diff options
Diffstat (limited to 'src/lib/protocols/lisp.c')
| -rw-r--r-- | src/lib/protocols/lisp.c | 40 |
1 files changed, 26 insertions, 14 deletions
diff --git a/src/lib/protocols/lisp.c b/src/lib/protocols/lisp.c index 403355772..a1a2dafbb 100644 --- a/src/lib/protocols/lisp.c +++ b/src/lib/protocols/lisp.c @@ -24,8 +24,8 @@ #include "ndpi_api.h" -#define LISP_PORT 4341 -#define LISP_PORT1 4342 +#define LISP_PORT 4341 /* Only UDP */ +#define LISP_PORT1 4342 /* TCP and UDP */ static void ndpi_int_lisp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, @@ -39,23 +39,35 @@ static void ndpi_check_lisp(struct ndpi_detection_module_struct *ndpi_struct, st { struct ndpi_packet_struct *packet = &ndpi_struct->packet; + u_int16_t lisp_port1 = htons(LISP_PORT1); + u_int16_t lisp_port = htons(LISP_PORT); if(packet->udp != NULL) { - - u_int16_t lisp_port = htons(LISP_PORT); - u_int16_t lisp_port1 = htons(LISP_PORT1); - - if(((packet->udp->source == lisp_port) - && (packet->udp->dest == lisp_port)) || - ((packet->udp->source == lisp_port1) - && (packet->udp->dest == lisp_port1)) ) { - + if((packet->udp->source == lisp_port && packet->udp->dest == lisp_port) || + (packet->udp->source == lisp_port1 && packet->udp->dest == lisp_port1)) { + NDPI_LOG_INFO(ndpi_struct, "found lisp\n"); + ndpi_int_lisp_add_connection(ndpi_struct, flow, 0); + return; + } + } else { + /* See draft-kouvelas-lisp-map-server-reliable-transport-07 */ + if(packet->tcp->source == lisp_port1 || + packet->tcp->dest == lisp_port1) { + if(packet->payload_packet_len >= 8) { + u_int16_t msg_len = ntohs(*(u_int16_t *)&packet->payload[2]); + if(msg_len >= packet->payload_packet_len && + /* End marker: we don't handle fragmented messages */ + packet->payload[packet->payload_packet_len - 1] == 0xE9 && + packet->payload[packet->payload_packet_len - 2] == 0xAD && + packet->payload[packet->payload_packet_len - 3] == 0xAC && + packet->payload[packet->payload_packet_len - 4] == 0x9F) { NDPI_LOG_INFO(ndpi_struct, "found lisp\n"); ndpi_int_lisp_add_connection(ndpi_struct, flow, 0); - return; - + return; + } } } + } NDPI_EXCLUDE_PROTO(ndpi_struct, flow); } @@ -78,7 +90,7 @@ void init_lisp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int ndpi_set_bitmask_protocol_detection("LISP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_LISP, ndpi_search_lisp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; |