aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--example/ndpi_util.h28
-rw-r--r--src/lib/protocols/msn.c318
-rw-r--r--src/lib/protocols/ppstream.c14
-rw-r--r--src/lib/protocols/vmware.c38
-rw-r--r--src/lib/protocols/xbox.c19
-rw-r--r--src/lib/protocols/zeromq.c4
6 files changed, 198 insertions, 223 deletions
diff --git a/example/ndpi_util.h b/example/ndpi_util.h
index 7b1450774..8cd6fdc7a 100644
--- a/example/ndpi_util.h
+++ b/example/ndpi_util.h
@@ -69,6 +69,8 @@ typedef struct ndpi_flow_info {
void *src_id, *dst_id;
} ndpi_flow_info_t;
+
+// flow statistics info
typedef struct ndpi_stats {
u_int32_t guessed_flow_protocols;
u_int64_t raw_packet_count;
@@ -84,6 +86,8 @@ typedef struct ndpi_stats {
u_int16_t max_packet_len;
} ndpi_stats_t;
+
+// flow preferences
typedef struct ndpi_workflow_prefs {
u_int8_t decode_tunnels;
u_int8_t quiet_mode;
@@ -92,9 +96,12 @@ typedef struct ndpi_workflow_prefs {
} ndpi_workflow_prefs_t;
struct ndpi_workflow;
+
/** workflow, flow, user data */
typedef void (*ndpi_workflow_callback_ptr) (struct ndpi_workflow *, struct ndpi_flow_info *, void *);
+
+// workflow main structure
typedef struct ndpi_workflow {
u_int64_t last_time;
@@ -114,38 +121,43 @@ typedef struct ndpi_workflow {
struct ndpi_detection_module_struct *ndpi_struct;
} ndpi_workflow_t;
+
/* TODO: remove wrappers parameters and use ndpi global, when their initialization will be fixed... */
struct ndpi_workflow * ndpi_workflow_init(const struct ndpi_workflow_prefs * prefs, pcap_t * pcap_handle);
+
+// workflow main free function
void ndpi_workflow_free(struct ndpi_workflow * workflow);
+
/** Free flow_info ndpi support structures but not the flow_info itself
*
* TODO remove! Half freeing things is bad!
*/
void ndpi_free_flow_info_half(struct ndpi_flow_info *flow);
+
/** Process a @packet and update the @workflow. */
void ndpi_workflow_process_packet (struct ndpi_workflow * workflow,
const struct pcap_pkthdr *header,
const u_char *packet);
-/* flow callbacks: ndpi_flow_info will be freed right after */
-static inline void ndpi_workflow_set_flow_detected_callback(struct ndpi_workflow * workflow,
- ndpi_workflow_callback_ptr callback,
- void * udata) {
+
+/* flow callbacks for complete detected flow
+ (ndpi_flow_info will be freed right after) */
+static inline void ndpi_workflow_set_flow_detected_callback(struct ndpi_workflow * workflow, ndpi_workflow_callback_ptr callback, void * udata) {
workflow->__flow_detected_callback = callback;
workflow->__flow_detected_udata = udata;
}
-static inline void ndpi_workflow_set_flow_giveup_callback(struct ndpi_workflow * workflow,
- ndpi_workflow_callback_ptr callback,
- void * udata) {
+/* flow callbacks for sufficient detected flow
+ (ndpi_flow_info will be freed right after) */
+static inline void ndpi_workflow_set_flow_giveup_callback(struct ndpi_workflow * workflow, ndpi_workflow_callback_ptr callback, void * udata) {
workflow->__flow_giveup_callback = callback;
workflow->__flow_giveup_udata = udata;
}
+// compare two nodes in workflow
int ndpi_workflow_node_cmp(const void *a, const void *b);
-
#endif
diff --git a/src/lib/protocols/msn.c b/src/lib/protocols/msn.c
index ff81a12b3..204e2bfe6 100644
--- a/src/lib/protocols/msn.c
+++ b/src/lib/protocols/msn.c
@@ -21,15 +21,13 @@
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
-
-
#include "ndpi_api.h"
#ifdef NDPI_PROTOCOL_MSN
#define MAX_PACKETS_FOR_MSN 100
-static void ndpi_int_msn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */
- /* ndpi_protocol_type_t protocol_type */)
+
+static void ndpi_int_msn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MSN, NDPI_PROTOCOL_UNKNOWN);
}
@@ -38,11 +36,11 @@ static u_int8_t ndpi_int_find_xmsn(struct ndpi_detection_module_struct *ndpi_str
{
struct ndpi_packet_struct *packet = &flow->packet;
- if (packet->parsed_lines > 3) {
+ if(packet->parsed_lines > 3) {
u_int16_t i;
- for (i = 2; i < packet->parsed_lines; i++) {
- if (packet->line[i].ptr != NULL && packet->line[i].len > NDPI_STATICSTRING_LEN("X-MSN") &&
- memcmp(packet->line[i].ptr, "X-MSN", NDPI_STATICSTRING_LEN("X-MSN")) == 0) {
+ for(i = 2; i < packet->parsed_lines; i++) {
+ if(packet->line[i].ptr != NULL && packet->line[i].len > NDPI_STATICSTRING_LEN("X-MSN") &&
+ memcmp(packet->line[i].ptr, "X-MSN", NDPI_STATICSTRING_LEN("X-MSN")) == 0) {
return 1;
}
}
@@ -50,7 +48,7 @@ static u_int8_t ndpi_int_find_xmsn(struct ndpi_detection_module_struct *ndpi_str
return 0;
}
-
+/* search over TCP */
static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
@@ -60,34 +58,35 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
u_int16_t plen;
u_int16_t status = 0;
-
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp detection...\n");
#ifdef NDPI_PROTOCOL_SSL
- if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) {
+ if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "msn ssl ft test\n");
- if (flow->packet_counter < 10) {
- }
- if (flow->packet_counter == 7 && packet->payload_packet_len > 300) {
- if (memcmp(packet->payload + 24, "MSNSLP", 6) == 0
- || (get_u_int32_t(packet->payload, 0) == htonl(0x30000000) && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "detected MSN File Transfer, ifdef ssl.\n");
- ndpi_int_msn_add_connection(ndpi_struct, flow);
- return;
+ if(flow->packet_counter < 10) {
+ if(flow->packet_counter == 7 && packet->payload_packet_len > 300) {
+ if(memcmp(packet->payload + 24, "MSNSLP", 6) == 0
+ || (get_u_int32_t(packet->payload, 0) == htonl(0x30000000) && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "detected MSN File Transfer, ifdef ssl.\n");
+ ndpi_int_msn_add_connection(ndpi_struct, flow);
+ return;
+ }
}
- }
- if (flow->packet_counter >= 5 && flow->packet_counter <= 10 && (get_u_int32_t(packet->payload, 0) == htonl(0x18000000)
- && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
- flow->l4.tcp.msn_ssl_ft++;
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "increased msn ft ssl stage to: %u at packet nr: %u\n", flow->l4.tcp.msn_ssl_ft,
- flow->packet_counter);
- if (flow->l4.tcp.msn_ssl_ft == 2) {
+ if(flow->packet_counter >= 5 && flow->packet_counter <= 10 && (get_u_int32_t(packet->payload, 0) == htonl(0x18000000)
+ && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
+ flow->l4.tcp.msn_ssl_ft++;
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "detected MSN File Transfer, ifdef ssl 2.\n");
- ndpi_int_msn_add_connection(ndpi_struct, flow);
+ "increased msn ft ssl stage to: %u at packet nr: %u\n", flow->l4.tcp.msn_ssl_ft,
+ flow->packet_counter);
+ if (flow->l4.tcp.msn_ssl_ft == 2) {
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
+ "detected MSN File Transfer, ifdef ssl 2.\n");
+ ndpi_int_msn_add_connection(ndpi_struct, flow);
+ }
+ return;
}
- return;
}
}
#endif
@@ -98,25 +97,25 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
* x is now "0", but can be increased
*/
/* now we have a look at the first packet only. */
- if (flow->packet_counter == 1
+ if(flow->packet_counter == 1
#ifdef NDPI_PROTOCOL_SSL
|| ((packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) && flow->packet_counter <= 3)
#endif
) {
-
+
/* this part is working asymmetrically */
- if (packet->payload_packet_len > 32 && (packet->payload[0] == 0x02 || packet->payload[0] == 0x00)
- && (ntohl(get_u_int32_t(packet->payload, 8)) == 0x2112a442 || ntohl(get_u_int32_t(packet->payload, 4)) == 0x2112a442)
- && ((ntohl(get_u_int32_t(packet->payload, 24)) == 0x000f0004 && ntohl(get_u_int32_t(packet->payload, 28)) == 0x72c64bc6)
- || (ntohl(get_u_int32_t(packet->payload, 20)) == 0x000f0004
- && ntohl(get_u_int32_t(packet->payload, 24)) == 0x72c64bc6))) {
+ if(packet->payload_packet_len > 32 && (packet->payload[0] == 0x02 || packet->payload[0] == 0x00)
+ && (ntohl(get_u_int32_t(packet->payload, 8)) == 0x2112a442 || ntohl(get_u_int32_t(packet->payload, 4)) == 0x2112a442)
+ && ((ntohl(get_u_int32_t(packet->payload, 24)) == 0x000f0004 && ntohl(get_u_int32_t(packet->payload, 28)) == 0x72c64bc6)
+ || (ntohl(get_u_int32_t(packet->payload, 20)) == 0x000f0004
+ && ntohl(get_u_int32_t(packet->payload, 24)) == 0x72c64bc6))) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found MSN in packets that also contain voice.messenger.live.com.\n");
/* TODO this is an alternative pattern for video detection */
/* if (packet->payload_packet_len > 100 &&
get_u_int16_t(packet->payload, 86) == htons(0x05dc)) { */
- if (packet->payload_packet_len > 101 && packet->payload[101] == 0x02) {
+ if(packet->payload_packet_len > 101 && packet->payload[101] == 0x02) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
} else {
ndpi_int_msn_add_connection(ndpi_struct, flow);
@@ -148,13 +147,12 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
}
-
- if (
+ if(
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "GET ") ||
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "POST ")) {
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "GET ") ||
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "POST ")) {
ndpi_parse_packet_line_info(ndpi_struct, flow);
if (packet->user_agent_line.ptr != NULL &&
packet->user_agent_line.len > NDPI_STATICSTRING_LEN("Messenger/") &&
@@ -163,29 +161,29 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
return;
}
}
-#ifdef NDPI_PROTOCOL_HTTP
- /* we have to examine two http packets */
- if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) {
- }
-#endif
+/* #ifdef NDPI_PROTOCOL_HTTP */
+/* /\* we have to examine two http packets *\/ */
+/* if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) { */
+/* } */
+/* #endif */
/* not seen this pattern in any trace */
/* now test for http login, at least 100 a bytes packet */
- if (packet->payload_packet_len > 100) {
- if (
+ if(packet->payload_packet_len > 100) {
+ if(
#ifdef NDPI_PROTOCOL_HTTP
packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
memcmp(packet->payload, "POST http://", 12) == 0) {
/* scan packet if not already done... */
ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- if (packet->content_line.ptr != NULL &&
- ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
- memcmp(packet->content_line.ptr, "application/x-msn-messenger",
- NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
- (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
- memcmp(packet->content_line.ptr, "text/x-msnmsgr",
- NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+
+ if(packet->content_line.ptr != NULL &&
+ ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
+ memcmp(packet->content_line.ptr, "application/x-msn-messenger",
+ NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
+ (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
+ memcmp(packet->content_line.ptr, "text/x-msnmsgr",
+ NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found MSN by pattern POST http:// .... application/x-msn-messenger.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
@@ -193,25 +191,24 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
}
-
/* now test for http login that uses a gateway, at least 400 a bytes packet */
/* for this case the asymmetric detection is asym (1) */
- if (packet->payload_packet_len > 400) {
- if ((
+ if(packet->payload_packet_len > 400) {
+ if((
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- (memcmp(packet->payload, "POST ", 5) == 0))) {
+ (memcmp(packet->payload, "POST ", 5) == 0))) {
u_int16_t c;
- if (memcmp(&packet->payload[5], "http://", 7) == 0) {
+ if(memcmp(&packet->payload[5], "http://", 7) == 0) {
/*
- * We are searching for a paten "POST http://gateway.messenger.hotmail.com/gateway/gateway.dll" or
+ * We are searching for a pattern "POST http://gateway.messenger.hotmail.com/gateway/gateway.dll" or
* "POST http://<some ip addres here like 172.0.0.0>/gateway/gateway.dll"
* POST http:// is 12 byte so we are searching for 13 to 70 byte for this paten.
*/
- for (c = 13; c < 50; c++) {
- if (memcmp(&packet->payload[c], "/", 1) == 0) {
- if (memcmp(&packet->payload[c], "/gateway/gateway.dll", 20) == 0) {
+ for(c = 13; c < 50; c++) {
+ if(memcmp(&packet->payload[c], "/", 1) == 0) {
+ if(memcmp(&packet->payload[c], "/gateway/gateway.dll", 20) == 0) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found pattern http://.../gateway/gateway.ddl.\n");
status = 1;
@@ -219,44 +216,38 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
}
- } else if ((memcmp(&packet->payload[5], "/gateway/gateway.dll", 20) == 0)) {
+ } else if((memcmp(&packet->payload[5], "/gateway/gateway.dll", 20) == 0)) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found pattern http://.../gateway/gateway.ddl.\n");
status = 1;
}
}
- if (status) {
+ if(status) {
u_int16_t a;
-
+
ndpi_parse_packet_line_info(ndpi_struct, flow);
- if (packet->content_line.ptr != NULL
- &&
- ((packet->content_line.len == 23
- && memcmp(packet->content_line.ptr, "text/xml; charset=utf-8", 23) == 0)
- ||
- (packet->content_line.len == 24
- && memcmp(packet->content_line.ptr, "text/html; charset=utf-8", 24) == 0)
- ||
- (packet->content_line.len == 33
- && memcmp(packet->content_line.ptr, "application/x-www-form-urlencoded", 33) == 0)
- )) {
- if ((src != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN)
- != 0) || (dst != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask,
- NDPI_PROTOCOL_MSN)
- != 0)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN with pattern text/xml; charset=utf-8.\n");
+ if(packet->content_line.ptr != NULL && ((packet->content_line.len == 23
+ && memcmp(packet->content_line.ptr, "text/xml; charset=utf-8", 23) == 0)
+ ||
+ (packet->content_line.len == 24
+ && memcmp(packet->content_line.ptr, "text/html; charset=utf-8", 24) == 0)
+ ||
+ (packet->content_line.len == 33
+ && memcmp(packet->content_line.ptr, "application/x-www-form-urlencoded", 33) == 0))) {
+
+ if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
+ || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
+
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern text/xml; charset=utf-8.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
- for (a = 0; a < packet->parsed_lines; a++) {
- if (packet->line[a].len >= 4 &&
- (memcmp(packet->line[a].ptr, "CVR ", 4) == 0
- || memcmp(packet->line[a].ptr, "VER ",
- 4) == 0 || memcmp(packet->line[a].ptr, "ANS ", 4) == 0)) {
+ for(a = 0; a < packet->parsed_lines; a++) {
+ if(packet->line[a].len >= 4 && (memcmp(packet->line[a].ptr, "CVR ", 4) == 0
+ || memcmp(packet->line[a].ptr, "VER ", 4) == 0 ||
+ memcmp(packet->line[a].ptr, "ANS ", 4) == 0)) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found MSN with pattern text/sml; charset0utf-8.\n");
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct,
@@ -269,52 +260,47 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
/* asym (1) ; possibly occurs in symmetric cases also. */
- if (flow->packet_counter <= 10 &&
- (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2)
- && packet->payload_packet_len > 100) {
+ if(flow->packet_counter <= 10 &&
+ (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2)
+ && packet->payload_packet_len > 100) {
/* not necessary to check the length, because this has been done : >400. */
- if (
+ if(
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.0 200 OK") ||
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.1 200 OK")
- ) {
-
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.0 200 OK") ||
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.1 200 OK")
+ ) {
+
ndpi_parse_packet_line_info(ndpi_struct, flow);
- if (packet->content_line.ptr != NULL &&
+ if(packet->content_line.ptr != NULL &&
((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
- memcmp(packet->content_line.ptr, "application/x-msn-messenger",
- NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
+ memcmp(packet->content_line.ptr, "application/x-msn-messenger", NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
(packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
- memcmp(packet->content_line.ptr, "text/x-msnmsgr",
- NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+ memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
- if (ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
+ if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
}
-
-
- /* did not find any trace with this pattern !!!!! */
+ /* did not find any trace with this pattern */
/* now block proxy connection */
- if (packet->payload_packet_len >= 42) {
- if (memcmp(packet->payload, "CONNECT messenger.hotmail.com:1863 HTTP/1.", 42) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN with pattern CONNECT messenger.hotmail.com:1863 HTTP/1..\n");
+ if(packet->payload_packet_len >= 42) {
+ if(memcmp(packet->payload, "CONNECT messenger.hotmail.com:1863 HTTP/1.", 42) == 0) {
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern CONNECT messenger.hotmail.com:1863 HTTP/1..\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
-
if (packet->payload_packet_len >= 18) {
if (memcmp(packet->payload, "USR ", 4) == 0 || memcmp(packet->payload, "ANS ", 4) == 0) {
@@ -347,59 +333,52 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
if (plen >= endlen) {
goto ndpi_msn_exclude;
}
-
}
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN with pattern USR/ANS ...mail_address.\n");
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern USR/ANS ...mail_address.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
}
-
/* finished examining the first packet only. */
-
/* asym (1) ; possibly occurs in symmetric cases also. */
- if (flow->packet_counter <= 10 &&
+ if(flow->packet_counter <= 10 &&
(flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2) &&
packet->payload_packet_len > 100) {
/* not necessary to check the length, because this has been done : >400. */
- if (
+ if(
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- (memcmp(packet->payload, "HTTP/1.0 200 OK", 15) == 0) ||
- (memcmp(packet->payload, "HTTP/1.1 200 OK", 15) == 0)
- ) {
-
+ (memcmp(packet->payload, "HTTP/1.0 200 OK", 15) == 0) ||
+ (memcmp(packet->payload, "HTTP/1.1 200 OK", 15) == 0)) {
+
ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- if (packet->content_line.ptr != NULL &&
- ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
- memcmp(packet->content_line.ptr, "application/x-msn-messenger",
- NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
- (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
- memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
+
+ if(packet->content_line.ptr != NULL && ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
+ memcmp(packet->content_line.ptr, "application/x-msn-messenger",
+ NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
+ (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
+ memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
- if (ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
+ if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
}
-
/* finished examining the secone packet only */
/* direct user connection (file transfer,...) */
-
- if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
- || (dst != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
+
+ if((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
+ || (dst != NULL
+ && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
if (flow->packet_counter == 1 &&
packet->payload_packet_len > 12 && memcmp(packet->payload, "recipientid=", 12) == 0) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "detected file transfer.\n");
@@ -407,23 +386,22 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
return;
}
}
-
/* MSN File Transfer of MSN 8.1 and 8.5
* first packet with length 4 and pattern 0x04000000
* second packet (in the same direction), with length 56 and pattern 0x00000000 from payload[16]
* third packet (in the opposite direction to 1 & 2), with length 4 and pattern 0x30000000
*/
- if (flow->l4.tcp.msn_stage == 0) {
+ if(flow->l4.tcp.msn_stage == 0) {
/* asymmetric detection to this pattern is asym (2) */
- if ((packet->payload_packet_len == 4 || packet->payload_packet_len == 8)
- && get_u_int32_t(packet->payload, 0) == htonl(0x04000000)) {
+ if((packet->payload_packet_len == 4 || packet->payload_packet_len == 8)
+ && get_u_int32_t(packet->payload, 0) == htonl(0x04000000)) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "maybe first TCP MSN detected\n");
-
- if (packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 4) == htonl(0x666f6f00)) {
+
+ if(packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 4) == htonl(0x666f6f00)) {
flow->l4.tcp.msn_stage = 5 + packet->packet_direction;
return;
}
-
flow->l4.tcp.msn_stage = 1 + packet->packet_direction;
return;
}
@@ -469,10 +447,11 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "msn 7.\n");
+
if (flow->packet_counter <= MAX_PACKETS_FOR_MSN) {
- if (packet->tcp->source == htons(443)
- || packet->tcp->dest == htons(443)) {
+ if (packet->tcp->source == htons(443) || packet->tcp->dest == htons(443)) {
if (packet->payload_packet_len > 300) {
+
if (memcmp(&packet->payload[40], "INVITE MSNMSGR", 14) == 0
|| memcmp(&packet->payload[56], "INVITE MSNMSGR", 14) == 0
|| memcmp(&packet->payload[172], "INVITE MSNMSGR", 14) == 0) {
@@ -484,17 +463,15 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
return;
}
- /* For no
- n port 443 flows exclude flow bitmask after first packet itself */
+ /* For non port 443 flows exclude flow bitmask after first packet itself */
}
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp excluded.\n");
ndpi_msn_exclude:
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN);
}
-
-
-static void ndpi_search_udp_msn_misc(struct ndpi_detection_module_struct
+/* search over UDP */
+static void ndpi_search_msn_udp_misc(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
@@ -530,27 +507,26 @@ void ndpi_search_msn(struct ndpi_detection_module_struct *ndpi_struct, struct nd
struct ndpi_packet_struct *packet = &flow->packet;
/* this if request should always be true */
- if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) {
+ if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) {
/* we deal with tcp now */
- if (packet->tcp != NULL) {
+ if(packet->tcp != NULL) {
/* msn can use http or ssl for connection. That's why every http, ssl and ukn packet must enter in the msn detection */
/* the detection can swich out the http or the ssl detection. In this case we need not check those protocols */
// need to do the ceck when protocol == http too (POST /gateway ...)
- if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN
-#if defined(NDPI_PROTOCOL_HTTP)
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP
+ if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN
+#ifdef NDPI_PROTOCOL_HTTP
+ || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP
#endif
-#if defined(NDPI_PROTOCOL_SSL)
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL
+#ifdef NDPI_PROTOCOL_SSL
+ || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL
#endif
-#if defined(NDPI_PROTOCOL_STUN)
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
+#ifdef NDPI_PROTOCOL_STUN
+ || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
#endif
- ) {
+ )
ndpi_search_msn_tcp(ndpi_struct, flow);
- }
} else if (packet->udp != NULL) {
- ndpi_search_udp_msn_misc(ndpi_struct, flow);
+ ndpi_search_msn_udp_misc(ndpi_struct, flow);
}
}
}
diff --git a/src/lib/protocols/ppstream.c b/src/lib/protocols/ppstream.c
index d60966798..f3323697b 100644
--- a/src/lib/protocols/ppstream.c
+++ b/src/lib/protocols/ppstream.c
@@ -1,8 +1,7 @@
/*
* ppstream.c
*
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2016 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -21,9 +20,8 @@
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
-
-
#include "ndpi_protocols.h"
+
#ifdef NDPI_PROTOCOL_PPSTREAM
static void ndpi_int_ppstream_add_connection(struct ndpi_detection_module_struct
@@ -36,13 +34,7 @@ void ndpi_search_ppstream(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
-
-
- // struct ndpi_id_struct *src=ndpi_struct->src;
- // struct ndpi_id_struct *dst=ndpi_struct->dst;
-
-
-
+
/* check TCP Connections -> Videodata */
if (packet->tcp != NULL) {
if (packet->payload_packet_len >= 60 && get_u_int32_t(packet->payload, 52) == 0
diff --git a/src/lib/protocols/vmware.c b/src/lib/protocols/vmware.c
index 9ef3ccd2f..e5421b946 100644
--- a/src/lib/protocols/vmware.c
+++ b/src/lib/protocols/vmware.c
@@ -27,30 +27,30 @@ void ndpi_search_vmware(struct ndpi_detection_module_struct *ndpi_struct, struct
struct ndpi_packet_struct *packet = &flow->packet;
/* Check whether this is an VMWARE flow */
- if(packet->udp != NULL) {
- if((packet->payload_packet_len == 66)
- && (ntohs(packet->udp->dest) == 902)
- && ((packet->payload[0] & 0xFF) == 0xA4)) {
+ if(packet->udp != NULL){
+ if((packet->payload_packet_len == 66) &&
+ (ntohs(packet->udp->dest) == 902) &&
+ ((packet->payload[0] & 0xFF) == 0xA4)){
+
NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "Found vmware.\n");
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VMWARE, NDPI_PROTOCOL_UNKNOWN);
- }
- else {
- NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "exclude vmware.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VMWARE);
+ return;
}
}
+ NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "exclude vmware.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VMWARE);
}
- void init_vmware_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
- {
- ndpi_set_bitmask_protocol_detection("VMWARE", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_VMWARE,
- ndpi_search_vmware,
- NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
-
- *id += 1;
- }
+void init_vmware_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("VMWARE", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_VMWARE,
+ ndpi_search_vmware,
+ NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
#endif
diff --git a/src/lib/protocols/xbox.c b/src/lib/protocols/xbox.c
index 7fad5ced9..92f68fc34 100644
--- a/src/lib/protocols/xbox.c
+++ b/src/lib/protocols/xbox.c
@@ -1,8 +1,7 @@
/*
* xbox.c
*
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2016 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -22,8 +21,8 @@
*
*/
-
#include "ndpi_protocols.h"
+
#ifdef NDPI_PROTOCOL_XBOX
static void ndpi_int_xbox_add_connection(struct ndpi_detection_module_struct
@@ -41,13 +40,11 @@ void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct n
// struct ndpi_id_struct *dst = flow->dst;
/*
- * THIS IS TH XBOX UDP DETCTION ONLY !!!
- * the xbox tcp detection is done by http code
+ * XBOX UDP DETCTION ONLY
+ * the xbox TCP detection is done by http code
+ * this detection also works for asymmetric xbox udp traffic
*/
-
-
- /* this detection also works for asymmetric xbox udp traffic */
- if (packet->udp != NULL) {
+ if(packet->udp != NULL) {
u_int16_t dport = ntohs(packet->udp->dest);
u_int16_t sport = ntohs(packet->udp->source);
@@ -88,11 +85,9 @@ void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct n
}
/* exclude here all non matched udp traffic, exclude here tcp only if http has been excluded, because xbox could use http */
- if (packet->tcp == NULL
#ifdef NDPI_PROTOCOL_HTTP
- || NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0
+ if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) {
#endif
- ) {
NDPI_LOG(NDPI_PROTOCOL_XBOX, ndpi_struct, NDPI_LOG_DEBUG, "xbox udp excluded.\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_XBOX);
}
diff --git a/src/lib/protocols/zeromq.c b/src/lib/protocols/zeromq.c
index f4780b334..f069bba09 100644
--- a/src/lib/protocols/zeromq.c
+++ b/src/lib/protocols/zeromq.c
@@ -88,8 +88,8 @@ void ndpi_search_zmq(struct ndpi_detection_module_struct *ndpi_struct, struct nd
NDPI_LOG(NDPI_PROTOCOL_ZMQ, ndpi_struct, NDPI_LOG_TRACE, "ZMQ detection...\n");
/* skip marked packets */
- if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_ZMQ) {
- if (packet->tcp_retransmission == 0) {
+ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_ZMQ) {
+ if(packet->tcp && packet->tcp_retransmission == 0) {
ndpi_check_zmq(ndpi_struct, flow);
}
}
Powered by cgit, Themed by Ted Yin.