diff options
| -rw-r--r-- | example/reader_util.c | 4 | ||||
| -rw-r--r-- | src/lib/protocols/whatsapp.c | 66 | ||||
| -rw-r--r-- | tests/pcap/whatsapp.pcap | bin | 0 -> 12234 bytes | |||
| -rw-r--r-- | tests/result/whatsapp.pcap.out | 12 |
4 files changed, 80 insertions, 2 deletions
diff --git a/example/reader_util.c b/example/reader_util.c index 730d14625..278ec63d7 100644 --- a/example/reader_util.c +++ b/example/reader_util.c @@ -1118,7 +1118,9 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl ndpi_snprintf(flow->http.request_content_type, sizeof(flow->http.request_content_type), "%s", flow->ndpi_flow->http.request_content_type ? flow->ndpi_flow->http.request_content_type : ""); ndpi_snprintf(flow->http.user_agent, sizeof(flow->http.user_agent), "%s", flow->ndpi_flow->http.user_agent ? flow->ndpi_flow->http.user_agent : ""); } - } else if(is_ndpi_proto(flow, NDPI_PROTOCOL_SSDP)) { + } else if(is_ndpi_proto(flow, NDPI_PROTOCOL_SSDP) || + (flow->detected_protocol.master_protocol != NDPI_PROTOCOL_TLS && + is_ndpi_proto(flow, NDPI_PROTOCOL_WHATSAPP))) { ndpi_snprintf(flow->http.user_agent, sizeof(flow->http.user_agent), "%s", flow->ndpi_flow->http.user_agent ? flow->ndpi_flow->http.user_agent : ""); } else if(is_ndpi_proto(flow, NDPI_PROTOCOL_TELNET)) { if(flow->ndpi_flow->protos.telnet.username[0] != '\0') diff --git a/src/lib/protocols/whatsapp.c b/src/lib/protocols/whatsapp.c index 412caf957..6202a85ab 100644 --- a/src/lib/protocols/whatsapp.c +++ b/src/lib/protocols/whatsapp.c @@ -23,8 +23,53 @@ #include "ndpi_api.h" +static void ndpi_whatsapp_dissect_extra(struct ndpi_flow_struct * const flow, + u_int8_t const * const payload, + u_int32_t payload_len) +{ + size_t offset = 18; + + while (offset + 1 < payload_len) + { + u_int8_t op = payload[offset]; + u_int8_t len = payload[offset + 1]; + + offset += 2; + if (offset + len >= payload_len) + { + break; + } + + switch (op) + { + case 0x28: + case 0x08: + break; + + case 0x12: + flow->http.user_agent = ndpi_malloc(len + 1); + if (flow->http.user_agent != NULL) + { + memcpy(flow->http.user_agent, &payload[offset], len); + flow->http.user_agent[len] = '\0'; + } + offset += len; + break; + + case 0x3a: + ndpi_hostname_sni_set(flow, &payload[offset], len); + break; + + default: + offset += len; + break; + } + } +} + void ndpi_search_whatsapp(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) { + struct ndpi_flow_struct *flow) +{ struct ndpi_packet_struct *packet = &ndpi_struct->packet; static u_int8_t whatsapp_sequence[] = { 0x45, 0x44, 0x0, 0x01, 0x0, 0x0, 0x02, 0x08, @@ -36,6 +81,25 @@ void ndpi_search_whatsapp(struct ndpi_detection_module_struct *ndpi_struct, NDPI_LOG_DBG(ndpi_struct, "search WhatsApp\n"); + if (packet->payload_packet_len == 4 && ntohl(get_u_int32_t(packet->payload, 0)) == 0x45440001) + { + NDPI_LOG_INFO(ndpi_struct, "found WhatsApp preface\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); + return; + } + + if (packet->payload_packet_len >= 32 && + ntohs(get_u_int16_t(packet->payload, 0)) == 0xc2fe && + packet->payload[3] == 0x05 && + ntohl(get_u_int32_t(packet->payload, 8)) == 0x00020016 && + packet->payload[16] == 0x08) + { + NDPI_LOG_INFO(ndpi_struct, "found WhatsApp (additional info available)\n"); + ndpi_whatsapp_dissect_extra(flow, packet->payload, packet->payload_packet_len); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); + return; + } + /* This is a very old sequence (2015?) but we still have it in our unit tests. Try to detect it, without too much effort... */ if(flow->l4.tcp.wa_matched_so_far == 0 && diff --git a/tests/pcap/whatsapp.pcap b/tests/pcap/whatsapp.pcap Binary files differnew file mode 100644 index 000000000..0289cd31b --- /dev/null +++ b/tests/pcap/whatsapp.pcap diff --git a/tests/result/whatsapp.pcap.out b/tests/result/whatsapp.pcap.out new file mode 100644 index 000000000..ed9667d0b --- /dev/null +++ b/tests/result/whatsapp.pcap.out @@ -0,0 +1,12 @@ +Guessed flow protos: 0 + +DPI Packets (TCP): 20 (4.00 pkts/flow) +Confidence DPI : 5 (flows) + +WhatsApp 75 11010 5 + + 1 TCP 192.168.2.100:45106 <-> 18.193.233.122:5222 [proto: 142/WhatsApp][Encrypted][Confidence: DPI][cat: Chat/9][8 pkts/2061 bytes <-> 7 pkts/1063 bytes][Goodput ratio: 74/56][359.14 sec][Hostname/SNI: fr-app-chat-global-xiaomi-net2-2117517874.eu-central-1.elb.amazonaws.com][bytes ratio: 0.319 (Upload)][IAT c2s/s2c min/avg/max/stddev: 7/1 59816/100 358553/211 133599/79][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 258/152 1014/488 311/142][User-Agent: Redmi Note 8T][PLAIN TEXT (xiaomi.com)][Plen Bins: 14,0,14,14,0,0,14,0,0,0,14,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,14,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 TCP 192.168.2.100:37708 <-> 3.127.176.74:5222 [proto: 142/WhatsApp][Encrypted][Confidence: DPI][cat: Chat/9][8 pkts/1983 bytes <-> 7 pkts/641 bytes][Goodput ratio: 73/27][455.15 sec][Hostname/SNI: fr-app-chat-global-xiaomi-net1-1667981913.eu-central-1.elb.amazonaws.com:5222][bytes ratio: 0.511 (Upload)][IAT c2s/s2c min/avg/max/stddev: 2/0 75808/90740 453408/453409 168869/181335][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 248/92 999/171 303/39][User-Agent: Redmi Note 9 Pro][PLAIN TEXT (xiaomi.com)][Plen Bins: 16,0,16,16,0,0,0,16,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 3 TCP 192.168.2.100:47918 <-> 179.60.195.33:5222 [proto: 142/WhatsApp][Encrypted][Confidence: DPI][cat: Chat/9][8 pkts/1796 bytes <-> 7 pkts/584 bytes][Goodput ratio: 70/19][0.31 sec][bytes ratio: 0.509 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/55 34/231 12/89][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 224/83 1311/123 411/25][Plen Bins: 50,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0] + 4 TCP 192.168.2.100:46244 <-> 157.240.201.61:5222 [proto: 142/WhatsApp][Encrypted][Confidence: DPI][cat: Chat/9][8 pkts/859 bytes <-> 7 pkts/584 bytes][Goodput ratio: 38/19][0.35 sec][bytes ratio: 0.191 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 7/0 54/58 150/122 49/50][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 107/83 345/123 91/25][Plen Bins: 33,50,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 5 TCP 192.168.2.100:56119 <-> 179.60.195.49:5222 [proto: 142/WhatsApp][Encrypted][Confidence: DPI][cat: Chat/9][8 pkts/855 bytes <-> 7 pkts/584 bytes][Goodput ratio: 37/19][0.32 sec][bytes ratio: 0.188 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 1/0 49/46 173/113 59/38][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 107/83 341/123 89/25][Plen Bins: 33,50,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |