_protocol(ndpi_struct, flow, protocol, protocol);
tlsInitExtraPacketProcessing(ndpi_struct, flow);
}
@@ -1637,8 +1640,8 @@ void init_tls_dissector(struct ndpi_detection_module_struct *ndpi_struct,
/* *************************************************** */
- ndpi_set_bitmask_protocol_detection("TLS", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_TLS,
+ ndpi_set_bitmask_protocol_detection("DTLS", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_DTLS,
ndpi_search_tls_wrapper,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
diff --git a/src/lib/protocols/upnp.c b/src/lib/protocols/wsd.c
index 1706d021d..8732675b1 100644
--- a/src/lib/protocols/upnp.c
+++ b/src/lib/protocols/wsd.c
@@ -1,7 +1,7 @@
/*
- * upnp.c
+ * wsd.c
*
- * Copyright (C) 2018 - ntop.org
+ * Copyright (C) 2018-21 - ntop.org
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
@@ -18,19 +18,21 @@
*
*/
+/* https://en.wikipedia.org/wiki/WS-Discovery */
+
#include "ndpi_protocol_ids.h"
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_UPNP
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_WSD
#include "ndpi_api.h"
-#define UPNP_PORT 3702
+#define WSD_PORT 3702
-void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct,
+void ndpi_search_wsd(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &flow->packet;
- NDPI_LOG_DBG(ndpi_struct, "search upnp\n");
+ NDPI_LOG_DBG(ndpi_struct, "search wsd\n");
if(packet->udp
&& (
@@ -40,23 +42,23 @@ void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct,
(packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000)
#endif
)
- && (ntohs(packet->udp->dest) == UPNP_PORT)
+ && (ntohs(packet->udp->dest) == WSD_PORT)
&& (packet->payload_packet_len >= 40)
&& (strncmp((char*)packet->payload, "<?xml", 5) == 0)
) {
NDPI_LOG_INFO(ndpi_struct,"found teredo\n");
- ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UPNP, NDPI_PROTOCOL_UNKNOWN);
+ ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WSD, NDPI_PROTOCOL_UNKNOWN);
} else {
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}
}
-void init_upnp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
- NDPI_PROTOCOL_BITMASK *detection_bitmask) {
- ndpi_set_bitmask_protocol_detection("UPNP", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_UPNP,
- ndpi_search_upnp,
+void init_wsd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+ ndpi_set_bitmask_protocol_detection("WSD", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_WSD,
+ ndpi_search_wsd,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
ADD_TO_DETECTION_BITMASK);
diff --git a/tests/result/dtls.pcap.out b/tests/result/dtls.pcap.out
index da2f424d2..46ffe4e71 100644
--- a/tests/result/dtls.pcap.out
+++ b/tests/result/dtls.pcap.out
@@ -1,8 +1,8 @@
-TLS 2 394 1
+DTLS 2 394 1
JA3 Host Stats:
IP Address # JA3C
1 192.168.13.203 1
- 1 UDP 192.168.13.203:40739 -> 192.168.13.57:56515 [proto: 91/TLS][cat: Web/5][2 pkts/394 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][< 1 sec][Risk: ** TLS (probably) not carrying HTTPS **** SNI TLS extension was missing **][DTLSv1.2][JA3C: bd743610892cec1efed851b2b5efd4f5][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 1 UDP 192.168.13.203:40739 -> 192.168.13.57:56515 [proto: 30/DTLS][cat: Web/5][2 pkts/394 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][< 1 sec][Risk: ** TLS (probably) not carrying HTTPS **** SNI TLS extension was missing **][DTLSv1.2][JA3C: bd743610892cec1efed851b2b5efd4f5][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
diff --git a/tests/result/upnp.pcap.out b/tests/result/upnp.pcap.out
index 247e2bde3..3de068ef8 100644
--- a/tests/result/upnp.pcap.out
+++ b/tests/result/upnp.pcap.out
@@ -1,4 +1,4 @@
-UPnP 14 9912 2
+WSD 14 9912 2
- 1 UDP [fe80::3441:3d24:6d30:a807]:58932 -> [ff02::c]:3702 [proto: 153/UPnP][cat: Network/14][7 pkts/5026 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][5.63 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 118/0 938/0 2000/0 752/0][Pkt Len c2s/s2c min/avg/max/stddev: 718/0 718/0 718/0 0/0][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
- 2 UDP 192.168.61.66:58931 -> 239.255.255.250:3702 [proto: 153/UPnP][cat: Network/14][7 pkts/4886 bytes -> 0 pkts/0 bytes][Goodput ratio: 94/0][6.64 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 179/0 1107/0 2004/0 740/0][Pkt Len c2s/s2c min/avg/max/stddev: 698/0 698/0 698/0 0/0][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 1 UDP [fe80::3441:3d24:6d30:a807]:58932 -> [ff02::c]:3702 [proto: 153/WSD][cat: Network/14][7 pkts/5026 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][5.63 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 118/0 938/0 2000/0 752/0][Pkt Len c2s/s2c min/avg/max/stddev: 718/0 718/0 718/0 0/0][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+ 2 UDP 192.168.61.66:58931 -> 239.255.255.250:3702 [proto: 153/WSD][cat: Network/14][7 pkts/4886 bytes -> 0 pkts/0 bytes][Goodput ratio: 94/0][6.64 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 179/0 1107/0 2004/0 740/0][Pkt Len c2s/s2c min/avg/max/stddev: 698/0 698/0 698/0 0/0][PLAIN TEXT (xml version)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
Powered by cgit, Themed by Ted Yin.