aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/include/ndpi_protocol_ids.h5
-rw-r--r--src/include/ndpi_protocols.h4
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_main.c10
-rw-r--r--src/lib/protocols/bittorrent.c2
-rw-r--r--src/lib/protocols/diameter.c132
-rw-r--r--src/lib/protocols/quic.c2
-rw-r--r--tests/pcap/diameter.pcapbin0 -> 2100 bytes
-rw-r--r--tests/result/diameter.pcap.out3
9 files changed, 153 insertions, 6 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index aaa25a396..30d138d3f 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -2,7 +2,7 @@
/*
* ndpi_protocol_ids.h
*
- * Copyright (C) 2011-17 - ntop.org
+ * Copyright (C) 2011-18 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -275,9 +275,10 @@
#define NDPI_PROTOCOL_SOUNDCLOUD 234
#define NDPI_PROTOCOL_CSGO 235 /* Counter-Strike Global Offensive, Dota 2 */
#define NDPI_PROTOCOL_LISP 236
+#define NDPI_PROTOCOL_DIAMETER 237
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_LISP
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_DIAMETER
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index da7acaef7..2fb105afe 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -1,7 +1,7 @@
/*
* ndpi_protocols.h
*
- * Copyright (C) 2011-16 - ntop.org
+ * Copyright (C) 2011-18 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -52,6 +52,7 @@ u_int ndpi_search_tcp_or_udp_raw(struct ndpi_detection_module_struct *ndpi_struc
void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
/* Applications and other protocols. */
+void ndpi_search_diameter(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_lisp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_edonkey(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
@@ -202,6 +203,7 @@ void ndpi_search_tinc(struct ndpi_detection_module_struct *ndpi_struct, struct n
void ndpi_search_fix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_csgo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
/* --- INIT FUNCTIONS --- */
+void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 410a50f21..e67d076c3 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -37,6 +37,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/dcerpc.c \
protocols/dhcp.c \
protocols/dhcpv6.c \
+ protocols/diameter.c \
protocols/directconnect.c \
protocols/directdownloadlink.c \
protocols/dns.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index f6c39b250..13a216b1d 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1,7 +1,7 @@
/*
* ndpi_main.c
*
- * Copyright (C) 2011-17 - ntop.org
+ * Copyright (C) 2011-18 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -1451,6 +1451,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "QUIC", NDPI_PROTOCOL_CATEGORY_WEB,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 443, 80, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DIAMETER,
+ no_master,
+ no_master, "Diameter", NDPI_PROTOCOL_CATEGORY_WEB,
+ ndpi_build_default_ports(ports_a, 3868, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DROPBOX,
no_master,
no_master, "Dropbox", NDPI_PROTOCOL_CATEGORY_CLOUD,
@@ -2767,6 +2772,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* QUIC */
init_quic_dissector(ndpi_struct, &a, detection_bitmask);
+ /* DIAMETER */
+ init_diameter_dissector(ndpi_struct, &a, detection_bitmask);
+
/* EAQ */
init_eaq_dissector(ndpi_struct, &a, detection_bitmask);
diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c
index 727992702..81fc3baf6 100644
--- a/src/lib/protocols/bittorrent.c
+++ b/src/lib/protocols/bittorrent.c
@@ -2,7 +2,7 @@
* bittorrent.c
*
* Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2011-18 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
diff --git a/src/lib/protocols/diameter.c b/src/lib/protocols/diameter.c
new file mode 100644
index 000000000..24317f498
--- /dev/null
+++ b/src/lib/protocols/diameter.c
@@ -0,0 +1,132 @@
+/*
+ * aimini.c
+ *
+ * Copyright (C) 2018 - ntop.org
+ * Written by Michele Campus - <campus@ntop.org>
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "ndpi_protocol_ids.h"
+
+#ifdef NDPI_PROTOCOL_DIAMETER
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DIAMETER
+
+#include "ndpi_api.h"
+
+
+// Header Flags possibile values
+#define REQUEST 0X80
+#define PROXYABLE 0X40
+#define ERROR 0X20
+#define RETRASM 0X10
+
+typedef enum {
+ AC = 271,
+ AS = 274,
+ CC = 272,
+ CE = 257,
+ DW = 280,
+ DP = 282,
+ RA = 258,
+ ST = 275
+} com_type_t;
+
+#define DIAM_HEADER_LEN 20
+
+// DIAMETER header
+struct diameter_header_t
+{
+ u_int8_t version;
+ u_int8_t length[3];
+ u_int8_t flags;
+ u_int8_t com_code[3];
+ u_int32_t app_id;
+ u_int32_t hop_id;
+ u_int32_t end_id;
+};
+
+
+// Check packet
+int is_diameter(struct ndpi_packet_struct *packet, int size_payload)
+{
+ // check param
+ if(!packet || size_payload == 0) return -1;
+
+ // cast to diameter header
+ struct diameter_header_t *diameter = (struct diameter_header_t *) packet;
+
+ // check if the packet is diameter
+ if(diameter->version == 0x01 &&
+ (diameter->flags == REQUEST ||
+ diameter->flags == PROXYABLE ||
+ diameter->flags == ERROR ||
+ diameter->flags == RETRASM)) {
+
+ u_int16_t com_code = diameter->com_code[2] + (diameter->com_code[1] << 8) + (diameter->com_code[0] << 8);
+
+ if(com_code == AC || com_code == AS ||
+ com_code == CC || com_code == CE ||
+ com_code == DW || com_code == DP ||
+ com_code == RA || com_code == ST)
+ return 0; // OK
+ }
+ // wrong packet
+ return -2;
+}
+
+
+void ndpi_search_diameter(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ // Diameter is on TCP
+ if(packet->tcp) {
+
+ /* Check if it's diameter */
+ int ret = is_diameter(packet, packet->payload_packet_len);
+ if(ret != 0) {
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
+ }
+ else {
+ NDPI_LOG_INFO(ndpi_struct, "found Diameter\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIAMETER, NDPI_PROTOCOL_UNKNOWN);
+ }
+ }
+ else { // UDP
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
+ }
+}
+
+
+void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("Diameter", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_DIAMETER, ndpi_search_diameter,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
+#endif /* NDPI_PROTOCOL_DIAMETER */
+
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index 24a2b8f12..203aead36 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1,7 +1,7 @@
/*
* quic.c
*
- * Copyright (C) 2012-16 - ntop.org
+ * Copyright (C) 2012-18 - ntop.org
*
* Based on code of:
* Andrea Buscarinu - <andrea.buscarinu@gmail.com>
diff --git a/tests/pcap/diameter.pcap b/tests/pcap/diameter.pcap
new file mode 100644
index 000000000..cad16d27b
--- /dev/null
+++ b/tests/pcap/diameter.pcap
Binary files differ
diff --git a/tests/result/diameter.pcap.out b/tests/result/diameter.pcap.out
new file mode 100644
index 000000000..9a43af0ef
--- /dev/null
+++ b/tests/result/diameter.pcap.out
@@ -0,0 +1,3 @@
+Diameter 6 1980 1
+
+ 1 TCP 10.201.9.245:50957 <-> 10.201.9.11:3868 [proto: 237/Diameter][3 pkts/1174 bytes <-> 3 pkts/806 bytes]
Powered by cgit, Themed by Ted Yin.