aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/protocols/mdns.c176
-rw-r--r--src/lib/protocols/tcp_udp.c2
2 files changed, 89 insertions, 89 deletions
diff --git a/src/lib/protocols/mdns.c b/src/lib/protocols/mdns.c
index 8226ab93c..d4426e7f3 100644
--- a/src/lib/protocols/mdns.c
+++ b/src/lib/protocols/mdns.c
@@ -37,108 +37,108 @@ static void ndpi_int_mdns_add_connection(struct ndpi_detection_module_struct
}
static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
+ *ndpi_struct, struct ndpi_flow_struct *flow)
{
- struct ndpi_packet_struct *packet = &flow->packet;
+ struct ndpi_packet_struct *packet = &flow->packet;
- if ((packet->payload[2] & 0x80) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
+ if ((packet->payload[2] & 0x80) == 0 &&
+ ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
+ ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
- NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n");
+ NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n");
- return 1;
- } else if ((packet->payload[2] & 0x80) != 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
- NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with answer query.\n");
+ return 1;
+ } else if ((packet->payload[2] & 0x80) != 0 &&
+ ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
+ ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
+ ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
+ NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with answer query.\n");
- return 1;
- }
+ return 1;
+ }
- return 0;
+ return 0;
}
void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
- struct ndpi_packet_struct *packet = &flow->packet;
+ struct ndpi_packet_struct *packet = &flow->packet;
-// struct ndpi_id_struct *src=ndpi_struct->src;
-// struct ndpi_id_struct *dst=ndpi_struct->dst;
-
- u_int16_t dport;
-// const u_int16_t sport=ntohs(packet->udp->source);
-
- /* check if UDP and */
- if (packet->udp != NULL) {
- /*read destination port */
- dport = ntohs(packet->udp->dest);
-
- NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "MDNS udp start \n");
-
-
-
- /*check standard MDNS to port 5353 */
- /*took this information from http://www.it-administrator.de/lexikon/multicast-dns.html */
-
- if (dport == 5353 && packet->payload_packet_len >= 12) {
-
- NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with destination port 5353\n");
-
- /* MDNS header is similar to dns header */
- /* dns header
- 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
- +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- | ID |
- +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- |QR| Opcode |AA|TC|RD|RA| Z | RCODE |
- +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- | QDCOUNT |
- +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- | ANCOUNT |
- +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- | NSCOUNT |
- +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- | ARCOUNT |
- +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
- *
- * dns query check: query: QR set, ancount = 0, nscount = 0, QDCOUNT < MAX_MDNS, ARCOUNT < MAX_MDNS
- *
- */
-
- /* mdns protocol must have destination address 224.0.0.251 */
- /* took this information from http://www.it-administrator.de/lexikon/multicast-dns.html */
-
- if (packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
-
- NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
- NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
-
- if (ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
- ndpi_int_mdns_add_connection(ndpi_struct, flow);
- return;
- }
- }
+ // struct ndpi_id_struct *src=ndpi_struct->src;
+ // struct ndpi_id_struct *dst=ndpi_struct->dst;
+
+ u_int16_t dport;
+ // const u_int16_t sport=ntohs(packet->udp->source);
+
+ /* check if UDP and */
+ if (packet->udp != NULL) {
+ /*read destination port */
+ dport = ntohs(packet->udp->dest);
+
+ NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "MDNS udp start \n");
+
+
+
+ /*check standard MDNS to port 5353 */
+ /*took this information from http://www.it-administrator.de/lexikon/multicast-dns.html */
+
+ if (dport == 5353 && packet->payload_packet_len >= 12) {
+
+ NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with destination port 5353\n");
+
+ /* MDNS header is similar to dns header */
+ /* dns header
+ 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5
+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ | ID |
+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ |QR| Opcode |AA|TC|RD|RA| Z | RCODE |
+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ | QDCOUNT |
+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ | ANCOUNT |
+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ | NSCOUNT |
+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ | ARCOUNT |
+ +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+ *
+ * dns query check: query: QR set, ancount = 0, nscount = 0, QDCOUNT < MAX_MDNS, ARCOUNT < MAX_MDNS
+ *
+ */
+
+ /* mdns protocol must have destination address 224.0.0.251 */
+ /* took this information from http://www.it-administrator.de/lexikon/multicast-dns.html */
+
+ if (packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
+
+ NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
+ NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
+
+ if (ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
+ ndpi_int_mdns_add_connection(ndpi_struct, flow);
+ return;
+ }
+ }
#ifdef NDPI_DETECTION_SUPPORT_IPV6
- if (packet->iphv6 != NULL) {
- const u_int32_t *daddr = packet->iphv6->daddr.ndpi_v6_u.u6_addr32;
- if (daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
-
- NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
- NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n");
-
- if (ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
- ndpi_int_mdns_add_connection(ndpi_struct, flow);
- return;
- }
- }
- }
-#endif
+ if (packet->iphv6 != NULL) {
+ const u_int32_t *daddr = packet->iphv6->ip6_dst.u6_addr.u6_addr32;
+ if (daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
+
+ NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
+ NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n");
- }
+ if (ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
+ ndpi_int_mdns_add_connection(ndpi_struct, flow);
+ return;
+ }
}
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MDNS);
+ }
+#endif
+
+ }
+ }
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MDNS);
}
diff --git a/src/lib/protocols/tcp_udp.c b/src/lib/protocols/tcp_udp.c
index de9700e4a..9f9febfeb 100644
--- a/src/lib/protocols/tcp_udp.c
+++ b/src/lib/protocols/tcp_udp.c
@@ -64,7 +64,7 @@ void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, st
proto = ndpi_search_tcp_or_udp_raw(ndpi_struct,
flow->packet.iph ? flow->packet.iph->protocol :
#ifdef NDPI_DETECTION_SUPPORT_IPV6
- flow->packet.iphv6->nexthdr,
+ flow->packet.iphv6->ip6_ctlun.ip6_un1.ip6_un1_nxt,
#else
0,
#endif
Powered by cgit, Themed by Ted Yin.