aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols')
-rw-r--r--src/lib/protocols/fbzero.c132
-rw-r--r--src/lib/protocols/filetopia.c98
2 files changed, 132 insertions, 98 deletions
diff --git a/src/lib/protocols/fbzero.c b/src/lib/protocols/fbzero.c
new file mode 100644
index 000000000..31acd0c9a
--- /dev/null
+++ b/src/lib/protocols/fbzero.c
@@ -0,0 +1,132 @@
+/*
+ * fbzero.c
+ *
+ * Copyright (C) 2018 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+/* https://code.facebook.com/posts/608854979307125/building-zero-protocol-for-fast-secure-mobile-connections/ */
+
+#ifdef NDPI_PROTOCOL_FBZERO
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FBZERO
+
+#include "ndpi_api.h"
+
+PACK_ON
+struct fbzero_tag {
+ char tag[4];
+ u_int32_t tag_offset_len;
+} PACK_OFF;
+
+PACK_ON
+struct fbzero_header {
+ u_int8_t flags;
+ char version[3];
+ u_int8_t unknown;
+ u_int32_t len;
+ char tag[4];
+ u_int16_t tag_number, _pad;
+} PACK_OFF;
+
+/* **************************************************************************** */
+
+void ndpi_search_fbzero(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search FacebookZero\n");
+
+ if(packet->payload_packet_len > sizeof(struct fbzero_header)) {
+ struct fbzero_header *h = (struct fbzero_header*)packet->payload;
+ struct fbzero_tag *t;
+ u_int offset = sizeof(struct fbzero_header), i, data_offset, tag_number, data_prev_offset = 0;
+
+ if((h->flags & 0x01) == 0)
+ goto fbzero_not_found;
+
+ if((h->version[0] != 'Q')
+ || (h->version[1] != 'T')
+ || (h->version[2] != 'V'))
+ goto fbzero_not_found;
+
+ if(h->unknown != 0x30)
+ goto fbzero_not_found;
+
+ t = (struct fbzero_tag*)&packet->payload[offset];
+ tag_number = h->tag_number;
+ data_offset = offset + tag_number*sizeof(struct fbzero_tag);
+
+ if(strncmp(h->tag, "CHLO", 4))
+ goto fbzero_not_found;
+
+ for(i=0; i<h->tag_number; i++) {
+#ifdef DEBUG
+ printf("[FBZERO] %u) %c%c%c%c\n", i, t->tag[0], t->tag[1], t->tag[2], t->tag[3]);
+#endif
+
+ offset += sizeof(struct fbzero_tag);
+
+ if((t->tag[0] == 'S') && (t->tag[1] == 'N')
+ && (t->tag[2] == 'I') && (t->tag[3] == '\0')) {
+ char *value = (char*)&packet->payload[data_offset + data_prev_offset];
+ u_int tag_len = t->tag_offset_len-data_prev_offset, max_len;
+
+ max_len = ndpi_min(tag_len, sizeof(flow->host_server_name)-1);
+
+ strncpy((char*)flow->host_server_name, value, max_len);
+ flow->host_server_name[max_len] = '\0';
+
+#ifdef DEBUG
+ printf("[FBZERO] SNI [@%u][len: %u][%s]\n", tag_len,
+ t->tag_offset_len-data_prev_offset, flow->host_server_name);
+#endif
+
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FBZERO, NDPI_PROTOCOL_UNKNOWN);
+
+ ndpi_match_host_subprotocol(ndpi_struct, flow, (char *)flow->host_server_name,
+ strlen((const char *)flow->host_server_name),
+ NDPI_PROTOCOL_FBZERO);
+ return;
+ }
+
+ data_prev_offset = t->tag_offset_len;
+ t = (struct fbzero_tag*)&packet->payload[offset];
+ }
+
+ return;
+ }
+
+ fbzero_not_found:
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+/* **************************************************************************** */
+
+void init_fbzero_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+ ndpi_set_bitmask_protocol_detection("FacebookZero", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_FBZERO,
+ ndpi_search_fbzero,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
+
+#endif
diff --git a/src/lib/protocols/filetopia.c b/src/lib/protocols/filetopia.c
deleted file mode 100644
index eb3215e48..000000000
--- a/src/lib/protocols/filetopia.c
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * filetopia.c
- *
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-#include "ndpi_protocol_ids.h"
-
-#ifdef NDPI_PROTOCOL_FILETOPIA
-
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_FILETOPIA
-
-#include "ndpi_api.h"
-
-
-static void ndpi_int_filetopia_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FILETOPIA, NDPI_PROTOCOL_UNKNOWN);
-}
-
-void ndpi_search_filetopia_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- struct ndpi_packet_struct *packet = &flow->packet;
-
- NDPI_LOG_DBG(ndpi_struct, "search Filetopia\n");
-
- if (flow->l4.tcp.filetopia_stage == 0) {
- if (packet->payload_packet_len >= 50 && packet->payload_packet_len <= 70
- && packet->payload[0] == 0x03 && packet->payload[1] == 0x9a
- && packet->payload[3] == 0x22 && packet->payload[packet->payload_packet_len - 1] == 0x2b) {
- NDPI_LOG_DBG2(ndpi_struct, "Filetopia stage 1 detected\n");
- flow->l4.tcp.filetopia_stage = 1;
- return;
- }
-
- } else if (flow->l4.tcp.filetopia_stage == 1) {
- if (packet->payload_packet_len >= 100 && packet->payload[0] == 0x03
- && packet->payload[1] == 0x9a && (packet->payload[3] == 0x22 || packet->payload[3] == 0x23)) {
-
- int i;
- for (i = 0; i < 10; i++) { // check 10 bytes for valid ASCII printable characters
- if (!(packet->payload[5 + i] >= 0x20 && packet->payload[5 + i] <= 0x7e)) {
- goto end_filetopia_nothing_found;
- }
- }
-
- NDPI_LOG_DBG2(ndpi_struct, "Filetopia stage 2 detected\n");
- flow->l4.tcp.filetopia_stage = 2;
- return;
- }
-
-
- } else if (flow->l4.tcp.filetopia_stage == 2) {
- if (packet->payload_packet_len >= 4 && packet->payload_packet_len <= 100
- && packet->payload[0] == 0x03 && packet->payload[1] == 0x9a
- && (packet->payload[3] == 0x22 || packet->payload[3] == 0x23)) {
- NDPI_LOG_INFO(ndpi_struct, "found Filetopia\n");
- ndpi_int_filetopia_add_connection(ndpi_struct, flow);
- return;
- }
-
- }
-
- end_filetopia_nothing_found:
- NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-}
-
-
-void init_filetopia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
- ndpi_set_bitmask_protocol_detection("Filetopia", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_FILETOPIA,
- ndpi_search_filetopia_tcp,
- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
- *id += 1;
-}
-
-#endif