aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols/msn.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols/msn.c')
-rw-r--r--src/lib/protocols/msn.c96
1 files changed, 45 insertions, 51 deletions
diff --git a/src/lib/protocols/msn.c b/src/lib/protocols/msn.c
index 2938d39b8..4c5b73dcd 100644
--- a/src/lib/protocols/msn.c
+++ b/src/lib/protocols/msn.c
@@ -21,10 +21,16 @@
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
*
*/
-#include "ndpi_api.h"
+
+#include "ndpi_protocol_ids.h"
+
#ifdef NDPI_PROTOCOL_MSN
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_MSN
+
+#include "ndpi_api.h"
+
#define MAX_PACKETS_FOR_MSN 100
static void ndpi_int_msn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
@@ -59,17 +65,16 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
u_int16_t plen;
u_int16_t status = 0;
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp detection...\n");
#ifdef NDPI_PROTOCOL_SSL
if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "msn ssl ft test\n");
+ NDPI_LOG_DBG2(ndpi_struct, "msn ssl ft test\n");
if(flow->packet_counter < 10) {
if(flow->packet_counter == 7 && packet->payload_packet_len > 300) {
if(memcmp(packet->payload + 24, "MSNSLP", 6) == 0
|| (get_u_int32_t(packet->payload, 0) == htonl(0x30000000) && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "detected MSN File Transfer, ifdef ssl.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer, ifdef ssl\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -77,12 +82,12 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
if(flow->packet_counter >= 5 && flow->packet_counter <= 10 && (get_u_int32_t(packet->payload, 0) == htonl(0x18000000)
&& get_u_int32_t(packet->payload, 4) == 0x00000000)) {
flow->l4.tcp.msn_ssl_ft++;
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
+ NDPI_LOG_DBG2(ndpi_struct,
"increased msn ft ssl stage to: %u at packet nr: %u\n", flow->l4.tcp.msn_ssl_ft,
flow->packet_counter);
if (flow->l4.tcp.msn_ssl_ft == 2) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "detected MSN File Transfer, ifdef ssl 2.\n");
+ NDPI_LOG_INFO(ndpi_struct,
+ "found MSN File Transfer, ifdef ssl 2.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
}
return;
@@ -109,18 +114,13 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
&& ((ntohl(get_u_int32_t(packet->payload, 24)) == 0x000f0004 && ntohl(get_u_int32_t(packet->payload, 28)) == 0x72c64bc6)
|| (ntohl(get_u_int32_t(packet->payload, 20)) == 0x000f0004
&& ntohl(get_u_int32_t(packet->payload, 24)) == 0x72c64bc6))) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
+ NDPI_LOG_INFO(ndpi_struct,
"found MSN in packets that also contain voice.messenger.live.com.\n");
/* TODO this is an alternative pattern for video detection */
/* if (packet->payload_packet_len > 100 &&
get_u_int16_t(packet->payload, 86) == htons(0x05dc)) { */
- if(packet->payload_packet_len > 101 && packet->payload[101] == 0x02) {
- ndpi_int_msn_add_connection(ndpi_struct, flow);
- } else {
- ndpi_int_msn_add_connection(ndpi_struct, flow);
- }
-
+ ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -133,14 +133,12 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
if (memcmp(&packet->payload[packet->payload_packet_len - 6], "CVR",
3) == 0 || memcmp(&packet->payload[packet->payload_packet_len - 8], "MSNP", 4) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN by pattern VER...CVR/MSNP ODOA.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN by pattern VER...CVR/MSNP ODOA\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
if (ndpi_match_strprefix(&packet->payload[4], packet->payload_packet_len-4, "MSNFT")) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN FT by pattern VER MSNFT...0d0a.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN FT by pattern VER MSNFT...0d0a\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -157,6 +155,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
if (packet->user_agent_line.ptr != NULL &&
packet->user_agent_line.len > NDPI_STATICSTRING_LEN("Messenger/") &&
memcmp(packet->user_agent_line.ptr, "Messenger/", NDPI_STATICSTRING_LEN("Messenger/")) == 0) {
+ NDPI_LOG_INFO(ndpi_struct, "found MSN Messenger/\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -184,8 +183,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
(packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
memcmp(packet->content_line.ptr, "text/x-msnmsgr",
NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN by pattern POST http:// .... application/x-msn-messenger.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN POST application/x-msn-messenger\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -209,16 +207,14 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
for(c = 13; c < 50; c++) {
if(memcmp(&packet->payload[c], "/", 1) == 0) {
if(memcmp(&packet->payload[c], "/gateway/gateway.dll", 20) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found pattern http://.../gateway/gateway.ddl.\n");
+ NDPI_LOG_DBG2(ndpi_struct, "found pattern http://.../gateway/gateway.ddl\n");
status = 1;
break;
}
}
}
} else if((memcmp(&packet->payload[5], "/gateway/gateway.dll", 20) == 0)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found pattern http://.../gateway/gateway.ddl.\n");
+ NDPI_LOG_DBG2(ndpi_struct, "found pattern http://.../gateway/gateway.ddl\n");
status = 1;
}
}
@@ -239,7 +235,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
|| (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern text/xml; charset=utf-8.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN with pattern text/xml; charset=utf-8\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -248,10 +244,8 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
|| memcmp(packet->line[a].ptr, "VER ", 4) == 0 ||
memcmp(packet->line[a].ptr, "ANS ", 4) == 0)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "found MSN with pattern text/sml; charset0utf-8.\n");
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct,
- NDPI_LOG_TRACE, "MSN xml CVS / VER / ANS found\n");
+ NDPI_LOG_DBG2(ndpi_struct, "found MSN with pattern text/sml; charset0utf-8\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN xml CVS / VER / ANS found\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -280,13 +274,13 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
(packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE,
- "HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
+ NDPI_LOG_INFO(ndpi_struct,
+ "found MSN application/x-msn-messenger.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN X-MSN\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -296,7 +290,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
/* now block proxy connection */
if(packet->payload_packet_len >= 42) {
if(memcmp(packet->payload, "CONNECT messenger.hotmail.com:1863 HTTP/1.", 42) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern CONNECT messenger.hotmail.com:1863 HTTP/1..\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN with pattern CONNECT messenger.hotmail.com:1863 HTTP/1.\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -322,7 +316,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
while (plen < endlen) {
if (ndpi_check_for_email_address(ndpi_struct, flow, plen) != 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found mail address\n");
+ NDPI_LOG_DBG2(ndpi_struct, "found mail address\n");
break;
}
if (packet->payload_packet_len > plen + 1
@@ -334,7 +328,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
goto ndpi_msn_exclude;
}
}
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern USR/ANS ...mail_address.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN with pattern USR/ANS ...mail_address\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -362,12 +356,12 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
(packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... application/x-msn-messenger.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN application/x-msn-messenger\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN X-MSN\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -381,7 +375,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
&& NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
if (flow->packet_counter == 1 &&
packet->payload_packet_len > 12 && memcmp(packet->payload, "recipientid=", 12) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "detected file transfer.\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN file transfer\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
return;
}
@@ -396,7 +390,7 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
if((packet->payload_packet_len == 4 || packet->payload_packet_len == 8)
&& get_u_int32_t(packet->payload, 0) == htonl(0x04000000)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "maybe first TCP MSN detected\n");
+ NDPI_LOG_DBG2(ndpi_struct, "maybe first TCP MSN detected\n");
if(packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 4) == htonl(0x666f6f00)) {
flow->l4.tcp.msn_stage = 5 + packet->packet_direction;
@@ -409,12 +403,12 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
} else if (flow->l4.tcp.msn_stage == 1 + packet->packet_direction) {
if (packet->payload_packet_len > 10 && get_u_int32_t(packet->payload, 0) == htonl(0x666f6f00)) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 1\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 1\n");
return;
}
/* did not see this pattern in any trace */
if (packet->payload_packet_len == 56 && get_u_int32_t(packet->payload, 16) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "maybe Second TCP MSN detected\n");
+ NDPI_LOG_DBG2(ndpi_struct, "maybe Second TCP MSN detected\n");
flow->l4.tcp.msn_stage = 3 + packet->packet_direction;
return;
}
@@ -423,30 +417,30 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
} else if (flow->l4.tcp.msn_stage == 2 - packet->packet_direction
&& packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x30000000)) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 2\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 2\n");
return;
} else if ((flow->l4.tcp.msn_stage == 3 + packet->packet_direction)
|| (flow->l4.tcp.msn_stage == 4 - packet->packet_direction)) {
if (packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x30000000)) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 2\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 2\n");
return;
}
} else if (flow->l4.tcp.msn_stage == 6 - packet->packet_direction) {
if ((packet->payload_packet_len == 4) &&
(get_u_int32_t(packet->payload, 0) == htonl(0x10000000) || get_u_int32_t(packet->payload, 0) == htonl(0x30000000))) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 3\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 3\n");
return;
}
} else if (flow->l4.tcp.msn_stage == 5 + packet->packet_direction) {
if ((packet->payload_packet_len == 20) && get_u_int32_t(packet->payload, 0) == htonl(0x10000000)) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 3\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 3\n");
return;
}
}
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "msn 7.\n");
+ NDPI_LOG_DBG(ndpi_struct, "msn 7\n");
if (flow->packet_counter <= MAX_PACKETS_FOR_MSN) {
if (memcmp(&packet->payload[0], "MSG ", 4) == 0
@@ -459,13 +453,12 @@ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct
|| memcmp(&packet->payload[0], "XFR ", 4) == 0) {
ndpi_int_msn_add_connection(ndpi_struct, flow);
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN detected\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN\n");
return;
}
}
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp excluded.\n");
ndpi_msn_exclude:
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN);
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}
/* search over UDP */
@@ -482,7 +475,7 @@ static void ndpi_search_msn_udp_misc(struct ndpi_detection_module_struct
if ((src == NULL || NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0)
&& (dst == NULL
|| NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0)) {
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN);
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
return;
}
@@ -490,7 +483,7 @@ static void ndpi_search_msn_udp_misc(struct ndpi_detection_module_struct
if (packet->payload_packet_len == 20
&& get_u_int32_t(packet->payload, 4) == 0 && packet->payload[9] == 0
&& get_u_int16_t(packet->payload, 10) == htons(0x0100)) {
- NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "msn udp misc data connection detected\n");
+ NDPI_LOG_INFO(ndpi_struct, "found MSN udp misc data connection\n");
ndpi_int_msn_add_connection(ndpi_struct, flow);
}
@@ -504,6 +497,7 @@ void ndpi_search_msn(struct ndpi_detection_module_struct *ndpi_struct, struct nd
{
struct ndpi_packet_struct *packet = &flow->packet;
+ NDPI_LOG_DBG(ndpi_struct, "search msn\n");
/* this if request should always be true */
if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) {
/* we deal with tcp now */
Powered by cgit, Themed by Ted Yin.