aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols')
-rw-r--r--src/lib/protocols/lisp.c22
-rw-r--r--src/lib/protocols/ssl.c15
-rw-r--r--src/lib/protocols/stun.c16
-rw-r--r--src/lib/protocols/upnp.c65
4 files changed, 114 insertions, 4 deletions
diff --git a/src/lib/protocols/lisp.c b/src/lib/protocols/lisp.c
index 2c6d7b611..7343ca034 100644
--- a/src/lib/protocols/lisp.c
+++ b/src/lib/protocols/lisp.c
@@ -1,10 +1,30 @@
+/*
+ * list.c
+ *
+ * Copyright (C) 2017-18 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
#include "ndpi_protocol_ids.h"
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_LISP
#include "ndpi_api.h"
-#define LISP_PORT 4341
+#define LISP_PORT 4341
#define LISP_PORT1 4342
static void ndpi_int_lisp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
diff --git a/src/lib/protocols/ssl.c b/src/lib/protocols/ssl.c
index 533bc69aa..9f1390d49 100644
--- a/src/lib/protocols/ssl.c
+++ b/src/lib/protocols/ssl.c
@@ -284,9 +284,18 @@ int getSSLcertificate(struct ndpi_detection_module_struct *ndpi_struct,
#endif
if(extension_id == 0) {
- u_int begin = 0,len;
+#if 1
+ u_int16_t len;
+
+ len = (packet->payload[offset+extension_offset+3] << 8) + packet->payload[offset+extension_offset+4];
+ len = (u_int)ndpi_min(len, buffer_len-1);
+ strncpy(buffer, (char*)&packet->payload[offset+extension_offset+5], len);
+ buffer[len] = '\0';
+#else
+ /* old code */
+ u_int begin = 0;
char *server_name = (char*)&packet->payload[offset+extension_offset];
-
+
while(begin < extension_len) {
if((!ndpi_isprint(server_name[begin]))
|| ndpi_ispunct(server_name[begin])
@@ -299,6 +308,8 @@ int getSSLcertificate(struct ndpi_detection_module_struct *ndpi_struct,
len = (u_int)ndpi_min(extension_len-begin, buffer_len-1);
strncpy(buffer, &server_name[begin], len);
buffer[len] = '\0';
+#endif
+
stripCertificateTrailer(buffer, buffer_len);
if(!ndpi_struct->disable_metadata_export) {
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index ad6a585f9..cb1322e5e 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -106,7 +106,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
case 0x4002:
/* These are the only messages apparently whatsapp voice can use */
break;
-
+
case 0x8054: /* Candidate Identifier */
if((len == 4)
&& ((offset+7) < payload_length)
@@ -119,6 +119,20 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
}
break;
+ case 0x8055: /* MS Service Quality (skype?) */
+ break;
+
+ /* Proprietary fields found on skype calls */
+ case 0x24DF:
+ case 0x3802:
+ case 0x8036:
+ case 0x8095:
+ case 0x0800:
+ /* printf("====>>>> %04X\n", attribute); */
+ flow->protos.stun_ssl.stun.is_skype = 1;
+ return(NDPI_IS_STUN);
+ break;
+
case 0x8070: /* Implementation Version */
if((len == 4)
&& ((offset+7) < payload_length)
diff --git a/src/lib/protocols/upnp.c b/src/lib/protocols/upnp.c
new file mode 100644
index 000000000..1706d021d
--- /dev/null
+++ b/src/lib/protocols/upnp.c
@@ -0,0 +1,65 @@
+/*
+ * upnp.c
+ *
+ * Copyright (C) 2018 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_UPNP
+
+#include "ndpi_api.h"
+
+#define UPNP_PORT 3702
+
+void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search upnp\n");
+
+ if(packet->udp
+ && (
+ (packet->iph && ((ntohl(packet->iph->daddr) & 0xF0000000) == 0xE0000000 /* A multicast address */))
+#ifdef NDPI_DETECTION_SUPPORT_IPV6
+ ||
+ (packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000)
+#endif
+ )
+ && (ntohs(packet->udp->dest) == UPNP_PORT)
+ && (packet->payload_packet_len >= 40)
+ && (strncmp((char*)packet->payload, "<?xml", 5) == 0)
+ ) {
+ NDPI_LOG_INFO(ndpi_struct,"found teredo\n");
+ ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UPNP, NDPI_PROTOCOL_UNKNOWN);
+ } else {
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ }
+}
+
+
+void init_upnp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+ ndpi_set_bitmask_protocol_detection("UPNP", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_UPNP,
+ ndpi_search_upnp,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
+