aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h5
-rw-r--r--src/include/ndpi_protocols.h3
-rw-r--r--src/lib/ndpi_main.c11
-rw-r--r--src/lib/protocols/dnp3.c47
-rw-r--r--src/lib/protocols/iec60870-5-104.c48
5 files changed, 110 insertions, 4 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index ceb3cf2c9..96e477598 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -278,14 +278,15 @@ typedef enum {
NDPI_PROTOCOL_GOOGLE_DOCS = 241,
NDPI_PROTOCOL_WHATSAPP_FILES = 242, /* Videos, pictures, voice messages... */
NDPI_PROTOCOL_TARGUS_GETDATA = 243,
- /*
+ NDPI_PROTOCOL_DNP3 = 244,
+ NDPI_PROTOCOL_104 = 245,
+/*
IMPORTANT
before allocating a new identifier please fill up
one of those named NDPI_PROTOCOL_FREE_XXX and not used
(placeholders to avoid protocol renumbering)
*/
-
/* IMPORTANT:NDPI_LAST_IMPLEMENTED_PROTOCOL MUST BE THE LAST ELEMENT */
NDPI_LAST_IMPLEMENTED_PROTOCOL
} ndpi_protocol_id_t;
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 67341bcfe..10ac53057 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -372,5 +372,6 @@ void init_modbus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i
void init_line_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
-
+void init_dnp3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_104_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
#endif /* __NDPI_PROTOCOLS_H__ */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 25c352e37..d12041dcb 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1752,7 +1752,16 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "AmazonVideo", NDPI_PROTOCOL_CATEGORY_CLOUD,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
-
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DNP3,
+ 1 /* no subprotocol */, no_master,
+ no_master, "DNP3", NDPI_PROTOCOL_CATEGORY_NETWORK,
+ ndpi_build_default_ports(ports_a, 20000, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_104,
+ 1 /* no subprotocol */, no_master,
+ no_master, "104", NDPI_PROTOCOL_CATEGORY_NETWORK, /* Perhaps IoT in the future */
+ ndpi_build_default_ports(ports_a, 2404, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
/* calling function for host and content matched protocols */
init_string_based_protocols(ndpi_mod);
diff --git a/src/lib/protocols/dnp3.c b/src/lib/protocols/dnp3.c
new file mode 100644
index 000000000..7d0c17f70
--- /dev/null
+++ b/src/lib/protocols/dnp3.c
@@ -0,0 +1,47 @@
+/*
+ * dnp3.c
+ * Extension for dnp3 recognition
+ *
+ * Created by Cesar HM
+ */
+
+#include "ndpi_protocol_ids.h"
+#include "ndpi_api.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DNP3
+
+void ndpi_search_dnp3_tcp(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+ NDPI_LOG_DBG(ndpi_struct, "search DNP3\n");
+
+ /* Check connection over TCP */
+
+ if(packet->tcp) {
+ /* The payload of DNP3 is 10 bytes long.
+ * Header bytes: 0x0564
+ */
+ if ( packet->payload_packet_len >= 10 &&
+ packet->payload[0] == 0x05 && packet->payload[1] == 0x64 ){
+ NDPI_LOG_INFO(ndpi_struct, "found DNP3\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DNP3, NDPI_PROTOCOL_UNKNOWN);
+ return;
+ }
+ }
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+
+}
+
+
+
+void init_dnp3_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+
+ ndpi_set_bitmask_protocol_detection("DNP3", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_DNP3,
+ ndpi_search_dnp3_tcp,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
diff --git a/src/lib/protocols/iec60870-5-104.c b/src/lib/protocols/iec60870-5-104.c
new file mode 100644
index 000000000..b7439f3e0
--- /dev/null
+++ b/src/lib/protocols/iec60870-5-104.c
@@ -0,0 +1,48 @@
+/*
+ * iec60870-5-104.c
+ * Extension for industrial 104 protocol recognition
+ *
+ * Created by Cesar HM
+ */
+
+#include "ndpi_protocol_ids.h"
+#include "ndpi_api.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_104
+
+void ndpi_search_104_tcp(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+ NDPI_LOG_DBG(ndpi_struct, "search 104\n");
+ u_int16_t iec104_port = htons(2404); // port used by 104
+
+ /* Check connection over TCP */
+
+ if(packet->tcp) {
+ /* The start byte of 104 is 0x68
+ * The usual port: 2404
+ */
+ if ( packet->payload[0] == 0x68 &&
+ ((packet->tcp->dest == iec104_port) || (packet->tcp->source == iec104_port)) ){
+ NDPI_LOG_INFO(ndpi_struct, "found 104\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_104, NDPI_PROTOCOL_UNKNOWN);
+ return;
+ }
+ }
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+
+}
+
+
+
+void init_104_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+
+ ndpi_set_bitmask_protocol_detection("104", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_104,
+ ndpi_search_104_tcp,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
Powered by cgit, Themed by Ted Yin.