aboutsummaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_content_match.c.inc2
-rw-r--r--src/lib/ndpi_main.c16
-rw-r--r--src/lib/protocols/kakaotalk_voice.c59
-rw-r--r--src/lib/protocols/rtcp.c15
5 files changed, 92 insertions, 1 deletions
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index e6db045bc..5cebcdff1 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -60,6 +60,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/ipp.c \
protocols/irc.c \
protocols/jabber.c \
+ protocols/kakaotalk_voice.c \
protocols/kerberos.c \
protocols/kontiki.c \
protocols/ldap.c \
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 9dad2511f..0274c184c 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -7296,6 +7296,8 @@ ndpi_protocol_match host_match[] = {
{ ".pandora.com", "Pandora", NDPI_SERVICE_PANDORA, NDPI_PROTOCOL_FUN },
{ ".torproject.org", "Tor", NDPI_PROTOCOL_TOR, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS },
{ "appmeutim.tim.com.br", "Meu", NDPI_SERVICE_MEU, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".timtorcedor.com.br", "Torcedor", NDPI_SERVICE_TORCEDOR, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".kakao.com", "KakaoTalk", NDPI_SERVICE_KAKAOTALK, NDPI_PROTOCOL_FUN },
{ NULL, 0 }
};
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index b7e02721b..171974043 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1471,6 +1471,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "EAQ",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 6000, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_SERVICE_KAKAOTALK_VOICE,
+ no_master,
+ no_master, "KakaoTalk_Voice",
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
custom_master[0] = NDPI_PROTOCOL_HTTP, custom_master[1] = NDPI_PROTOCOL_UNKNOWN;
custom_master1[0] = NDPI_PROTOCOL_DNS, custom_master1[1] = NDPI_PROTOCOL_UNKNOWN;
@@ -3545,7 +3550,16 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
#ifdef NDPI_PROTOCOL_EAQ
ndpi_set_bitmask_protocol_detection("EAQ", ndpi_struct, detection_bitmask, a++,
NDPI_PROTOCOL_EAQ,
- ndpi_search_quic,
+ ndpi_search_eaq,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+#endif
+
+#ifdef NDPI_SERVICE_KAKAOTALK_VOICE
+ ndpi_set_bitmask_protocol_detection("KakaoTalk_Voice", ndpi_struct, detection_bitmask, a++,
+ NDPI_SERVICE_KAKAOTALK_VOICE,
+ ndpi_search_kakaotalk_voice,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
ADD_TO_DETECTION_BITMASK);
diff --git a/src/lib/protocols/kakaotalk_voice.c b/src/lib/protocols/kakaotalk_voice.c
new file mode 100644
index 000000000..dfda5c849
--- /dev/null
+++ b/src/lib/protocols/kakaotalk_voice.c
@@ -0,0 +1,59 @@
+/*
+ * kakaotalk_voice.c
+ *
+ * Copyright (C) 2015 - ntop.org
+ *
+ * This module is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This module is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License.
+ * If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+/*
+ KakaoTalk (call only)
+
+ http://www.kakao.com/services/talk/voices
+*/
+#include "ndpi_api.h"
+
+
+#ifdef NDPI_SERVICE_KAKAOTALK_VOICE
+void ndpi_search_kakaotalk_voice(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+ unsigned char *vers;
+ int ver_offs;
+
+ if(packet->udp != NULL) {
+ if((packet->payload[0] == 0x81)
+ || (packet->payload[1] == 0xC8)
+ || (packet->payload[2] == 0x00)
+ || (packet->payload[3] == 0x0C)) {
+ /* Looks good so far */
+
+ /*
+ inetnum: 1.201.0.0 - 1.201.255.255
+ netname: KINXINC-KR
+ */
+
+ if(((ntohl(packet->iph->saddr) & 0xFFFF0000 /* 255.255.0.0 */) == 0x01C90000 /* 1.201.0.0/16 */)
+ || ((ntohl(packet->iph->daddr) & 0xFFFF0000 /* 255.255.0.0 */) == 0x01C90000 /* 1.201.0.0/16 */)) {
+ ndpi_int_add_connection(ndpi_struct, flow, NDPI_SERVICE_KAKAOTALK_VOICE, NDPI_REAL_PROTOCOL);
+ return;
+ }
+ }
+ }
+
+ NDPI_LOG(NDPI_PROTOCOL_KAKAOTALK_VOICE, ndpi_struct, NDPI_LOG_DEBUG, "Exclude kakaotalk_voice.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_SERVICE_KAKAOTALK_VOICE);
+}
+#endif
diff --git a/src/lib/protocols/rtcp.c b/src/lib/protocols/rtcp.c
index 02875648a..f618261dd 100644
--- a/src/lib/protocols/rtcp.c
+++ b/src/lib/protocols/rtcp.c
@@ -35,6 +35,19 @@ void ndpi_search_rtcp(struct ndpi_detection_module_struct *ndpi_struct, struct n
ndpi_int_rtcp_add_connection(ndpi_struct, flow);
}
} else if(packet->udp != NULL) {
+ /* Let's check first the RTCP packet length */
+ u_int16_t len, offset = 0, rtcp_section_len;
+
+ while(offset < packet->payload_packet_len) {
+ len = packet->payload[2+offset] * 256 + packet->payload[2+offset+1];
+ rtcp_section_len = (len + 1) * 4;
+
+ if((offset+rtcp_section_len) > packet->payload_packet_len)
+ goto exclude_rtcp;
+ else
+ offset += rtcp_section_len;
+ }
+
sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "calculating dport over udp.\n");
if(((packet->payload_packet_len >= 28 || packet->payload_packet_len <= 1200) &&
@@ -45,6 +58,8 @@ void ndpi_search_rtcp(struct ndpi_detection_module_struct *ndpi_struct, struct n
ndpi_int_rtcp_add_connection(ndpi_struct, flow);
}
} else {
+ exclude_rtcp:
+
NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "exclude RTCP.\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTCP);
}
Powered by cgit, Themed by Ted Yin.