aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols')
-rw-r--r--src/lib/protocols/coap.c38
-rw-r--r--src/lib/protocols/dns.c18
-rw-r--r--src/lib/protocols/dropbox.c1
-rw-r--r--src/lib/protocols/tor.c7
4 files changed, 41 insertions, 23 deletions
diff --git a/src/lib/protocols/coap.c b/src/lib/protocols/coap.c
index cddf31b7e..5f8e97863 100644
--- a/src/lib/protocols/coap.c
+++ b/src/lib/protocols/coap.c
@@ -72,7 +72,7 @@ struct ndpi_coap_hdr
[164] = "5.04 Gateway Timeout",
[165] = "5.05 Proxying Not Supported"
**/
-
+
/**
* Entry point when protocol is identified.
@@ -84,6 +84,20 @@ static void ndpi_int_coap_add_connection (struct ndpi_detection_module_struct *n
}
/**
+ * Check if the default port is acceptable
+ *
+ * UDP Port 5683 (mandatory)
+ * UDP Ports 61616-61631 compressed 6lowPAN
+ */
+static int isCoAPport(u_int16_t port) {
+ if((port == 5683)
+ || ((port >= 61616) && (port <= 61631)))
+ return(1);
+ else
+ return(0);
+}
+
+/**
* Dissector function that searches CoAP headers
*/
void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct,
@@ -91,22 +105,24 @@ void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct,
{
struct ndpi_packet_struct *packet = &flow->packet;
struct ndpi_coap_hdr * h = (struct ndpi_coap_hdr*) packet->payload;
-
+
if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
return;
}
// search for udp packet
if(packet->udp != NULL) {
-
- // header too short
- if(packet->payload_packet_len < 4) {
-
+ u_int16_t s_port = ntohs(flow->packet.udp->source);
+ u_int16_t d_port = ntohs(flow->packet.udp->dest);
+
+ if((!isCoAPport(s_port) && !isCoAPport(s_port))
+ || (packet->payload_packet_len < 4) // header too short
+ ) {
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "excluding Coap\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
return;
}
-
+
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "calculating coap over udp.\n");
// check values in header
@@ -116,21 +132,21 @@ void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct,
if((h->code >= 0 && h->code <= 5) || (h->code >= 65 && h->code <= 69) ||
(h->code >= 128 && h->code <= 134) || (h->code >= 140 && h->code <= 143) ||
(h->code >= 160 && h->code <= 165)) {
-
+
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found...\n");
ndpi_int_coap_add_connection(ndpi_struct,flow);
return;
}
}
}
- }
+ }
}
-
+
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap ...\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
return;
-
}
+
/**
* Entry point for the ndpi library
*/
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index f95ebbc36..7ee114579 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -126,8 +126,6 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
} else
invalid = 1;
- if(ndpi_struct->dns_dissect_response)
- return; /* The response will set the verdict */
} else {
/* DNS Reply */
@@ -198,11 +196,18 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
off++;
}
+
flow->host_server_name[j] = '\0';
flow->protos.dns.num_queries = (u_int8_t)dns_header.num_queries,
flow->protos.dns.num_answers = (u_int8_t) (dns_header.num_answers + dns_header.authority_rrs + dns_header.additional_rrs);
+ if(j > 0)
+ ndpi_match_host_subprotocol(ndpi_struct, flow,
+ (char *)flow->host_server_name,
+ strlen((const char*)flow->host_server_name),
+ NDPI_PROTOCOL_DNS);
+
#ifdef DNS_DEBUG
printf("[%s:%d] [num_queries=%d][num_answers=%d][reply_code=%u][rsp_type=%u][host_server_name=%s]\n",
__FILE__, __LINE__,
@@ -210,14 +215,11 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
flow->protos.dns.reply_code, flow->protos.dns.rsp_type, flow->host_server_name
);
#endif
-
- if(j > 0)
- ndpi_match_host_subprotocol(ndpi_struct, flow,
- (char *)flow->host_server_name,
- strlen((const char*)flow->host_server_name),
- NDPI_PROTOCOL_DNS);
if(flow->packet.detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
+ if(is_query && ndpi_struct->dns_dissect_response)
+ return; /* The response will set the verdict */
+
/**
Do not set the protocol with DNS if ndpi_match_host_subprotocol() has
matched a subprotocol
diff --git a/src/lib/protocols/dropbox.c b/src/lib/protocols/dropbox.c
index f51de95d2..3e53b4224 100644
--- a/src/lib/protocols/dropbox.c
+++ b/src/lib/protocols/dropbox.c
@@ -44,7 +44,6 @@ static void ndpi_check_dropbox(struct ndpi_detection_module_struct *ndpi_struct,
u_int32_t payload_len = packet->payload_packet_len;
if(packet->udp != NULL) {
-
u_int16_t dropbox_port = htons(DB_LSP_PORT);
if((packet->udp->source == dropbox_port)
diff --git a/src/lib/protocols/tor.c b/src/lib/protocols/tor.c
index 7903bf511..cb926d5f0 100644
--- a/src/lib/protocols/tor.c
+++ b/src/lib/protocols/tor.c
@@ -24,7 +24,7 @@ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
if((certificate == NULL)
|| (strlen(certificate) < 6)
- || !(strncmp(certificate, "www.", 4)))
+ || (strncmp(certificate, "www.", 4)))
return(0);
// printf("***** [SSL] %s(): %s\n", __FUNCTION__, certificate);
@@ -39,10 +39,11 @@ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
len = strlen(name);
- if(len > 6) {
+ if(len >= 5) {
for(i = 0; name[i+1] != '\0'; i++) {
+ // printf("***** [SSL] %s(): [%d][%c]", __FUNCTION__, i, name[i]);
+
if((name[i] >= '0') && (name[i] <= '9')) {
-
if(prev_num != 1) {
numbers_found++;
Powered by cgit, Themed by Ted Yin.