aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rwxr-xr-xautogen.sh5
-rw-r--r--configure.ac33
-rw-r--r--example/ndpiReader.c25
-rw-r--r--src/include/ndpi_typedefs.h54
-rw-r--r--src/lib/Makefile.am4
-rw-r--r--src/lib/ndpi_content_match.c.inc7
-rw-r--r--src/lib/ndpi_main.c10
-rw-r--r--src/lib/protocols/dns.c2
-rw-r--r--src/lib/protocols/quic.c197
-rw-r--r--src/lib/protocols/redis_net.c (renamed from src/lib/protocols/redis.c)0
-rw-r--r--src/lib/protocols/warcraft3.c2
-rw-r--r--src/lib/protocols/zeromq.c (renamed from src/lib/protocols/zmq.c)0
-rw-r--r--src/lib/third_party/include/ndpi_patricia.h (renamed from src/lib/third_party/include/patricia.h)22
-rw-r--r--src/lib/third_party/src/ndpi_patricia.c (renamed from src/lib/third_party/src/patricia.c)39
-rwxr-xr-xtests/do.sh5
-rw-r--r--tests/pcap/skype.pcapbin0 -> 699646 bytes
-rw-r--r--tests/pcap/skype_no_unknown.pcapbin0 -> 526100 bytes
-rw-r--r--tests/result/quic.pcap.out2
-rw-r--r--tests/result/skype.pcap.out13
-rw-r--r--tests/result/skype_no_unknown.pcap.out11
20 files changed, 242 insertions, 189 deletions
diff --git a/autogen.sh b/autogen.sh
index 9853e65ef..7f109b0a5 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,7 +1,6 @@
#!/bin/sh
-#
-# 1.5.1 r8171 06/09/2014
-#
+
+/bin/rm -f configure config.h config.h.in src/lib/Makefile.in
autoreconf -ivf
./configure
diff --git a/configure.ac b/configure.ac
index 7c80bdf06..598c0a22b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,32 +10,33 @@ AC_PROG_CC
AX_PTHREAD
if test -d ".git"; then :
-GIT_TAG=`git rev-parse HEAD`
-GIT_DATE=`date +%Y%m%d`
-GIT_RELEASE="${PACKAGE_VERSION} (${GIT_TAG}:${GIT_DATE})"
+ GIT_TAG=`git log -1 --format=%h`
+ GIT_DATE=`git log -1 --format=%cd`
+ GIT_NUM=`git rev-list HEAD --count`
+ GIT_BRANCH=`git rev-parse --abbrev-ref HEAD`
+ GIT_RELEASE="${PACKAGE_VERSION}-${GIT_BRANCH}-${GIT_NUM}-${GIT_TAG}"
else
-GIT_RELEASE="${PACKAGE_VERSION}"
-SVN_DATE=`date`
+ GIT_RELEASE="${PACKAGE_VERSION}"
+ GIT_DATE=`date`
fi
-AC_DEFINE_UNQUOTED(NDPI_GIT_RELEASE, "r${GIT_RELEASE}", [SVN Release])
-AC_DEFINE_UNQUOTED(NDPI_SVN_DATE, "${SVN_DATE}", [Last SVN change])
+AC_DEFINE_UNQUOTED(NDPI_GIT_RELEASE, "${GIT_RELEASE}", [GIT Release])
+AC_DEFINE_UNQUOTED(NDPI_GIT_DATE, "${GIT_DATE}", [Last GIT change])
AC_CHECK_HEADERS([netinet/in.h stdint.h stdlib.h string.h unistd.h])
PCAP_HOME=$HOME/PF_RING/userland
if test -d $PCAP_HOME; then :
- echo -n ""
+ echo -n ""
else
- PCAP_HOME=`pwd`/../../PF_RING/userland
+ PCAP_HOME=`pwd`/../../PF_RING/userland
fi
-
SHORT_MACHINE=`uname -m | cut -b1-3`
if test $SHORT_MACHINE = "arm"; then
-LIBNUMA=""
+ LIBNUMA=""
else
-LIBNUMA="-lnuma"
+ LIBNUMA="-lnuma"
fi
if test -f $PCAP_HOME/libpcap/libpcap.a; then :
@@ -57,11 +58,11 @@ else
fi
if test -d /usr/local/include/json-c/; then :
- CFLAGS="$CFLAGS -I/usr/local/include/json-c/"
- LDFLAGS="$LDFLAGS -L/usr/local/lib -ljson-c"
+ CFLAGS="$CFLAGS -I/usr/local/include/json-c/"
+ LDFLAGS="$LDFLAGS -L/usr/local/lib -ljson-c"
else
- CFLAGS="$CFLAGS $(pkg-config --cflags json-c)"
- LDFLAGS="$LDFLAGS $(pkg-config --libs json-c)"
+ CFLAGS="$CFLAGS $(pkg-config --cflags json-c)"
+ LDFLAGS="$LDFLAGS $(pkg-config --libs json-c)"
fi
OLD_LIBS=$LIBS
diff --git a/example/ndpiReader.c b/example/ndpiReader.c
index 84bece123..558d204ed 100644
--- a/example/ndpiReader.c
+++ b/example/ndpiReader.c
@@ -160,7 +160,7 @@ static u_int32_t size_id_struct = 0; //< ID tracking structure size
#endif
// flow tracking
-typedef struct ndpi_flow {
+typedef struct ndpi_flow {
u_int32_t lower_ip;
u_int32_t upper_ip;
u_int16_t lower_port;
@@ -208,6 +208,7 @@ static void help(u_int long_help) {
" -d | Disable protocol guess and use only DPI\n"
" -q | Quiet mode\n"
" -t | Dissect GTP tunnels\n"
+ " -r | Print nDPI version and git revision\n"
" -w <path> | Write test output on the specified file. This is useful for\n"
" | testing purposes in order to compare results across runs\n"
" -h | This help\n"
@@ -232,7 +233,7 @@ static void parseOptions(int argc, char **argv) {
u_int num_cores = sysconf(_SC_NPROCESSORS_ONLN);
#endif
- while ((opt = getopt(argc, argv, "df:g:i:hp:l:s:tv:V:n:j:w:q")) != EOF) {
+ while ((opt = getopt(argc, argv, "df:g:i:hp:l:s:tv:V:n:j:rp:w:q")) != EOF) {
switch (opt) {
case 'd':
enable_protocol_guess = 0;
@@ -271,6 +272,10 @@ static void parseOptions(int argc, char **argv) {
decode_tunnels = 1;
break;
+ case 'r':
+ printf("ndpiReader - nDPI (%s)\n", ndpi_revision());
+ exit(0);
+
case 'v':
verbose = atoi(optarg);
break;
@@ -304,7 +309,7 @@ static void parseOptions(int argc, char **argv) {
case 'q':
quiet_mode = 1;
break;
-
+
default:
help(0);
break;
@@ -637,7 +642,7 @@ static void node_idle_scan_walker(const void *node, ndpi_VISIT which, int depth,
if (flow->detected_protocol == 0 /* UNKNOWN */ && !undetected_flows_deleted)
undetected_flows_deleted = 1;
-
+
free_ndpi_flow(flow);
ndpi_thread_info[thread_id].stats.ndpi_flow_count--;
@@ -866,7 +871,7 @@ static struct ndpi_flow *get_ndpi_flow6(u_int16_t thread_id,
if(iph.protocol == 0x3C /* IPv6 destination option */) {
u_int8_t *options = (u_int8_t*)iph6 + sizeof(const struct ndpi_ip6_hdr);
-
+
iph.protocol = options[0];
}
@@ -884,7 +889,7 @@ static void setupDetection(u_int16_t thread_id) {
memset(&ndpi_thread_info[thread_id], 0, sizeof(ndpi_thread_info[thread_id]));
// init global detection structure
- ndpi_thread_info[thread_id].ndpi_struct = ndpi_init_detection_module(detection_tick_resolution,
+ ndpi_thread_info[thread_id].ndpi_struct = ndpi_init_detection_module(detection_tick_resolution,
malloc_wrapper, free_wrapper, debug_printf);
if(ndpi_thread_info[thread_id].ndpi_struct == NULL) {
printf("ERROR: global structure initialization failed\n");
@@ -978,14 +983,14 @@ static unsigned int packet_processing(u_int16_t thread_id,
}
if((
- (flow->detected_protocol == NDPI_PROTOCOL_HTTP)
+ (flow->detected_protocol == NDPI_PROTOCOL_HTTP)
|| (flow->detected_protocol == NDPI_SERVICE_FACEBOOK)
)
&& full_http_dissection) {
char *method;
printf("[URL] %s\n", ndpi_get_http_url(ndpi_thread_info[thread_id].ndpi_struct, ndpi_flow));
- printf("[Content-Type] %s\n", ndpi_get_http_content_type(ndpi_thread_info[thread_id].ndpi_struct, ndpi_flow));
+ printf("[Content-Type] %s\n", ndpi_get_http_content_type(ndpi_thread_info[thread_id].ndpi_struct, ndpi_flow));
switch(ndpi_get_http_method(ndpi_thread_info[thread_id].ndpi_struct, ndpi_flow)) {
case HTTP_METHOD_OPTIONS: method = "HTTP_METHOD_OPTIONS"; break;
@@ -1271,7 +1276,7 @@ static void printResults(u_int64_t tot_usec) {
ndpi_get_proto_name(ndpi_thread_info[0].ndpi_struct, i),
(long long unsigned int)cumulative_stats.protocol_counter[i],
(long long unsigned int)cumulative_stats.protocol_counter_bytes[i],
- cumulative_stats.protocol_flows[i]);
+ cumulative_stats.protocol_flows[i]);
if((!json_flag) && (!quiet_mode)) {
printf("\t%-20s packets: %-13llu bytes: %-13llu "
@@ -1594,7 +1599,7 @@ static void pcap_packet_callback(u_char *args, const struct pcap_pkthdr *header,
if(proto == 0x3C /* IPv6 destination option */) {
u_int8_t *options = (u_int8_t*)&packet[ip_offset+ip_len];
-
+
proto = options[0];
ip_len += 8 * (options[1] + 1);
}
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 5bdd5a6e6..1afca2138 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -32,8 +32,8 @@ typedef enum {
} ndpi_log_level_t;
typedef void (*ndpi_debug_function_ptr) (u_int32_t protocol,
- void *module_struct, ndpi_log_level_t log_level,
- const char *format, ...);
+ void *module_struct, ndpi_log_level_t log_level,
+ const char *format, ...);
#define BT_ANNOUNCE
typedef enum {
@@ -102,43 +102,43 @@ typedef union {
#ifdef NDPI_PROTOCOL_BITTORRENT
#ifndef __KERNEL__
typedef struct spinlock {
- volatile int val;
+ volatile int val;
} spinlock_t;
typedef struct atomic {
- volatile int counter;
+ volatile int counter;
} atomic_t;
#endif
struct hash_ip4p_node {
- struct hash_ip4p_node *next,*prev;
- time_t lchg;
- u_int16_t port,count:12,flag:4;
- u_int32_t ip;
- // + 12 bytes for ipv6
+ struct hash_ip4p_node *next,*prev;
+ time_t lchg;
+ u_int16_t port,count:12,flag:4;
+ u_int32_t ip;
+ // + 12 bytes for ipv6
};
struct hash_ip4p {
- struct hash_ip4p_node *top;
- spinlock_t lock;
- size_t len;
+ struct hash_ip4p_node *top;
+ spinlock_t lock;
+ size_t len;
};
struct hash_ip4p_table {
- size_t size;
- int ipv6;
- spinlock_t lock;
- atomic_t count;
- struct hash_ip4p tbl[0];
+ size_t size;
+ int ipv6;
+ spinlock_t lock;
+ atomic_t count;
+ struct hash_ip4p tbl;
};
struct bt_announce { // 192 bytes
- u_int32_t hash[5];
- u_int32_t ip[4];
- u_int32_t time;
- u_int16_t port;
- u_int8_t name_len,
- name[192 - 4*10 - 2 - 1]; // 149 bytes
+ u_int32_t hash[5];
+ u_int32_t ip[4];
+ u_int32_t time;
+ u_int16_t port;
+ u_int8_t name_len,
+ name[192 - 4*10 - 2 - 1]; // 149 bytes
};
#endif
@@ -174,7 +174,7 @@ typedef struct ndpi_id_struct {
u_int32_t yahoo_video_lan_timer;
#endif
#endif
-/* NDPI_PROTOCOL_IRC_MAXPORT % 2 must be 0 */
+ /* NDPI_PROTOCOL_IRC_MAXPORT % 2 must be 0 */
#ifdef NDPI_PROTOCOL_IRC
#define NDPI_PROTOCOL_IRC_MAXPORT 8
u_int16_t irc_port[NDPI_PROTOCOL_IRC_MAXPORT];
@@ -518,8 +518,8 @@ typedef struct ndpi_packet_struct {
u_int8_t ssl_certificate_detected:4, ssl_certificate_num_checks:4;
u_int8_t packet_lines_parsed_complete:1,
- packet_direction:1,
- empty_line_position_set:1;
+ packet_direction:1,
+ empty_line_position_set:1;
} ndpi_packet_struct_t;
struct ndpi_detection_module_struct;
@@ -710,7 +710,7 @@ typedef struct ndpi_flow_struct {
Pointer to src or dst
that identifies the
server of this connection
- */
+ */
#ifndef __KERNEL__
u_char host_server_name[256]; /* HTTP host or DNS query */
#else
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index ed83ae5e0..86aeb6c68 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -96,7 +96,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/quic.c \
protocols/radius.c \
protocols/rdp.c \
- protocols/redis.c \
+ protocols/redis_net.c \
protocols/rsync.c \
protocols/rtcp.c \
protocols/rtmp.c \
@@ -149,7 +149,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/xdmcp.c \
protocols/yahoo.c \
protocols/zattoo.c \
- protocols/zmq.c \
+ protocols/zeromq.c \
third_party/include/actypes.h \
third_party/include/ahocorasick.h \
third_party/include/node.h \
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 3b4693fc3..1a7f8eef6 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -72,12 +72,14 @@ static ndpi_network host_protocol_list[] = {
{ 0x6CA0A000 /* 108.160.160.0 */, 20, NDPI_PROTOCOL_DROPBOX },
/*
- Skype
+ Skype (Microsoft CDN)
157.56.0.0/14, 157.60.0.0/16, 157.54.0.0/15
+ 111.221.64.0 - 111.221.127.255
*/
{ 0x9D380000 /* 157.56.0.0 */, 14, NDPI_PROTOCOL_SKYPE },
{ 0x9D3C0000 /* 157.60.0.0 */, 16, NDPI_PROTOCOL_SKYPE },
- { 0x9D360000 /* 157.54.0.0/ */, 15, NDPI_PROTOCOL_SKYPE },
+ { 0x9D360000 /* 157.54.0.0 */, 15, NDPI_PROTOCOL_SKYPE },
+ { 0x6FDD4000 /* 111.221.64.0 */, 18, NDPI_PROTOCOL_SKYPE },
/*
Google
@@ -258,6 +260,7 @@ static ndpi_network host_protocol_list[] = {
{ 0xD820F200, 24, NDPI_PROTOCOL_SKYPE },
{ 0xD821F000, 22, NDPI_PROTOCOL_SKYPE },
{ 0xD4A10800, 24, NDPI_PROTOCOL_SKYPE },
+
{ 0x012A1231, 32, NDPI_PROTOCOL_TOR },
{ 0x01E69FA1, 32, NDPI_PROTOCOL_TOR },
{ 0x020DE985, 32, NDPI_PROTOCOL_TOR },
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index b7ba63330..d8047825b 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -49,8 +49,8 @@
#endif
#include "ndpi_content_match.c.inc"
-#include "third_party/include/patricia.h"
-#include "third_party/src/patricia.c"
+#include "third_party/include/ndpi_patricia.h"
+#include "third_party/src/ndpi_patricia.c"
#ifdef WIN32
/* http://social.msdn.microsoft.com/Forums/uk/vcgeneral/thread/963aac07-da1a-4612-be4a-faac3f1d65ca */
@@ -1682,6 +1682,7 @@ static int fill_prefix_v4(prefix_t *p, struct in_addr *a, int b, int mb) {
if(b < 0 || b > mb)
return(-1);
+ memset(p, 0, sizeof(prefix_t));
memcpy(&p->add.sin, a, (mb+7)/8);
p->family = AF_INET;
p->bitlen = b;
@@ -1697,6 +1698,7 @@ u_int16_t ndpi_network_ptree_match(struct ndpi_detection_module_struct *ndpi_str
prefix_t prefix;
patricia_node_t *node;
+ pin->s_addr = ntohl(pin->s_addr); /* Make sure all in network byte order otherwise compares wont work */
fill_prefix_v4(&prefix, pin, 32, ((patricia_tree_t*)ndpi_struct->protocols_ptree)->maxbits);
node = ndpi_patricia_search_best(ndpi_struct->protocols_ptree, &prefix);
@@ -1760,7 +1762,7 @@ static void ndpi_init_ptree_ipv4(struct ndpi_detection_module_struct *ndpi_str,
struct in_addr pin;
patricia_node_t *node;
- pin.s_addr = host_list[i].network;
+ pin.s_addr = ntohl(host_list[i].network);
if((node = add_to_ptree(ptree, AF_INET, &pin, host_list[i].cidr /* bits */)) != NULL)
node->value.user_value = host_list[i].value;
}
@@ -4226,7 +4228,7 @@ unsigned int ndpi_detection_process_packet(struct ndpi_detection_module_struct *
flow->packet.tick_timestamp = d;
}
#else
- flow->packet.tick_timestamp = current_tick_l/1000;
+ flow->packet.tick_timestamp = (u_int32_t)current_tick_l/1000;
#endif
/* parse packet */
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index 071039340..631514afd 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -246,7 +246,7 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
j++, i++;
}
- if(a_record != 0) {
+ if(a_record[0] != 0) {
char a_buf[32];
int i;
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index 2e1ad6628..3180ef28b 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -46,111 +46,118 @@
static void ndpi_int_quic_add_connection(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow)
{
- ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_REAL_PROTOCOL);
+ ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_REAL_PROTOCOL);
}
-int connect_id(const unsigned char pflags)
+static int connect_id(const unsigned char pflags)
{
- u_int cid_len;
+ u_int cid_len;
- // Check CID length.
- switch (pflags & QUIC_CID_MASK)
- {
- case CID_LEN_8: cid_len = 8; break;
- case CID_LEN_4: cid_len = 4; break;
- case CID_LEN_1: cid_len = 1; break;
- case CID_LEN_0: cid_len = 0; break;
- default:
- return -1;
-
- }
- // Return offset.
- return cid_len + 1;
+ // Check CID length.
+ switch (pflags & QUIC_CID_MASK)
+ {
+ case CID_LEN_8: cid_len = 8; break;
+ case CID_LEN_4: cid_len = 4; break;
+ case CID_LEN_1: cid_len = 1; break;
+ case CID_LEN_0: cid_len = 0; break;
+ default:
+ return -1;
+
+ }
+ // Return offset.
+ return cid_len + 1;
}
-int sequence(const unsigned char *payload)
+static int sequence(const unsigned char *payload)
{
- unsigned char conv[6] = {0};
- u_int seq_value = -1;
- u_int seq_lens;
- u_int cid_offs;
- int i;
-
- // Search SEQ bytes length.
- switch (payload[0] & QUIC_SEQ_MASK)
- {
- case SEQ_LEN_6: seq_lens = 6; break;
- case SEQ_LEN_4: seq_lens = 4; break;
- case SEQ_LEN_2: seq_lens = 2; break;
- case SEQ_LEN_1: seq_lens = 1; break;
- default:
- return -1;
- }
- // Retrieve SEQ offset.
- cid_offs = connect_id(payload[0]);
-
- if (cid_offs >= 0 && seq_lens > 0)
- {
- for (i = 0; i < seq_lens; i++)
- conv[i] = payload[cid_offs + i];
-
- seq_value = SEQ_CONV(conv);
- }
- // Return SEQ dec value;
- return seq_value;
+ unsigned char conv[6] = {0};
+ u_int seq_value = -1;
+ int seq_lens;
+ int cid_offs;
+ int i;
+
+ // Search SEQ bytes length.
+ switch (payload[0] & QUIC_SEQ_MASK)
+ {
+ case SEQ_LEN_6: seq_lens = 6; break;
+ case SEQ_LEN_4: seq_lens = 4; break;
+ case SEQ_LEN_2: seq_lens = 2; break;
+ case SEQ_LEN_1: seq_lens = 1; break;
+ default:
+ return -1;
+ }
+ // Retrieve SEQ offset.
+ cid_offs = connect_id(payload[0]);
+
+ if (cid_offs >= 0 && seq_lens > 0)
+ {
+ for (i = 0; i < seq_lens; i++)
+ conv[i] = payload[cid_offs + i];
+
+ seq_value = SEQ_CONV(conv);
+ }
+ // Return SEQ dec value;
+ return seq_value;
}
void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
- struct ndpi_packet_struct *packet = &flow->packet;
- u_int ver_offs;
-
- if(packet->udp != NULL) {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating quic over udp.\n");
-
- // Settings without version. First check if PUBLIC FLAGS & SEQ bytes are 0x0. SEQ must be 1 at least.
- if ((packet->payload[0] == 0x00 && packet->payload[1] != 0x00) || ((packet->payload[0] & QUIC_NO_V_RES_RSV) == 0))
- {
- if (sequence(packet->payload) < 1)
- {
-
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
- }
-
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
- ndpi_int_quic_add_connection(ndpi_struct, flow);
- }
-
- // Check if version, than the CID length.
- else if (packet->payload[0] & QUIC_VER_MASK)
- {
- // Skip CID length.
- ver_offs = connect_id(packet->payload[0]);
-
- if (ver_offs >= 0){
- unsigned char vers[] = {packet->payload[ver_offs], packet->payload[ver_offs + 1],
- packet->payload[ver_offs + 2], packet->payload[ver_offs + 3]};
-
- // Version Match.
- if (vers[0] == 'Q' && vers[1] == '0' &&
- (vers[2] == '2' && (vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
- vers[3] == '1' || vers[3] == '0')) ||
- (vers[2] == '1' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
- vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
- vers[3] == '1' || vers[3] == '0')) ||
- (vers[2] == '0' && vers[3] == '9'))
-
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
- ndpi_int_quic_add_connection(ndpi_struct, flow);
- }
- }
- } else
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
- }
- }
+ struct ndpi_packet_struct *packet = &flow->packet;
+ int ver_offs;
+
+ if(packet->udp != NULL) {
+ u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
+
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating quic over udp.\n");
+
+ if(((packet->payload[0] & 0xF0) != 0)
+ || (!(sport == 80 || dport == 80 || sport == 443 || dport == 443)))
+ goto exclude_quic;
+
+ // Settings without version. First check if PUBLIC FLAGS & SEQ bytes are 0x0. SEQ must be 1 at least.
+ if ((packet->payload[0] == 0x00 && packet->payload[1] != 0x00) || ((packet->payload[0] & QUIC_NO_V_RES_RSV) == 0))
+ {
+ if (sequence(packet->payload) < 1)
+ {
+
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
+ }
+
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
+ ndpi_int_quic_add_connection(ndpi_struct, flow);
+ }
+
+ // Check if version, than the CID length.
+ else if (packet->payload[0] & QUIC_VER_MASK)
+ {
+ // Skip CID length.
+ ver_offs = connect_id(packet->payload[0]);
+
+ if (ver_offs >= 0){
+ unsigned char vers[] = {packet->payload[ver_offs], packet->payload[ver_offs + 1],
+ packet->payload[ver_offs + 2], packet->payload[ver_offs + 3]};
+
+ // Version Match.
+ if (vers[0] == 'Q' && vers[1] == '0' &&
+ (vers[2] == '2' && (vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
+ vers[3] == '1' || vers[3] == '0')) ||
+ (vers[2] == '1' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
+ vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
+ vers[3] == '1' || vers[3] == '0')) ||
+ (vers[2] == '0' && vers[3] == '9'))
+
+ {
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
+ ndpi_int_quic_add_connection(ndpi_struct, flow);
+ }
+ }
+ } else
+ {
+ exclude_quic:
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
+ }
+ }
}
#endif
diff --git a/src/lib/protocols/redis.c b/src/lib/protocols/redis_net.c
index a47778b48..a47778b48 100644
--- a/src/lib/protocols/redis.c
+++ b/src/lib/protocols/redis_net.c
diff --git a/src/lib/protocols/warcraft3.c b/src/lib/protocols/warcraft3.c
index 7780dbf6e..39c93378e 100644
--- a/src/lib/protocols/warcraft3.c
+++ b/src/lib/protocols/warcraft3.c
@@ -43,7 +43,7 @@ void ndpi_search_warcraft3(struct ndpi_detection_module_struct
// struct ndpi_id_struct *src=ndpi_struct->src;
// struct ndpi_id_struct *dst=ndpi_struct->dst;
- u_int32_t l; /*
+ u_int16_t l; /*
Leave it as u_int32_t because otherwise 'u_int16_t temp'
might overflood it and thus generate an infinite loop
*/
diff --git a/src/lib/protocols/zmq.c b/src/lib/protocols/zeromq.c
index 12548a2ed..12548a2ed 100644
--- a/src/lib/protocols/zmq.c
+++ b/src/lib/protocols/zeromq.c
diff --git a/src/lib/third_party/include/patricia.h b/src/lib/third_party/include/ndpi_patricia.h
index be8476e85..651e52fc9 100644
--- a/src/lib/third_party/include/patricia.h
+++ b/src/lib/third_party/include/ndpi_patricia.h
@@ -1,5 +1,5 @@
/*
- * $Id: patricia.h,v 1.6 2005/12/07 20:53:01 dplonka Exp $
+ * $Id: ndpi_patricia.h,v 1.6 2005/12/07 20:53:01 dplonka Exp $
* Dave Plonka <plonka@doit.wisc.edu>
*
* This product includes software developed by the University of Michigan,
@@ -7,7 +7,7 @@
*
* This file had been called "radix.h" in the MRT sources.
*
- * I renamed it to "patricia.h" since it's not an implementation of a general
+ * I renamed it to "ndpi_patricia.h" since it's not an implementation of a general
* radix trie. Also, pulled in various requirements from "mrt.h" and added
* some other things it could be used as a standalone API.
@@ -38,10 +38,14 @@
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
-#ifndef _PATRICIA_H
-#define _PATRICIA_H
+#ifndef _NDPI_PATRICIA_H
+#define _NDPI_PATRICIA_H
-#define HAVE_IPV6
+#ifndef WIN32
+#define PATRICIA_IPV6 HAVE_IPV6
+#else
+#undef PATRICIA_IPV6
+#endif
/* typedef unsigned int u_int; */
/* { from defs.h */
@@ -94,7 +98,7 @@ typedef struct the_prefix_t {
int ref_count; /* reference count */
union {
struct in_addr sin;
-#ifdef HAVE_IPV6
+#ifdef PATRICIA_IPV6
struct in6_addr sin6;
#endif /* IPV6 */
} add;
@@ -138,7 +142,11 @@ void ndpi_Clear_Patricia (patricia_tree_t *patricia, void_fn_t func);
void ndpi_Destroy_Patricia (patricia_tree_t *patricia, void_fn_t func);
void ndpi_patricia_process (patricia_tree_t *patricia, void_fn2_t func);
+#ifdef WIN32
+#define PATRICIA_MAXBITS 128
+#else
#define PATRICIA_MAXBITS (sizeof(struct in6_addr) * 8)
+#endif
#define PATRICIA_NBIT(x) (0x80 >> ((x) & 0x7f))
#define PATRICIA_NBYTE(x) ((x) >> 3)
@@ -185,7 +193,7 @@ void ndpi_patricia_process (patricia_tree_t *patricia, void_fn2_t func);
} \
} while (0)
-#endif /* _PATRICIA_H */
+#endif /* _NDPI_PATRICIA_H */
/*************************
diff --git a/src/lib/third_party/src/patricia.c b/src/lib/third_party/src/ndpi_patricia.c
index b7b4c2010..59d17e556 100644
--- a/src/lib/third_party/src/patricia.c
+++ b/src/lib/third_party/src/ndpi_patricia.c
@@ -58,7 +58,8 @@
#define assert(a) ;
#endif /* __KERNEL__ */
-#include "patricia.h"
+#include "ndpi_patricia.h"
+
#ifdef __KERNEL__
@@ -125,12 +126,12 @@ inet_pton (int af, const char *src, void *dst)
}
}
#ifdef NT
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
else if(af == AF_INET6) {
struct in6_addr Address;
return (inet6_addr(src, &Address));
}
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
#endif /* NT */
#ifndef NT
else {
@@ -174,10 +175,10 @@ ndpi_my_inet_pton (int af, const char *src, void *dst)
}
memcpy (dst, xp, sizeof(struct in_addr));
return (1);
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
} else if(af == AF_INET6) {
return (inet_pton (af, src, dst));
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
} else {
#ifndef NT
#ifndef __KERNEL__
@@ -195,7 +196,7 @@ ndpi_my_inet_pton (int af, const char *src, void *dst)
* thread safe and (almost) re-entrant implementation
*/
char *
-ndpi_ndpi_prefix_toa2x (prefix_t *prefix, char *buff, int with_len)
+ndpi_prefix_toa2x (prefix_t *prefix, char *buff, int with_len)
{
if(prefix == NULL)
return ((char*)"(Null)");
@@ -235,7 +236,7 @@ ndpi_ndpi_prefix_toa2x (prefix_t *prefix, char *buff, int with_len)
}
return (buff);
}
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
else if(prefix->family == AF_INET6) {
char *r;
r = (char *) inet_ntop (AF_INET6, &prefix->add.sin6, buff, 48 /* a guess value */ );
@@ -245,7 +246,7 @@ ndpi_ndpi_prefix_toa2x (prefix_t *prefix, char *buff, int with_len)
}
return (buff);
}
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
else
return (NULL);
}
@@ -256,7 +257,7 @@ ndpi_ndpi_prefix_toa2x (prefix_t *prefix, char *buff, int with_len)
char *
ndpi_prefix_toa2 (prefix_t *prefix, char *buff)
{
- return (ndpi_ndpi_prefix_toa2x (prefix, buff, 0));
+ return (ndpi_prefix_toa2x (prefix, buff, 0));
}
/* ndpi_prefix_toa
@@ -273,7 +274,7 @@ ndpi_New_Prefix2 (int family, void *dest, int bitlen, prefix_t *prefix)
int dynamic_allocated = 0;
int default_bitlen = sizeof(struct in_addr) * 8;
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
if(family == AF_INET6) {
default_bitlen = sizeof(struct in6_addr) * 8;
if(prefix == NULL) {
@@ -283,7 +284,7 @@ ndpi_New_Prefix2 (int family, void *dest, int bitlen, prefix_t *prefix)
memcpy (&prefix->add.sin6, dest, sizeof(struct in6_addr));
}
else
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
if(family == AF_INET) {
if(prefix == NULL) {
#ifndef NT
@@ -327,9 +328,9 @@ ndpi_ascii2prefix (int family, char *string)
long maxbitlen = 0;
char *cp;
struct in_addr sin;
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
struct in6_addr sin6;
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
char save[MAXLINE];
if(string == NULL)
@@ -338,19 +339,19 @@ ndpi_ascii2prefix (int family, char *string)
/* easy way to handle both families */
if(family == 0) {
family = AF_INET;
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
if(strchr (string, ':')) family = AF_INET6;
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
}
if(family == AF_INET) {
maxbitlen = sizeof(struct in_addr) * 8;
}
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
else if(family == AF_INET6) {
maxbitlen = sizeof(struct in6_addr) * 8;
}
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
if((cp = strchr (string, '/')) != NULL) {
bitlen = atol (cp + 1);
@@ -372,7 +373,7 @@ ndpi_ascii2prefix (int family, char *string)
return (ndpi_New_Prefix (AF_INET, &sin, bitlen));
}
-#if defined(HAVE_IPV6) && (!defined(__KERNEL__))
+#if defined(PATRICIA_IPV6) && (!defined(__KERNEL__))
else if(family == AF_INET6) {
// Get rid of this with next IPv6 upgrade
#if defined(NT) && !defined(HAVE_INET_NTOP)
@@ -384,7 +385,7 @@ ndpi_ascii2prefix (int family, char *string)
#endif /* NT */
return (ndpi_New_Prefix (AF_INET6, &sin6, bitlen));
}
-#endif /* HAVE_IPV6 */
+#endif /* PATRICIA_IPV6 */
else
return (NULL);
}
diff --git a/tests/do.sh b/tests/do.sh
index 4f81906f7..e7d28aa9c 100755
--- a/tests/do.sh
+++ b/tests/do.sh
@@ -15,13 +15,16 @@ build_results() {
check_results() {
for f in $PCAPS; do
if [ -f result/$f.out ]; then
- $READER -q -i pcap/$f -w /tmp/reader.out
+ CMD="$READER -q -i pcap/$f -w /tmp/reader.out"
+ $CMD
NUM_DIFF=`diff result/$f.out /tmp/reader.out | wc -l`
if [ $NUM_DIFF -eq 0 ]; then
echo "$f\t OK"
else
echo "$f\t ERROR"
+ echo "$CMD"
+ diff result/$f.out /tmp/reader.out
fi
/bin/rm /tmp/reader.out
diff --git a/tests/pcap/skype.pcap b/tests/pcap/skype.pcap
new file mode 100644
index 000000000..d8c85f508
--- /dev/null
+++ b/tests/pcap/skype.pcap
Binary files differ
diff --git a/tests/pcap/skype_no_unknown.pcap b/tests/pcap/skype_no_unknown.pcap
new file mode 100644
index 000000000..5266bca6f
--- /dev/null
+++ b/tests/pcap/skype_no_unknown.pcap
Binary files differ
diff --git a/tests/result/quic.pcap.out b/tests/result/quic.pcap.out
index 283fb04d2..900864e4d 100644
--- a/tests/result/quic.pcap.out
+++ b/tests/result/quic.pcap.out
@@ -1 +1 @@
-Unknown 413 254874 1
+Quic 413 254874 1
diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out
new file mode 100644
index 000000000..404442549
--- /dev/null
+++ b/tests/result/skype.pcap.out
@@ -0,0 +1,13 @@
+Unknown 409 49221 18
+DNS 8 807 4
+MDNS 8 1736 2
+NTP 2 180 1
+SSDP 101 38156 6
+ICMP 8 656 1
+IGMP 5 258 4
+SSL 20 1516 1
+DropBox 38 17948 5
+Skype 2362 501011 246
+Apple 15 2045 2
+AppleiCloud 88 20520 2
+Spotify 5 430 1
diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out
new file mode 100644
index 000000000..2b6435897
--- /dev/null
+++ b/tests/result/skype_no_unknown.pcap.out
@@ -0,0 +1,11 @@
+Unknown 241 60170 16
+DNS 6 627 3
+MDNS 3 400 2
+NetBIOS 22 3106 7
+SSDP 40 14100 3
+ICMP 4 328 1
+IGMP 4 226 4
+SSL 22 1444 3
+DropBox 16 7342 5
+Skype 1637 379382 221
+Apple 84 20699 2
Powered by cgit, Themed by Ted Yin.