aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols/thunder.c
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols/thunder.c')
-rw-r--r--src/lib/protocols/thunder.c292
1 files changed, 146 insertions, 146 deletions
diff --git a/src/lib/protocols/thunder.c b/src/lib/protocols/thunder.c
index 3784bb781..b771fcf8d 100644
--- a/src/lib/protocols/thunder.c
+++ b/src/lib/protocols/thunder.c
@@ -29,183 +29,183 @@
static void ndpi_int_thunder_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow, ndpi_protocol_type_t protocol_type)
{
- struct ndpi_packet_struct *packet = &flow->packet;
- struct ndpi_id_struct *src = flow->src;
- struct ndpi_id_struct *dst = flow->dst;
-
- ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_THUNDER, protocol_type);
-
- if (src != NULL) {
- src->thunder_ts = packet->tick_timestamp;
- }
- if (dst != NULL) {
- dst->thunder_ts = packet->tick_timestamp;
- }
+ struct ndpi_packet_struct *packet = &flow->packet;
+ struct ndpi_id_struct *src = flow->src;
+ struct ndpi_id_struct *dst = flow->dst;
+
+ ndpi_int_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_THUNDER, protocol_type);
+
+ if (src != NULL) {
+ src->thunder_ts = packet->tick_timestamp;
+ }
+ if (dst != NULL) {
+ dst->thunder_ts = packet->tick_timestamp;
+ }
}
#if !defined(WIN32)
- static inline
+static inline
#else
__forceinline static
#endif
- void ndpi_int_search_thunder_udp(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
+void ndpi_int_search_thunder_udp(struct ndpi_detection_module_struct
+ *ndpi_struct, struct ndpi_flow_struct *flow)
{
- struct ndpi_packet_struct *packet = &flow->packet;
+ struct ndpi_packet_struct *packet = &flow->packet;
-// struct ndpi_id_struct *src=ndpi_struct->src;
-// struct ndpi_id_struct *dst=ndpi_struct->dst;
-
- if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30
- && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) {
- if (flow->thunder_stage == 3) {
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "THUNDER udp detected\n");
- ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL);
- return;
- }
-
- flow->thunder_stage++;
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "maybe thunder udp packet detected, stage increased to %u\n", flow->thunder_stage);
- return;
- }
-
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "excluding thunder udp at stage %u\n", flow->thunder_stage);
-
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER);
+ // struct ndpi_id_struct *src=ndpi_struct->src;
+ // struct ndpi_id_struct *dst=ndpi_struct->dst;
+
+ if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30
+ && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) {
+ if (flow->thunder_stage == 3) {
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "THUNDER udp detected\n");
+ ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL);
+ return;
+ }
+
+ flow->thunder_stage++;
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "maybe thunder udp packet detected, stage increased to %u\n", flow->thunder_stage);
+ return;
+ }
+
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "excluding thunder udp at stage %u\n", flow->thunder_stage);
+
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER);
}
#if !defined(WIN32)
- static inline
+static inline
#else
__forceinline static
#endif
- void ndpi_int_search_thunder_tcp(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
+void ndpi_int_search_thunder_tcp(struct ndpi_detection_module_struct
+ *ndpi_struct, struct ndpi_flow_struct *flow)
{
- struct ndpi_packet_struct *packet = &flow->packet;
+ struct ndpi_packet_struct *packet = &flow->packet;
-// struct ndpi_id_struct *src=ndpi_struct->src;
-// struct ndpi_id_struct *dst=ndpi_struct->dst;
-
- if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30
- && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) {
- if (flow->thunder_stage == 3) {
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "THUNDER tcp detected\n");
- ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL);
- return;
- }
-
- flow->thunder_stage++;
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "maybe thunder tcp packet detected, stage increased to %u\n", flow->thunder_stage);
- return;
- }
-
- if (flow->thunder_stage == 0 && packet->payload_packet_len > 17
- && memcmp(packet->payload, "POST / HTTP/1.1\r\n", 17) == 0) {
- ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "maybe thunder http POST packet detected, parsed packet lines: %u, empty line set %u (at: %u)\n",
- packet->parsed_lines, packet->empty_line_position_set, packet->empty_line_position);
-
- if (packet->empty_line_position_set != 0 &&
- packet->content_line.ptr != NULL &&
- packet->content_line.len == 24 &&
- memcmp(packet->content_line.ptr, "application/octet-stream",
- 24) == 0 && packet->empty_line_position_set < (packet->payload_packet_len - 8)
- && packet->payload[packet->empty_line_position + 2] >= 0x30
- && packet->payload[packet->empty_line_position + 2] < 0x40
- && packet->payload[packet->empty_line_position + 3] == 0x00
- && packet->payload[packet->empty_line_position + 4] == 0x00
- && packet->payload[packet->empty_line_position + 5] == 0x00) {
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "maybe thunder http POST packet application does match\n");
- ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_CORRELATED_PROTOCOL);
- return;
- }
- }
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "excluding thunder tcp at stage %u\n", flow->thunder_stage);
-
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER);
+ // struct ndpi_id_struct *src=ndpi_struct->src;
+ // struct ndpi_id_struct *dst=ndpi_struct->dst;
+
+ if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30
+ && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) {
+ if (flow->thunder_stage == 3) {
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "THUNDER tcp detected\n");
+ ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL);
+ return;
+ }
+
+ flow->thunder_stage++;
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "maybe thunder tcp packet detected, stage increased to %u\n", flow->thunder_stage);
+ return;
+ }
+
+ if (flow->thunder_stage == 0 && packet->payload_packet_len > 17
+ && memcmp(packet->payload, "POST / HTTP/1.1\r\n", 17) == 0) {
+ ndpi_parse_packet_line_info(ndpi_struct, flow);
+
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "maybe thunder http POST packet detected, parsed packet lines: %u, empty line set %u (at: %u)\n",
+ packet->parsed_lines, packet->empty_line_position_set, packet->empty_line_position);
+
+ if (packet->empty_line_position_set != 0 &&
+ packet->content_line.ptr != NULL &&
+ packet->content_line.len == 24 &&
+ memcmp(packet->content_line.ptr, "application/octet-stream",
+ 24) == 0 && packet->empty_line_position_set < (packet->payload_packet_len - 8)
+ && packet->payload[packet->empty_line_position + 2] >= 0x30
+ && packet->payload[packet->empty_line_position + 2] < 0x40
+ && packet->payload[packet->empty_line_position + 3] == 0x00
+ && packet->payload[packet->empty_line_position + 4] == 0x00
+ && packet->payload[packet->empty_line_position + 5] == 0x00) {
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "maybe thunder http POST packet application does match\n");
+ ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_CORRELATED_PROTOCOL);
+ return;
+ }
+ }
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "excluding thunder tcp at stage %u\n", flow->thunder_stage);
+
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER);
}
#if !defined(WIN32)
- static inline
+static inline
#else
__forceinline static
#endif
- void ndpi_int_search_thunder_http(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
+void ndpi_int_search_thunder_http(struct ndpi_detection_module_struct
+ *ndpi_struct, struct ndpi_flow_struct *flow)
{
- struct ndpi_packet_struct *packet = &flow->packet;
- struct ndpi_id_struct *src = flow->src;
- struct ndpi_id_struct *dst = flow->dst;
-
-
- if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_THUNDER) {
- if (src != NULL && ((u_int32_t)
- (packet->tick_timestamp - src->thunder_ts) < ndpi_struct->thunder_timeout)) {
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "thunder : save src connection packet detected\n");
- src->thunder_ts = packet->tick_timestamp;
- } else if (dst != NULL && ((u_int32_t)
- (packet->tick_timestamp - dst->thunder_ts) < ndpi_struct->thunder_timeout)) {
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "thunder : save dst connection packet detected\n");
- dst->thunder_ts = packet->tick_timestamp;
- }
- return;
- }
-
- if (packet->payload_packet_len > 5
- && memcmp(packet->payload, "GET /", 5) == 0 && NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_THUNDER)) {
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "HTTP packet detected.\n");
- ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- if (packet->parsed_lines > 7
- && packet->parsed_lines < 11
- && packet->line[1].len > 10
- && memcmp(packet->line[1].ptr, "Accept: */*", 11) == 0
- && packet->line[2].len > 22
- && memcmp(packet->line[2].ptr, "Cache-Control: no-cache",
- 23) == 0 && packet->line[3].len > 16
- && memcmp(packet->line[3].ptr, "Connection: close", 17) == 0
- && packet->line[4].len > 6
- && memcmp(packet->line[4].ptr, "Host: ", 6) == 0
- && packet->line[5].len > 15
- && memcmp(packet->line[5].ptr, "Pragma: no-cache", 16) == 0
- && packet->user_agent_line.ptr != NULL
- && packet->user_agent_line.len > 49
- && memcmp(packet->user_agent_line.ptr,
- "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)", 50) == 0) {
- NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
- "Thunder HTTP download detected, adding flow.\n");
- ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_CORRELATED_PROTOCOL);
- }
- }
+ struct ndpi_packet_struct *packet = &flow->packet;
+ struct ndpi_id_struct *src = flow->src;
+ struct ndpi_id_struct *dst = flow->dst;
+
+
+ if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_THUNDER) {
+ if (src != NULL && ((u_int32_t)
+ (packet->tick_timestamp - src->thunder_ts) < ndpi_struct->thunder_timeout)) {
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "thunder : save src connection packet detected\n");
+ src->thunder_ts = packet->tick_timestamp;
+ } else if (dst != NULL && ((u_int32_t)
+ (packet->tick_timestamp - dst->thunder_ts) < ndpi_struct->thunder_timeout)) {
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "thunder : save dst connection packet detected\n");
+ dst->thunder_ts = packet->tick_timestamp;
+ }
+ return;
+ }
+
+ if (packet->payload_packet_len > 5
+ && memcmp(packet->payload, "GET /", 5) == 0 && NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_THUNDER)) {
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "HTTP packet detected.\n");
+ ndpi_parse_packet_line_info(ndpi_struct, flow);
+
+ if (packet->parsed_lines > 7
+ && packet->parsed_lines < 11
+ && packet->line[1].len > 10
+ && memcmp(packet->line[1].ptr, "Accept: */*", 11) == 0
+ && packet->line[2].len > 22
+ && memcmp(packet->line[2].ptr, "Cache-Control: no-cache",
+ 23) == 0 && packet->line[3].len > 16
+ && memcmp(packet->line[3].ptr, "Connection: close", 17) == 0
+ && packet->line[4].len > 6
+ && memcmp(packet->line[4].ptr, "Host: ", 6) == 0
+ && packet->line[5].len > 15
+ && memcmp(packet->line[5].ptr, "Pragma: no-cache", 16) == 0
+ && packet->user_agent_line.ptr != NULL
+ && packet->user_agent_line.len > 49
+ && memcmp(packet->user_agent_line.ptr,
+ "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)", 50) == 0) {
+ NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG,
+ "Thunder HTTP download detected, adding flow.\n");
+ ndpi_int_thunder_add_connection(ndpi_struct, flow, NDPI_CORRELATED_PROTOCOL);
+ }
+ }
}
void ndpi_search_thunder(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
- struct ndpi_packet_struct *packet = &flow->packet;
- //
- //struct ndpi_id_struct *src = flow->src;
- //struct ndpi_id_struct *dst = flow->dst;
-
- if (packet->tcp != NULL) {
- ndpi_int_search_thunder_http(ndpi_struct, flow);
- ndpi_int_search_thunder_tcp(ndpi_struct, flow);
- } else if (packet->udp != NULL) {
- ndpi_int_search_thunder_udp(ndpi_struct, flow);
- }
+ struct ndpi_packet_struct *packet = &flow->packet;
+ //
+ //struct ndpi_id_struct *src = flow->src;
+ //struct ndpi_id_struct *dst = flow->dst;
+
+ if (packet->tcp != NULL) {
+ ndpi_int_search_thunder_http(ndpi_struct, flow);
+ ndpi_int_search_thunder_tcp(ndpi_struct, flow);
+ } else if (packet->udp != NULL) {
+ ndpi_int_search_thunder_udp(ndpi_struct, flow);
+ }
}
#endif
Powered by cgit, Themed by Ted Yin.