aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols')
-rw-r--r--src/lib/protocols/bittorrent.c2
-rw-r--r--src/lib/protocols/btlib.c16
-rw-r--r--src/lib/protocols/btlib.h2
-rw-r--r--src/lib/protocols/diameter.c132
-rw-r--r--src/lib/protocols/quic.c2
5 files changed, 147 insertions, 7 deletions
diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c
index 727992702..81fc3baf6 100644
--- a/src/lib/protocols/bittorrent.c
+++ b/src/lib/protocols/bittorrent.c
@@ -2,7 +2,7 @@
* bittorrent.c
*
* Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2011-18 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
diff --git a/src/lib/protocols/btlib.c b/src/lib/protocols/btlib.c
index 66d9654bc..ac456f364 100644
--- a/src/lib/protocols/btlib.c
+++ b/src/lib/protocols/btlib.c
@@ -29,17 +29,17 @@
#include <string.h>
#include <strings.h>
+/*
typedef unsigned char u_int8_t;
typedef unsigned short int u_int16_t;
typedef unsigned long long int u_int64_t;
+*/
#include <stdint.h>
#include <stdlib.h>
#include <arpa/inet.h>
#endif
-typedef signed long long int i_int64_t;
-
#include "btlib.h"
int bt_parse_debug = 0;
@@ -90,6 +90,7 @@ static char *print_id_ip6_p(char *s,const struct bt_nodes6_data *b) {
}
+#if 0
void dump_bt_proto_struct(struct bt_parse_protocol *p) {
char b20h[128];
int i;
@@ -155,7 +156,9 @@ void dump_bt_proto_struct(struct bt_parse_protocol *p) {
if(p->interval) printf("\tinterval\t%d\n",p->interval);
if(p->min_interval) printf("\tmin interval\t%d\n",p->min_interval);
}
+#endif
+#ifdef BTLIB_DEBUG
static void _print_safe_str(char *msg,char *k,const u_int8_t *s,size_t l) {
static const char *th="0123456789abcdef?";
char *buf = (char*)ndpi_malloc((size_t)(l*3+2));
@@ -183,6 +186,11 @@ static void print_safe_str(char *msg,bt_parse_data_cb_t *cbd) {
}
#define DEBUG_TRACE(cmd) { if(bt_parse_debug) cmd; }
+#else
+#define DEBUG_TRACE(cmd) ;
+#endif
+
+
#define STREQ(a,b) !strcmp(a,b)
@@ -408,8 +416,8 @@ void cb_data(bt_parse_data_cb_t *cbd,int *ret) {
const u_int8_t *bt_decode(const u_int8_t *b, size_t *l, int *ret, bt_parse_data_cb_t *cbd) {
unsigned int n=0,neg=0;
- i_int64_t d = 0;
- register u_int8_t c;
+ int64_t d = 0;
+ u_int8_t c;
if(*l == 0) return NULL;
if(cbd->level > BDEC_MAXDEPT) goto bad_data;
diff --git a/src/lib/protocols/btlib.h b/src/lib/protocols/btlib.h
index a9ca53786..cc8b52b65 100644
--- a/src/lib/protocols/btlib.h
+++ b/src/lib/protocols/btlib.h
@@ -171,7 +171,7 @@ typedef struct bt_parse_data_cb {
int level;
int t;
union {
- i_int64_t i;
+ int64_t i;
b_elem_s_t s;
} v;
} bt_parse_data_cb_t;
diff --git a/src/lib/protocols/diameter.c b/src/lib/protocols/diameter.c
new file mode 100644
index 000000000..24317f498
--- /dev/null
+++ b/src/lib/protocols/diameter.c
@@ -0,0 +1,132 @@
+/*
+ * aimini.c
+ *
+ * Copyright (C) 2018 - ntop.org
+ * Written by Michele Campus - <campus@ntop.org>
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "ndpi_protocol_ids.h"
+
+#ifdef NDPI_PROTOCOL_DIAMETER
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DIAMETER
+
+#include "ndpi_api.h"
+
+
+// Header Flags possibile values
+#define REQUEST 0X80
+#define PROXYABLE 0X40
+#define ERROR 0X20
+#define RETRASM 0X10
+
+typedef enum {
+ AC = 271,
+ AS = 274,
+ CC = 272,
+ CE = 257,
+ DW = 280,
+ DP = 282,
+ RA = 258,
+ ST = 275
+} com_type_t;
+
+#define DIAM_HEADER_LEN 20
+
+// DIAMETER header
+struct diameter_header_t
+{
+ u_int8_t version;
+ u_int8_t length[3];
+ u_int8_t flags;
+ u_int8_t com_code[3];
+ u_int32_t app_id;
+ u_int32_t hop_id;
+ u_int32_t end_id;
+};
+
+
+// Check packet
+int is_diameter(struct ndpi_packet_struct *packet, int size_payload)
+{
+ // check param
+ if(!packet || size_payload == 0) return -1;
+
+ // cast to diameter header
+ struct diameter_header_t *diameter = (struct diameter_header_t *) packet;
+
+ // check if the packet is diameter
+ if(diameter->version == 0x01 &&
+ (diameter->flags == REQUEST ||
+ diameter->flags == PROXYABLE ||
+ diameter->flags == ERROR ||
+ diameter->flags == RETRASM)) {
+
+ u_int16_t com_code = diameter->com_code[2] + (diameter->com_code[1] << 8) + (diameter->com_code[0] << 8);
+
+ if(com_code == AC || com_code == AS ||
+ com_code == CC || com_code == CE ||
+ com_code == DW || com_code == DP ||
+ com_code == RA || com_code == ST)
+ return 0; // OK
+ }
+ // wrong packet
+ return -2;
+}
+
+
+void ndpi_search_diameter(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ // Diameter is on TCP
+ if(packet->tcp) {
+
+ /* Check if it's diameter */
+ int ret = is_diameter(packet, packet->payload_packet_len);
+ if(ret != 0) {
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
+ }
+ else {
+ NDPI_LOG_INFO(ndpi_struct, "found Diameter\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIAMETER, NDPI_PROTOCOL_UNKNOWN);
+ }
+ }
+ else { // UDP
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
+ }
+}
+
+
+void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("Diameter", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_DIAMETER, ndpi_search_diameter,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
+#endif /* NDPI_PROTOCOL_DIAMETER */
+
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index 24a2b8f12..203aead36 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1,7 +1,7 @@
/*
* quic.c
*
- * Copyright (C) 2012-16 - ntop.org
+ * Copyright (C) 2012-18 - ntop.org
*
* Based on code of:
* Andrea Buscarinu - <andrea.buscarinu@gmail.com>
Powered by cgit, Themed by Ted Yin.