aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--example/ndpi_util.h28
-rw-r--r--src/include/ndpi_protocol_ids.h9
-rw-r--r--src/include/ndpi_protocols.h2
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_main.c8
-rw-r--r--src/lib/protocols/imesh.c308
-rw-r--r--src/lib/protocols/msn.c318
-rw-r--r--src/lib/protocols/ppstream.c14
-rw-r--r--src/lib/protocols/vmware.c38
-rw-r--r--src/lib/protocols/vnc.c63
-rw-r--r--src/lib/protocols/xbox.c19
-rw-r--r--src/lib/protocols/zeromq.c4
-rw-r--r--tests/pcap/vnc.pcapbin0 -> 486664 bytes
-rw-r--r--tests/result/hangout.pcap.out2
-rw-r--r--tests/result/http_ipv6.pcap.out8
-rw-r--r--tests/result/mpeg.pcap.out2
-rw-r--r--tests/result/vnc.pcap.out4
17 files changed, 242 insertions, 586 deletions
diff --git a/example/ndpi_util.h b/example/ndpi_util.h
index 7b1450774..8cd6fdc7a 100644
--- a/example/ndpi_util.h
+++ b/example/ndpi_util.h
@@ -69,6 +69,8 @@ typedef struct ndpi_flow_info {
void *src_id, *dst_id;
} ndpi_flow_info_t;
+
+// flow statistics info
typedef struct ndpi_stats {
u_int32_t guessed_flow_protocols;
u_int64_t raw_packet_count;
@@ -84,6 +86,8 @@ typedef struct ndpi_stats {
u_int16_t max_packet_len;
} ndpi_stats_t;
+
+// flow preferences
typedef struct ndpi_workflow_prefs {
u_int8_t decode_tunnels;
u_int8_t quiet_mode;
@@ -92,9 +96,12 @@ typedef struct ndpi_workflow_prefs {
} ndpi_workflow_prefs_t;
struct ndpi_workflow;
+
/** workflow, flow, user data */
typedef void (*ndpi_workflow_callback_ptr) (struct ndpi_workflow *, struct ndpi_flow_info *, void *);
+
+// workflow main structure
typedef struct ndpi_workflow {
u_int64_t last_time;
@@ -114,38 +121,43 @@ typedef struct ndpi_workflow {
struct ndpi_detection_module_struct *ndpi_struct;
} ndpi_workflow_t;
+
/* TODO: remove wrappers parameters and use ndpi global, when their initialization will be fixed... */
struct ndpi_workflow * ndpi_workflow_init(const struct ndpi_workflow_prefs * prefs, pcap_t * pcap_handle);
+
+// workflow main free function
void ndpi_workflow_free(struct ndpi_workflow * workflow);
+
/** Free flow_info ndpi support structures but not the flow_info itself
*
* TODO remove! Half freeing things is bad!
*/
void ndpi_free_flow_info_half(struct ndpi_flow_info *flow);
+
/** Process a @packet and update the @workflow. */
void ndpi_workflow_process_packet (struct ndpi_workflow * workflow,
const struct pcap_pkthdr *header,
const u_char *packet);
-/* flow callbacks: ndpi_flow_info will be freed right after */
-static inline void ndpi_workflow_set_flow_detected_callback(struct ndpi_workflow * workflow,
- ndpi_workflow_callback_ptr callback,
- void * udata) {
+
+/* flow callbacks for complete detected flow
+ (ndpi_flow_info will be freed right after) */
+static inline void ndpi_workflow_set_flow_detected_callback(struct ndpi_workflow * workflow, ndpi_workflow_callback_ptr callback, void * udata) {
workflow->__flow_detected_callback = callback;
workflow->__flow_detected_udata = udata;
}
-static inline void ndpi_workflow_set_flow_giveup_callback(struct ndpi_workflow * workflow,
- ndpi_workflow_callback_ptr callback,
- void * udata) {
+/* flow callbacks for sufficient detected flow
+ (ndpi_flow_info will be freed right after) */
+static inline void ndpi_workflow_set_flow_giveup_callback(struct ndpi_workflow * workflow, ndpi_workflow_callback_ptr callback, void * udata) {
workflow->__flow_giveup_callback = callback;
workflow->__flow_giveup_udata = udata;
}
+// compare two nodes in workflow
int ndpi_workflow_node_cmp(const void *a, const void *b);
-
#endif
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index ff0b1735e..75a015370 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -54,7 +54,6 @@
#define NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC 110
#define NDPI_PROTOCOL_HTTP_CONNECT 130
#define NDPI_PROTOCOL_HTTP_PROXY 131
-#define NDPI_PROTOCOL_SOCKS 172 /* Tomasz Bujlow <tomasz@skatnet.dk> */
#define NDPI_PROTOCOL_FTP_CONTROL 1 /* Tomasz Bujlow <tomasz@skatnet.dk> */
@@ -86,7 +85,7 @@
#define NDPI_PROTOCOL_VMWARE 28
#define NDPI_PROTOCOL_MAIL_SMTPS 29
#define NDPI_PROTOCOL_FILETOPIA 30
-#define NDPI_PROTOCOL_IMESH 31
+#define NDPI_PROTOCOL_UBNTAC2 31 /* Ubiquity UBNT AirControl 2 - Thomas Fjellstrom <thomas+ndpi@fjellstrom.ca> */
#define NDPI_PROTOCOL_KONTIKI 32
#define NDPI_PROTOCOL_OPENFT 33
#define NDPI_PROTOCOL_FASTTRACK 34
@@ -188,6 +187,8 @@
#define NDPI_PROTOCOL_UBUNTUONE 169 /* Remy Mudingay <mudingay@ill.fr> */
#define NDPI_PROTOCOL_WHOIS_DAS 170
#define NDPI_PROTOCOL_COLLECTD 171
+#define NDPI_PROTOCOL_SOCKS 172 /* Tomasz Bujlow <tomasz@skatnet.dk> */
+#define NDPI_PROTOCOL_MS_LYNC 173
#define NDPI_PROTOCOL_RTMP 174 /* Tomasz Bujlow <tomasz@skatnet.dk> */
#define NDPI_PROTOCOL_FTP_DATA 175 /* Tomasz Bujlow <tomasz@skatnet.dk> */
#define NDPI_PROTOCOL_ZMQ 177
@@ -201,8 +202,6 @@
#define NDPI_PROTOCOL_STARCRAFT 211 /* Matteo Bracci <matteobracci1@gmail.com> */
#define NDPI_PROTOCOL_TEREDO 212
#define NDPI_PROTOCOL_HEP 213 /* Sipcapture.org QXIP BV */
-#define NDPI_PROTOCOL_UBNTAC2 214 /* Ubiquity UBNT AirControl 2 - Thomas Fjellstrom <thomas+ndpi@fjellstrom.ca> */
-#define NDPI_PROTOCOL_MS_LYNC 173
@@ -262,7 +261,7 @@
#define NDPI_PROTOCOL_MQTT 208
#define NDPI_PROTOCOL_RX 209
#define NDPI_SERVICE_SINA 210
-#define NDPI_SERVICE_HANGOUT 215
+#define NDPI_SERVICE_HANGOUT 214
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_SERVICE_HANGOUT
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 93ba4b643..5ce5dac09 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -80,7 +80,6 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
void ndpi_search_rtsp_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_filetopia_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_vmware(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
-void ndpi_search_imesh_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ssl_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_mms_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_icecast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
@@ -232,7 +231,6 @@ void init_http_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
void init_http_activesync_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_iax_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_icecast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
-void init_imesh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_ipp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_irc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_jabber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index b35479464..4d1bc1f39 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -59,7 +59,6 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/http.c \
protocols/iax.c \
protocols/icecast.c \
- protocols/imesh.c \
protocols/ipp.c \
protocols/irc.c \
protocols/jabber.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 749a740b4..14e0ee387 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -843,11 +843,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "Filetopia",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_IMESH,
- no_master,
- no_master, "iMESH",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_KONTIKI,
no_master,
no_master, "Kontiki",
@@ -2274,9 +2269,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* VMWARE */
init_vmware_dissector(ndpi_struct, &a, detection_bitmask);
- /* IMESH */
- init_imesh_dissector(ndpi_struct, &a, detection_bitmask);
-
/* MMS */
init_mms_dissector(ndpi_struct, &a, detection_bitmask);
diff --git a/src/lib/protocols/imesh.c b/src/lib/protocols/imesh.c
deleted file mode 100644
index e67019a43..000000000
--- a/src/lib/protocols/imesh.c
+++ /dev/null
@@ -1,308 +0,0 @@
-/*
- * imesh.c
- *
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-
-#include "ndpi_api.h"
-
-#ifdef NDPI_PROTOCOL_IMESH
-
-
-static void ndpi_int_imesh_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
- struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */)
-{
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IMESH, NDPI_PROTOCOL_UNKNOWN);
-}
-
-
-void ndpi_search_imesh_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- struct ndpi_packet_struct *packet = &flow->packet;
-
- if (packet->udp != NULL) {
-
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "UDP FOUND\n");
-
- // this is the login packet
- if (packet->payload_packet_len == 28 && (get_u_int32_t(packet->payload, 0)) == htonl(0x02000000) &&
- get_u_int32_t(packet->payload, 24) == 0 &&
- (packet->udp->dest == htons(1864) || packet->udp->source == htons(1864))) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh Login detected\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- if (packet->payload_packet_len == 36) {
- if (get_u_int32_t(packet->payload, 0) == htonl(0x02000000) && packet->payload[4] != 0 &&
- packet->payload[5] == 0 && get_u_int16_t(packet->payload, 6) == htons(0x0083) &&
- get_u_int32_t(packet->payload, 24) == htonl(0x40000000) &&
- (packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] ||
- packet->payload[packet->payload_packet_len - 1] - 1 == packet->payload[packet->payload_packet_len - 5]
- || packet->payload[packet->payload_packet_len - 1] ==
- packet->payload[packet->payload_packet_len - 5] - 1)) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- if (get_u_int16_t(packet->payload, 0) == htons(0x0200) && get_u_int16_t(packet->payload, 2) != 0 &&
- get_u_int32_t(packet->payload, 4) == htonl(0x02000083) && get_u_int32_t(packet->payload, 24) == htonl(0x40000000) &&
- (packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] ||
- packet->payload[packet->payload_packet_len - 1] - 1 == packet->payload[packet->payload_packet_len - 5]
- || packet->payload[packet->payload_packet_len - 1] ==
- packet->payload[packet->payload_packet_len - 5] - 1)) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- }
- if (packet->payload_packet_len == 24 && get_u_int16_t(packet->payload, 0) == htons(0x0200)
- && get_u_int16_t(packet->payload, 2) != 0 && get_u_int32_t(packet->payload, 4) == htonl(0x03000084) &&
- (packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] ||
- packet->payload[packet->payload_packet_len - 1] - 1 == packet->payload[packet->payload_packet_len - 5] ||
- packet->payload[packet->payload_packet_len - 1] == packet->payload[packet->payload_packet_len - 5] - 1)) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- if (packet->payload_packet_len == 32 && get_u_int32_t(packet->payload, 0) == htonl(0x02000000) &&
- get_u_int16_t(packet->payload, 21) == 0 && get_u_int16_t(packet->payload, 26) == htons(0x0100)) {
- if (get_u_int32_t(packet->payload, 4) == htonl(0x00000081) && packet->payload[11] == packet->payload[15] &&
- get_l16(packet->payload, 24) == htons(packet->udp->source)) {
- /* packet->payload[28] = source address */
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- if (get_u_int32_t(packet->payload, 4) == htonl(0x01000082)) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh detected\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- }
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh UDP packetlen: %d\n",
- packet->payload_packet_len);
-
- }
-
- if (packet->tcp != NULL) {
- if (packet->payload_packet_len == 64 && get_u_int32_t(packet->payload, 0) == htonl(0x40000000) &&
- get_u_int32_t(packet->payload, 4) == 0 && get_u_int32_t(packet->payload, 8) == htonl(0x0000fcff) &&
- get_u_int32_t(packet->payload, 12) == htonl(0x04800100) && get_u_int32_t(packet->payload, 45) == htonl(0xff020000) &&
- get_u_int16_t(packet->payload, 49) == htons(0x001a)) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- if (packet->payload_packet_len == 95 && get_u_int32_t(packet->payload, 0) == htonl(0x5f000000) &&
- get_u_int16_t(packet->payload, 4) == 0 && get_u_int16_t(packet->payload, 7) == htons(0x0004) &&
- get_u_int32_t(packet->payload, 20) == 0 && get_u_int32_t(packet->payload, 28) == htonl(0xc8000400) &&
- packet->payload[9] == 0x80 && get_u_int32_t(packet->payload, 10) == get_u_int32_t(packet->payload, 24)) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- if (packet->payload_packet_len == 28 && get_u_int32_t(packet->payload, 0) == htonl(0x1c000000) &&
- get_u_int16_t(packet->payload, 10) == htons(0xfcff) && get_u_int32_t(packet->payload, 12) == htonl(0x07801800) &&
- (get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == htons(0x1900) ||
- get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == htons(0x1a00))) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
-
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "TCP FOUND :: Payload %u\n",
- packet->payload_packet_len);
-
- if (packet->actual_payload_len == 0) {
- return;
- }
- if ((packet->actual_payload_len == 8 || packet->payload_packet_len == 10) /* PATTERN:: 04 00 00 00 00 00 00 00 [00 00] */
- &&get_u_int32_t(packet->payload, 0) == htonl(0x04000000)
- && get_u_int32_t(packet->payload, 4) == 0) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 10 /* PATTERN:: ?? ?? 04|00 00 64|00 00 */
- && (packet->payload[2] == 0x04 || packet->payload[2] == 0x00)
- && packet->payload[3] == 0x00 && (packet->payload[4] == 0x00 || packet->payload[4] == 0x64)
- && packet->payload[5] == 0x00
- && (packet->payload[2] != packet->payload[4]) /* We do not want that the packet is ?? ?? 00 00 00 00 */
- ) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 2 && packet->payload[0] == 0x06 && packet->payload[1] == 0x00) {
- flow->l4.tcp.imesh_stage++;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 10 /* PATTERN:: 06 00 04|00 00 01|00 00 01|00 00 ?? 00 */
- && packet->payload[0] == 0x06
- && packet->payload[1] == 0x00 && (packet->payload[2] == 0x04 || packet->payload[2] == 0x00)
- && packet->payload[3] == 0x00 && (packet->payload[4] == 0x00 || packet->payload[4] == 0x01)
- && packet->payload[5] == 0x00 && (packet->payload[6] == 0x01 || packet->payload[6] == 0x00)
- && packet->payload[7] == 0x00 && packet->payload[9] == 0x00
- && (packet->payload[2] || packet->payload[4] || packet->payload[6]) /* We do not want that the packet is all 06 00 00 ... */
- ) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 24 && packet->payload[0] == 0x06 // PATTERN :: 06 00 12 00 00 00 34 00 00
- && packet->payload[1] == 0x00
- && packet->payload[2] == 0x12
- && packet->payload[3] == 0x00
- && packet->payload[4] == 0x00
- && packet->payload[5] == 0x00
- && packet->payload[6] == 0x34 && packet->payload[7] == 0x00 && packet->payload[8] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 8 /* PATTERN:: 06|00 00 02 00 00 00 33 00 */
- && (packet->payload[0] == 0x06 || packet->payload[0] == 0x00)
- && packet->payload[1] == 0x00
- && packet->payload[2] == 0x02
- && packet->payload[3] == 0x00
- && packet->payload[4] == 0x00
- && packet->payload[5] == 0x00 && packet->payload[6] == 0x33 && packet->payload[7] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->payload_packet_len == 6 /* PATTERN:: 02 00 00 00 33 00 */
- && packet->payload[0] == 0x02
- && packet->payload[1] == 0x00
- && packet->payload[2] == 0x00
- && packet->payload[3] == 0x00 && packet->payload[4] == 0x33 && packet->payload[5] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 12 && packet->payload[0] == 0x06 // PATTERN : 06 00 06 00 00 00 64 00
- && packet->payload[1] == 0x00
- && packet->payload[2] == 0x06
- && packet->payload[3] == 0x00
- && packet->payload[4] == 0x00
- && packet->payload[5] == 0x00 && packet->payload[6] == 0x64 && packet->payload[7] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 10 /* PATTERN:: 06 00 04|01 00 00 00 01|00 00 ?? 00 */
- && packet->payload[0] == 0x06
- && packet->payload[1] == 0x00 && (packet->payload[2] == 0x04 || packet->payload[2] == 0x01)
- && packet->payload[3] == 0x00
- && packet->payload[4] == 0x00
- && packet->payload[5] == 0x00 && (packet->payload[6] == 0x01 || packet->payload[6] == 0x00)
- && packet->payload[7] == 0x00
- /* && packet->payload[8]==0x00 */
- && packet->payload[9] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if ((packet->actual_payload_len == 64 || packet->actual_payload_len == 52 /* PATTERN:: [len] 00 00 00 00 */
- || packet->actual_payload_len == 95)
- && get_u_int16_t(packet->payload, 0) == (packet->actual_payload_len)
- && packet->payload[1] == 0x00 && packet->payload[2] == 0x00
- && packet->payload[3] == 0x00 && packet->payload[4] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 6 && packet->payload[0] == 0x06 // PATTERN : 06 00 04|6c 00|01 00 00
- && packet->payload[1] == 0x00 && (packet->payload[2] == 0x04 || packet->payload[2] == 0x6c)
- && (packet->payload[3] == 0x00 || packet->payload[3] == 0x01)
- && packet->payload[4] == 0x00 && packet->payload[5] == 0x00) {
-
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 6 /* PATTERN:: [len] ?? ee 00 00 00 */
- && get_u_int16_t(packet->payload, 0) == (packet->actual_payload_len)
- && packet->payload[2] == 0xee
- && packet->payload[3] == 0x00 && packet->payload[4] == 0x00 && packet->payload[5] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- } else if (packet->actual_payload_len == 10 /* PATTERN:: 06 00 00 00 00 00 00 00 */
- && packet->payload[0] == 0x06
- && packet->payload[1] == 0x00
- && packet->payload[2] == 0x00
- && packet->payload[3] == 0x00
- && packet->payload[4] == 0x00
- && packet->payload[5] == 0x00 && packet->payload[6] == 0x00 && packet->payload[7] == 0x00) {
- flow->l4.tcp.imesh_stage += 2;
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG,
- "IMESH FOUND :: Payload %u\n", packet->actual_payload_len);
- }
-
-
- /* http login */
- if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("POST /registration") &&
- memcmp(packet->payload, "POST /registration", NDPI_STATICSTRING_LEN("POST /registration")) == 0) {
- ndpi_parse_packet_line_info(ndpi_struct, flow);
- if (packet->parsed_lines > 6 &&
- packet->host_line.ptr != NULL &&
- packet->host_line.len == NDPI_STATICSTRING_LEN("login.bearshare.com") &&
- packet->line[1].ptr != NULL &&
- packet->line[1].len == NDPI_STATICSTRING_LEN("Authorization: Basic Og==") &&
- packet->line[4].ptr != NULL &&
- packet->line[4].len == NDPI_STATICSTRING_LEN("Accept-Encoding: identity") &&
- memcmp(packet->line[1].ptr, "Authorization: Basic Og==",
- NDPI_STATICSTRING_LEN("Authorization: Basic Og==")) == 0 &&
- memcmp(packet->host_line.ptr, "login.bearshare.com",
- NDPI_STATICSTRING_LEN("login.bearshare.com")) == 0 &&
- memcmp(packet->line[4].ptr, "Accept-Encoding: identity",
- NDPI_STATICSTRING_LEN("Accept-Encoding: identity")) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh Login detected\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- }
- /*give one packet tolerance for detection */
- if((flow->l4.tcp.imesh_stage >= 4)
- && (flow->l4.tcp.seen_syn && flow->l4.tcp.seen_syn_ack && flow->l4.tcp.seen_ack) /* We have seen the 3-way handshake */)
- {
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "found imesh.\n");
- ndpi_int_imesh_add_connection(ndpi_struct, flow);
- return;
- }
- }
-
- if ((flow->packet_counter < 5) || packet->actual_payload_len == 0) {
- return;
- }
- //imesh_not_found_end:
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IMESH);
- NDPI_LOG(NDPI_PROTOCOL_IMESH, ndpi_struct, NDPI_LOG_DEBUG, "iMesh excluded at stage %d\n",
- packet->tcp != NULL ? flow->l4.tcp.imesh_stage : 0);
-
-}
-
-
-void init_imesh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
- ndpi_set_bitmask_protocol_detection("iMESH", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_IMESH,
- ndpi_search_imesh_tcp_udp,
- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
-
- *id += 1;
-}
-
-#endif
diff --git a/src/lib/protocols/msn.c b/src/lib/protocols/msn.c
index ff81a12b3..204e2bfe6 100644
--- a/src/lib/protocols/msn.c
+++ b/src/lib/protocols/msn.c
@@ -21,15 +21,13 @@
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
-
-
#include "ndpi_api.h"
#ifdef NDPI_PROTOCOL_MSN
#define MAX_PACKETS_FOR_MSN 100
-static void ndpi_int_msn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */
- /* ndpi_protocol_type_t protocol_type */)
+
+static void ndpi_int_msn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MSN, NDPI_PROTOCOL_UNKNOWN);
}
@@ -38,11 +36,11 @@ static u_int8_t ndpi_int_find_xmsn(struct ndpi_detection_module_struct *ndpi_str
{
struct ndpi_packet_struct *packet = &flow->packet;
- if (packet->parsed_lines > 3) {
+ if(packet->parsed_lines > 3) {
u_int16_t i;
- for (i = 2; i < packet->parsed_lines; i++) {
- if (packet->line[i].ptr != NULL && packet->line[i].len > NDPI_STATICSTRING_LEN("X-MSN") &&
- memcmp(packet->line[i].ptr, "X-MSN", NDPI_STATICSTRING_LEN("X-MSN")) == 0) {
+ for(i = 2; i < packet->parsed_lines; i++) {
+ if(packet->line[i].ptr != NULL && packet->line[i].len > NDPI_STATICSTRING_LEN("X-MSN") &&
+ memcmp(packet->line[i].ptr, "X-MSN", NDPI_STATICSTRING_LEN("X-MSN")) == 0) {
return 1;
}
}
@@ -50,7 +48,7 @@ static u_int8_t ndpi_int_find_xmsn(struct ndpi_detection_module_struct *ndpi_str
return 0;
}
-
+/* search over TCP */
static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
@@ -60,34 +58,35 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
u_int16_t plen;
u_int16_t status = 0;
-
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp detection...\n");
#ifdef NDPI_PROTOCOL_SSL
- if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) {
+ if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "msn ssl ft test\n");
- if (flow->packet_counter < 10) {
- }
- if (flow->packet_counter == 7 && packet->payload_packet_len > 300) {
- if (memcmp(packet->payload + 24, "MSNSLP", 6) == 0
- || (get_u_int32_t(packet->payload, 0) == htonl(0x30000000) && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "detected MSN File Transfer, ifdef ssl.\n");
- ndpi_int_msn_add_connection(ndpi_struct, flow);
- return;
+ if(flow->packet_counter < 10) {
+ if(flow->packet_counter == 7 && packet->payload_packet_len > 300) {
+ if(memcmp(packet->payload + 24, "MSNSLP", 6) == 0
+ || (get_u_int32_t(packet->payload, 0) == htonl(0x30000000) && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "detected MSN File Transfer, ifdef ssl.\n");
+ ndpi_int_msn_add_connection(ndpi_struct, flow);
+ return;
+ }
}
- }
- if (flow->packet_counter >= 5 && flow->packet_counter <= 10 && (get_u_int32_t(packet->payload, 0) == htonl(0x18000000)
- && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
- flow->l4.tcp.msn_ssl_ft++;
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "increased msn ft ssl stage to: %u at packet nr: %u\n", flow->l4.tcp.msn_ssl_ft,
- flow->packet_counter);
- if (flow->l4.tcp.msn_ssl_ft == 2) {
+ if(flow->packet_counter >= 5 && flow->packet_counter <= 10 && (get_u_int32_t(packet->payload, 0) == htonl(0x18000000)
+ && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
+ flow->l4.tcp.msn_ssl_ft++;
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "detected MSN File Transfer, ifdef ssl 2.\n");
- ndpi_int_msn_add_connection(ndpi_struct, flow);
+ "increased msn ft ssl stage to: %u at packet nr: %u\n", flow->l4.tcp.msn_ssl_ft,
+ flow->packet_counter);
+ if (flow->l4.tcp.msn_ssl_ft == 2) {
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
+ "detected MSN File Transfer, ifdef ssl 2.\n");
+ ndpi_int_msn_add_connection(ndpi_struct, flow);
+ }
+ return;
}
- return;
}
}
#endif
@@ -98,25 +97,25 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
* x is now "0", but can be increased
*/
/* now we have a look at the first packet only. */
- if (flow->packet_counter == 1
+ if(flow->packet_counter == 1
#ifdef NDPI_PROTOCOL_SSL
|| ((packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) && flow->packet_counter <= 3)
#endif
) {
-
+
/* this part is working asymmetrically */
- if (packet->payload_packet_len > 32 && (packet->payload[0] == 0x02 || packet->payload[0] == 0x00)
- && (ntohl(get_u_int32_t(packet->payload, 8)) == 0x2112a442 || ntohl(get_u_int32_t(packet->payload, 4)) == 0x2112a442)
- && ((ntohl(get_u_int32_t(packet->payload, 24)) == 0x000f0004 && ntohl(get_u_int32_t(packet->payload, 28)) == 0x72c64bc6)
- || (ntohl(get_u_int32_t(packet->payload, 20)) == 0x000f0004
- && ntohl(get_u_int32_t(packet->payload, 24)) == 0x72c64bc6))) {
+ if(packet->payload_packet_len > 32 && (packet->payload[0] == 0x02 || packet->payload[0] == 0x00)
+ && (ntohl(get_u_int32_t(packet->payload, 8)) == 0x2112a442 || ntohl(get_u_int32_t(packet->payload, 4)) == 0x2112a442)
+ && ((ntohl(get_u_int32_t(packet->payload, 24)) == 0x000f0004 && ntohl(get_u_int32_t(packet->payload, 28)) == 0x72c64bc6)
+ || (ntohl(get_u_int32_t(packet->payload, 20)) == 0x000f0004
+ && ntohl(get_u_int32_t(packet->payload, 24)) == 0x72c64bc6))) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found MSN in packets that also contain voice.messenger.live.com.\n");
/* TODO this is an alternative pattern for video detection */
/* if (packet->payload_packet_len > 100 &&
get_u_int16_t(packet->payload, 86) == htons(0x05dc)) { */
- if (packet->payload_packet_len > 101 && packet->payload[101] == 0x02) {
+ if(packet->payload_packet_len > 101 && packet->payload[101] == 0x02) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
} else {
ndpi_int_msn_add_connection(ndpi_struct, flow);
@@ -148,13 +147,12 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
}
-
- if (
+ if(
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "GET ") ||
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "POST ")) {
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "GET ") ||
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "POST ")) {
ndpi_parse_packet_line_info(ndpi_struct, flow);
if (packet->user_agent_line.ptr != NULL &&
packet->user_agent_line.len > NDPI_STATICSTRING_LEN("Messenger/") &&
@@ -163,29 +161,29 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
return;
}
}
-#ifdef NDPI_PROTOCOL_HTTP
- /* we have to examine two http packets */
- if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) {
- }
-#endif
+/* #ifdef NDPI_PROTOCOL_HTTP */
+/* /\* we have to examine two http packets *\/ */
+/* if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) { */
+/* } */
+/* #endif */
/* not seen this pattern in any trace */
/* now test for http login, at least 100 a bytes packet */
- if (packet->payload_packet_len > 100) {
- if (
+ if(packet->payload_packet_len > 100) {
+ if(
#ifdef NDPI_PROTOCOL_HTTP
packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
memcmp(packet->payload, "POST http://", 12) == 0) {
/* scan packet if not already done... */
ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- if (packet->content_line.ptr != NULL &&
- ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
- memcmp(packet->content_line.ptr, "application/x-msn-messenger",
- NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
- (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
- memcmp(packet->content_line.ptr, "text/x-msnmsgr",
- NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+
+ if(packet->content_line.ptr != NULL &&
+ ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
+ memcmp(packet->content_line.ptr, "application/x-msn-messenger",
+ NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
+ (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
+ memcmp(packet->content_line.ptr, "text/x-msnmsgr",
+ NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found MSN by pattern POST http:// .... application/x-msn-messenger.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
@@ -193,25 +191,24 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
}
-
/* now test for http login that uses a gateway, at least 400 a bytes packet */
/* for this case the asymmetric detection is asym (1) */
- if (packet->payload_packet_len > 400) {
- if ((
+ if(packet->payload_packet_len > 400) {
+ if((
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- (memcmp(packet->payload, "POST ", 5) == 0))) {
+ (memcmp(packet->payload, "POST ", 5) == 0))) {
u_int16_t c;
- if (memcmp(&packet->payload[5], "http://", 7) == 0) {
+ if(memcmp(&packet->payload[5], "http://", 7) == 0) {
/*
- * We are searching for a paten "POST http://gateway.messenger.hotmail.com/gateway/gateway.dll" or
+ * We are searching for a pattern "POST http://gateway.messenger.hotmail.com/gateway/gateway.dll" or
* "POST http://<some ip addres here like 172.0.0.0>/gateway/gateway.dll"
* POST http:// is 12 byte so we are searching for 13 to 70 byte for this paten.
*/
- for (c = 13; c < 50; c++) {
- if (memcmp(&packet->payload[c], "/", 1) == 0) {
- if (memcmp(&packet->payload[c], "/gateway/gateway.dll", 20) == 0) {
+ for(c = 13; c < 50; c++) {
+ if(memcmp(&packet->payload[c], "/", 1) == 0) {
+ if(memcmp(&packet->payload[c], "/gateway/gateway.dll", 20) == 0) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found pattern http://.../gateway/gateway.ddl.\n");
status = 1;
@@ -219,44 +216,38 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
}
- } else if ((memcmp(&packet->payload[5], "/gateway/gateway.dll", 20) == 0)) {
+ } else if((memcmp(&packet->payload[5], "/gateway/gateway.dll", 20) == 0)) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found pattern http://.../gateway/gateway.ddl.\n");
status = 1;
}
}
- if (status) {
+ if(status) {
u_int16_t a;
-
+
ndpi_parse_packet_line_info(ndpi_struct, flow);
- if (packet->content_line.ptr != NULL
- &&
- ((packet->content_line.len == 23
- && memcmp(packet->content_line.ptr, "text/xml; charset=utf-8", 23) == 0)
- ||
- (packet->content_line.len == 24
- && memcmp(packet->content_line.ptr, "text/html; charset=utf-8", 24) == 0)
- ||
- (packet->content_line.len == 33
- && memcmp(packet->content_line.ptr, "application/x-www-form-urlencoded", 33) == 0)
- )) {
- if ((src != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN)
- != 0) || (dst != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask,
- NDPI_PROTOCOL_MSN)
- != 0)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN with pattern text/xml; charset=utf-8.\n");
+ if(packet->content_line.ptr != NULL && ((packet->content_line.len == 23
+ && memcmp(packet->content_line.ptr, "text/xml; charset=utf-8", 23) == 0)
+ ||
+ (packet->content_line.len == 24
+ && memcmp(packet->content_line.ptr, "text/html; charset=utf-8", 24) == 0)
+ ||
+ (packet->content_line.len == 33
+ && memcmp(packet->content_line.ptr, "application/x-www-form-urlencoded", 33) == 0))) {
+
+ if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
+ || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
+
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern text/xml; charset=utf-8.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
- for (a = 0; a < packet->parsed_lines; a++) {
- if (packet->line[a].len >= 4 &&
- (memcmp(packet->line[a].ptr, "CVR ", 4) == 0
- || memcmp(packet->line[a].ptr, "VER ",
- 4) == 0 || memcmp(packet->line[a].ptr, "ANS ", 4) == 0)) {
+ for(a = 0; a < packet->parsed_lines; a++) {
+ if(packet->line[a].len >= 4 && (memcmp(packet->line[a].ptr, "CVR ", 4) == 0
+ || memcmp(packet->line[a].ptr, "VER ", 4) == 0 ||
+ memcmp(packet->line[a].ptr, "ANS ", 4) == 0)) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"found MSN with pattern text/sml; charset0utf-8.\n");
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct,
@@ -269,52 +260,47 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
/* asym (1) ; possibly occurs in symmetric cases also. */
- if (flow->packet_counter <= 10 &&
- (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2)
- && packet->payload_packet_len > 100) {
+ if(flow->packet_counter <= 10 &&
+ (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2)
+ && packet->payload_packet_len > 100) {
/* not necessary to check the length, because this has been done : >400. */
- if (
+ if(
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.0 200 OK") ||
- ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.1 200 OK")
- ) {
-
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.0 200 OK") ||
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.1 200 OK")
+ ) {
+
ndpi_parse_packet_line_info(ndpi_struct, flow);
- if (packet->content_line.ptr != NULL &&
+ if(packet->content_line.ptr != NULL &&
((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
- memcmp(packet->content_line.ptr, "application/x-msn-messenger",
- NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
+ memcmp(packet->content_line.ptr, "application/x-msn-messenger", NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
(packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
- memcmp(packet->content_line.ptr, "text/x-msnmsgr",
- NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+ memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
"HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
- if (ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
+ if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
}
-
-
- /* did not find any trace with this pattern !!!!! */
+ /* did not find any trace with this pattern */
/* now block proxy connection */
- if (packet->payload_packet_len >= 42) {
- if (memcmp(packet->payload, "CONNECT messenger.hotmail.com:1863 HTTP/1.", 42) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN with pattern CONNECT messenger.hotmail.com:1863 HTTP/1..\n");
+ if(packet->payload_packet_len >= 42) {
+ if(memcmp(packet->payload, "CONNECT messenger.hotmail.com:1863 HTTP/1.", 42) == 0) {
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern CONNECT messenger.hotmail.com:1863 HTTP/1..\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
-
if (packet->payload_packet_len >= 18) {
if (memcmp(packet->payload, "USR ", 4) == 0 || memcmp(packet->payload, "ANS ", 4) == 0) {
@@ -347,59 +333,52 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
if (plen >= endlen) {
goto ndpi_msn_exclude;
}
-
}
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN with pattern USR/ANS ...mail_address.\n");
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern USR/ANS ...mail_address.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
}
-
/* finished examining the first packet only. */
-
/* asym (1) ; possibly occurs in symmetric cases also. */
- if (flow->packet_counter <= 10 &&
+ if(flow->packet_counter <= 10 &&
(flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2) &&
packet->payload_packet_len > 100) {
/* not necessary to check the length, because this has been done : >400. */
- if (
+ if(
#ifdef NDPI_PROTOCOL_HTTP
- packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
+ packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP ||
#endif
- (memcmp(packet->payload, "HTTP/1.0 200 OK", 15) == 0) ||
- (memcmp(packet->payload, "HTTP/1.1 200 OK", 15) == 0)
- ) {
-
+ (memcmp(packet->payload, "HTTP/1.0 200 OK", 15) == 0) ||
+ (memcmp(packet->payload, "HTTP/1.1 200 OK", 15) == 0)) {
+
ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- if (packet->content_line.ptr != NULL &&
- ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
- memcmp(packet->content_line.ptr, "application/x-msn-messenger",
- NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
- (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
- memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
+
+ if(packet->content_line.ptr != NULL && ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
+ memcmp(packet->content_line.ptr, "application/x-msn-messenger",
+ NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
+ (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
+ memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
+
+ NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
- if (ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
+ if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
}
}
-
/* finished examining the secone packet only */
/* direct user connection (file transfer,...) */
-
- if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
- || (dst != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
+
+ if((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
+ || (dst != NULL
+ && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
if (flow->packet_counter == 1 &&
packet->payload_packet_len > 12 && memcmp(packet->payload, "recipientid=", 12) == 0) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "detected file transfer.\n");
@@ -407,23 +386,22 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
return;
}
}
-
/* MSN File Transfer of MSN 8.1 and 8.5
* first packet with length 4 and pattern 0x04000000
* second packet (in the same direction), with length 56 and pattern 0x00000000 from payload[16]
* third packet (in the opposite direction to 1 & 2), with length 4 and pattern 0x30000000
*/
- if (flow->l4.tcp.msn_stage == 0) {
+ if(flow->l4.tcp.msn_stage == 0) {
/* asymmetric detection to this pattern is asym (2) */
- if ((packet->payload_packet_len == 4 || packet->payload_packet_len == 8)
- && get_u_int32_t(packet->payload, 0) == htonl(0x04000000)) {
+ if((packet->payload_packet_len == 4 || packet->payload_packet_len == 8)
+ && get_u_int32_t(packet->payload, 0) == htonl(0x04000000)) {
+
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "maybe first TCP MSN detected\n");
-
- if (packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 4) == htonl(0x666f6f00)) {
+
+ if(packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 4) == htonl(0x666f6f00)) {
flow->l4.tcp.msn_stage = 5 + packet->packet_direction;
return;
}
-
flow->l4.tcp.msn_stage = 1 + packet->packet_direction;
return;
}
@@ -469,10 +447,11 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
}
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "msn 7.\n");
+
if (flow->packet_counter <= MAX_PACKETS_FOR_MSN) {
- if (packet->tcp->source == htons(443)
- || packet->tcp->dest == htons(443)) {
+ if (packet->tcp->source == htons(443) || packet->tcp->dest == htons(443)) {
if (packet->payload_packet_len > 300) {
+
if (memcmp(&packet->payload[40], "INVITE MSNMSGR", 14) == 0
|| memcmp(&packet->payload[56], "INVITE MSNMSGR", 14) == 0
|| memcmp(&packet->payload[172], "INVITE MSNMSGR", 14) == 0) {
@@ -484,17 +463,15 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
}
return;
}
- /* For no
- n port 443 flows exclude flow bitmask after first packet itself */
+ /* For non port 443 flows exclude flow bitmask after first packet itself */
}
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp excluded.\n");
ndpi_msn_exclude:
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN);
}
-
-
-static void ndpi_search_udp_msn_misc(struct ndpi_detection_module_struct
+/* search over UDP */
+static void ndpi_search_msn_udp_misc(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
@@ -530,27 +507,26 @@ void ndpi_search_msn(struct ndpi_detection_module_struct *ndpi_struct, struct nd
struct ndpi_packet_struct *packet = &flow->packet;
/* this if request should always be true */
- if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) {
+ if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) {
/* we deal with tcp now */
- if (packet->tcp != NULL) {
+ if(packet->tcp != NULL) {
/* msn can use http or ssl for connection. That's why every http, ssl and ukn packet must enter in the msn detection */
/* the detection can swich out the http or the ssl detection. In this case we need not check those protocols */
// need to do the ceck when protocol == http too (POST /gateway ...)
- if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN
-#if defined(NDPI_PROTOCOL_HTTP)
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP
+ if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN
+#ifdef NDPI_PROTOCOL_HTTP
+ || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP
#endif
-#if defined(NDPI_PROTOCOL_SSL)
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL
+#ifdef NDPI_PROTOCOL_SSL
+ || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL
#endif
-#if defined(NDPI_PROTOCOL_STUN)
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
+#ifdef NDPI_PROTOCOL_STUN
+ || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
#endif
- ) {
+ )
ndpi_search_msn_tcp(ndpi_struct, flow);
- }
} else if (packet->udp != NULL) {
- ndpi_search_udp_msn_misc(ndpi_struct, flow);
+ ndpi_search_msn_udp_misc(ndpi_struct, flow);
}
}
}
diff --git a/src/lib/protocols/ppstream.c b/src/lib/protocols/ppstream.c
index d60966798..f3323697b 100644
--- a/src/lib/protocols/ppstream.c
+++ b/src/lib/protocols/ppstream.c
@@ -1,8 +1,7 @@
/*
* ppstream.c
*
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2016 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -21,9 +20,8 @@
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
-
-
#include "ndpi_protocols.h"
+
#ifdef NDPI_PROTOCOL_PPSTREAM
static void ndpi_int_ppstream_add_connection(struct ndpi_detection_module_struct
@@ -36,13 +34,7 @@ void ndpi_search_ppstream(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
-
-
- // struct ndpi_id_struct *src=ndpi_struct->src;
- // struct ndpi_id_struct *dst=ndpi_struct->dst;
-
-
-
+
/* check TCP Connections -> Videodata */
if (packet->tcp != NULL) {
if (packet->payload_packet_len >= 60 && get_u_int32_t(packet->payload, 52) == 0
diff --git a/src/lib/protocols/vmware.c b/src/lib/protocols/vmware.c
index 9ef3ccd2f..e5421b946 100644
--- a/src/lib/protocols/vmware.c
+++ b/src/lib/protocols/vmware.c
@@ -27,30 +27,30 @@ void ndpi_search_vmware(struct ndpi_detection_module_struct *ndpi_struct, struct
struct ndpi_packet_struct *packet = &flow->packet;
/* Check whether this is an VMWARE flow */
- if(packet->udp != NULL) {
- if((packet->payload_packet_len == 66)
- && (ntohs(packet->udp->dest) == 902)
- && ((packet->payload[0] & 0xFF) == 0xA4)) {
+ if(packet->udp != NULL){
+ if((packet->payload_packet_len == 66) &&
+ (ntohs(packet->udp->dest) == 902) &&
+ ((packet->payload[0] & 0xFF) == 0xA4)){
+
NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "Found vmware.\n");
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VMWARE, NDPI_PROTOCOL_UNKNOWN);
- }
- else {
- NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "exclude vmware.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VMWARE);
+ return;
}
}
+ NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "exclude vmware.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VMWARE);
}
- void init_vmware_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
- {
- ndpi_set_bitmask_protocol_detection("VMWARE", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_VMWARE,
- ndpi_search_vmware,
- NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
-
- *id += 1;
- }
+void init_vmware_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("VMWARE", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_VMWARE,
+ ndpi_search_vmware,
+ NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
#endif
diff --git a/src/lib/protocols/vnc.c b/src/lib/protocols/vnc.c
index 5d793bccf..6315a2aa5 100644
--- a/src/lib/protocols/vnc.c
+++ b/src/lib/protocols/vnc.c
@@ -1,8 +1,7 @@
/*
* vnc.c
*
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2016 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -21,48 +20,46 @@
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
-
-
#include "ndpi_protocols.h"
#ifdef NDPI_PROTOCOL_VNC
-static void ndpi_int_vnc_add_connection(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VNC, NDPI_PROTOCOL_UNKNOWN);
-}
-
-/*
- return 0 if nothing has been detected
- return 1 if it is a http packet
-*/
void ndpi_search_vnc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
- // struct ndpi_id_struct *src=ndpi_struct->src;
- // struct ndpi_id_struct *dst=ndpi_struct->dst;
-
-
- if (flow->l4.tcp.vnc_stage == 0) {
- if (packet->payload_packet_len == 12
- && memcmp(packet->payload, "RFB 003.00", 10) == 0 && packet->payload[11] == 0x0a) {
- NDPI_LOG(NDPI_PROTOCOL_VNC, ndpi_struct, NDPI_LOG_DEBUG, "reached vnc stage one\n");
- flow->l4.tcp.vnc_stage = 1 + packet->packet_direction;
- return;
- }
- } else if (flow->l4.tcp.vnc_stage == 2 - packet->packet_direction) {
- if (packet->payload_packet_len == 12
- && memcmp(packet->payload, "RFB 003.00", 10) == 0 && packet->payload[11] == 0x0a) {
- NDPI_LOG(NDPI_PROTOCOL_VNC, ndpi_struct, NDPI_LOG_DEBUG, "found vnc\n");
- ndpi_int_vnc_add_connection(ndpi_struct, flow);
- return;
+ /* search over TCP */
+ if(packet->tcp) {
+
+ if(flow->l4.tcp.vnc_stage == 0) {
+
+ if(packet->payload_packet_len == 12 &&
+ (memcmp(packet->payload, "RFB 003.003", 11) == 0 && packet->payload[11] == 0x0a) ||
+ (memcmp(packet->payload, "RFB 003.007", 11) == 0 && packet->payload[11] == 0x0a) ||
+ (memcmp(packet->payload, "RFB 003.008", 11) == 0 && packet->payload[11] == 0x0a) ||
+ (memcmp(packet->payload, "RFB 004.001", 11) == 0 && packet->payload[11] == 0x0a)) {
+
+ NDPI_LOG(NDPI_PROTOCOL_VNC, ndpi_struct, NDPI_LOG_DEBUG, "reached vnc stage one\n");
+ flow->l4.tcp.vnc_stage = 1 + packet->packet_direction;
+ return;
+ }
+ } else if(flow->l4.tcp.vnc_stage == 2 - packet->packet_direction) {
+
+ if(packet->payload_packet_len == 12 &&
+ (memcmp(packet->payload, "RFB 003.003", 11) == 0 && packet->payload[11] == 0x0a) ||
+ (memcmp(packet->payload, "RFB 003.007", 11) == 0 && packet->payload[11] == 0x0a) ||
+ (memcmp(packet->payload, "RFB 003.008", 11) == 0 && packet->payload[11] == 0x0a) ||
+ (memcmp(packet->payload, "RFB 004.001", 11) == 0 && packet->payload[11] == 0x0a)) {
+
+ NDPI_LOG(NDPI_PROTOCOL_VNC, ndpi_struct, NDPI_LOG_DEBUG, "found vnc\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VNC, NDPI_PROTOCOL_UNKNOWN);
+ return;
+ }
}
}
+ /* exclude VNC */
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VNC);
-
}
@@ -74,7 +71,7 @@ void init_vnc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int3
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
ADD_TO_DETECTION_BITMASK);
-
+
*id += 1;
}
diff --git a/src/lib/protocols/xbox.c b/src/lib/protocols/xbox.c
index 7fad5ced9..92f68fc34 100644
--- a/src/lib/protocols/xbox.c
+++ b/src/lib/protocols/xbox.c
@@ -1,8 +1,7 @@
/*
* xbox.c
*
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2016 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -22,8 +21,8 @@
*
*/
-
#include "ndpi_protocols.h"
+
#ifdef NDPI_PROTOCOL_XBOX
static void ndpi_int_xbox_add_connection(struct ndpi_detection_module_struct
@@ -41,13 +40,11 @@ void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct n
// struct ndpi_id_struct *dst = flow->dst;
/*
- * THIS IS TH XBOX UDP DETCTION ONLY !!!
- * the xbox tcp detection is done by http code
+ * XBOX UDP DETCTION ONLY
+ * the xbox TCP detection is done by http code
+ * this detection also works for asymmetric xbox udp traffic
*/
-
-
- /* this detection also works for asymmetric xbox udp traffic */
- if (packet->udp != NULL) {
+ if(packet->udp != NULL) {
u_int16_t dport = ntohs(packet->udp->dest);
u_int16_t sport = ntohs(packet->udp->source);
@@ -88,11 +85,9 @@ void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct n
}
/* exclude here all non matched udp traffic, exclude here tcp only if http has been excluded, because xbox could use http */
- if (packet->tcp == NULL
#ifdef NDPI_PROTOCOL_HTTP
- || NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0
+ if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) {
#endif
- ) {
NDPI_LOG(NDPI_PROTOCOL_XBOX, ndpi_struct, NDPI_LOG_DEBUG, "xbox udp excluded.\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_XBOX);
}
diff --git a/src/lib/protocols/zeromq.c b/src/lib/protocols/zeromq.c
index f4780b334..f069bba09 100644
--- a/src/lib/protocols/zeromq.c
+++ b/src/lib/protocols/zeromq.c
@@ -88,8 +88,8 @@ void ndpi_search_zmq(struct ndpi_detection_module_struct *ndpi_struct, struct nd
NDPI_LOG(NDPI_PROTOCOL_ZMQ, ndpi_struct, NDPI_LOG_TRACE, "ZMQ detection...\n");
/* skip marked packets */
- if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_ZMQ) {
- if (packet->tcp_retransmission == 0) {
+ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_ZMQ) {
+ if(packet->tcp && packet->tcp_retransmission == 0) {
ndpi_check_zmq(ndpi_struct, flow);
}
}
diff --git a/tests/pcap/vnc.pcap b/tests/pcap/vnc.pcap
new file mode 100644
index 000000000..5c7a73eb0
--- /dev/null
+++ b/tests/pcap/vnc.pcap
Binary files differ
diff --git a/tests/result/hangout.pcap.out b/tests/result/hangout.pcap.out
index 481ddfe3c..817d11220 100644
--- a/tests/result/hangout.pcap.out
+++ b/tests/result/hangout.pcap.out
@@ -1,3 +1,3 @@
GoogleHangout 19 2774 1
- 1 UDP 10.89.61.13:56406 <-> 74.125.134.127:19305 [proto: 215/GoogleHangout][19 pkts/2774 bytes]
+ 1 UDP 10.89.61.13:56406 <-> 74.125.134.127:19305 [proto: 214/GoogleHangout][19 pkts/2774 bytes]
diff --git a/tests/result/http_ipv6.pcap.out b/tests/result/http_ipv6.pcap.out
index 9f495c49c..3e2c6fe60 100644
--- a/tests/result/http_ipv6.pcap.out
+++ b/tests/result/http_ipv6.pcap.out
@@ -5,10 +5,10 @@ QUIC 3 502 1
ntop 80 36401 4
1 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:33062 <-> [2a00:1450:400b:c02::9a]:443 [proto: 91/SSL][2 pkts/172 bytes]
- 2 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37486 [proto: 91.217/SSL.ntop][19 pkts/7014 bytes][SSL client: www.ntop.org]
- 3 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37488 [proto: 91.217/SSL.ntop][17 pkts/6842 bytes][SSL client: www.ntop.org]
- 4 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37494 [proto: 91.217/SSL.ntop][18 pkts/6928 bytes][SSL client: www.ntop.org]
- 5 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37506 [proto: 91.217/SSL.ntop][26 pkts/15617 bytes][SSL client: www.ntop.org]
+ 2 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37486 [proto: 91.216/SSL.ntop][19 pkts/7014 bytes][SSL client: www.ntop.org]
+ 3 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37488 [proto: 91.216/SSL.ntop][17 pkts/6842 bytes][SSL client: www.ntop.org]
+ 4 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37494 [proto: 91.216/SSL.ntop][18 pkts/6928 bytes][SSL client: www.ntop.org]
+ 5 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a03:b0c0:3:d0::70:1001]:37506 [proto: 91.216/SSL.ntop][26 pkts/15617 bytes][SSL client: www.ntop.org]
6 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4006:804::200e]:40526 [proto: 91/SSL][2 pkts/172 bytes]
7 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a00:1450:4001:803::1017]:41776 [proto: 91/SSL][14 pkts/2213 bytes]
8 TCP [2a00:d40:1:3:7aac:c0ff:fea7:d4c]:443 <-> [2a02:26f0:ad:197::236]:53132 [proto: 91.119/SSL.Facebook][12 pkts/5187 bytes][SSL client: s-static.ak.facebook.com]
diff --git a/tests/result/mpeg.pcap.out b/tests/result/mpeg.pcap.out
index 12b3d1ad5..a2c210473 100644
--- a/tests/result/mpeg.pcap.out
+++ b/tests/result/mpeg.pcap.out
@@ -1,3 +1,3 @@
ntop 19 10643 1
- 1 TCP 46.101.157.119:80 <-> 192.168.80.160:55804 [proto: 7.217/HTTP.ntop][19 pkts/10643 bytes][Host: luca.ntop.org]
+ 1 TCP 46.101.157.119:80 <-> 192.168.80.160:55804 [proto: 7.216/HTTP.ntop][19 pkts/10643 bytes][Host: luca.ntop.org]
diff --git a/tests/result/vnc.pcap.out b/tests/result/vnc.pcap.out
new file mode 100644
index 000000000..ad20b1441
--- /dev/null
+++ b/tests/result/vnc.pcap.out
@@ -0,0 +1,4 @@
+VNC 4551 329158 2
+
+ 1 TCP 192.168.2.110:6900 <-> 95.237.48.208:51559 [proto: 89/VNC][1008 pkts/72613 bytes]
+ 2 TCP 192.168.2.110:6900 <-> 95.237.48.208:59791 [proto: 89/VNC][3543 pkts/256545 bytes]
Powered by cgit, Themed by Ted Yin.