diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/include/ndpi_protocol_ids.h | 5 | ||||
| -rw-r--r-- | src/include/ndpi_protocols.h | 1 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 8 | ||||
| -rw-r--r-- | src/lib/protocols/hpvirtgrp.c | 71 |
4 files changed, 83 insertions, 2 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index cbcde77af..b289362f5 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -264,8 +264,8 @@ typedef enum { NDPI_PROTOCOL_LINKEDIN = 233, /* Paulo Angelo <pa@pauloangelo.com> */ NDPI_PROTOCOL_SOUNDCLOUD = 234, NDPI_PROTOCOL_CSGO = 235, /* Counter-Strike Global Offensive, Dota = 2 */ - NDPI_PROTOCOL_LISP = 236, - NDPI_PROTOCOL_DIAMETER = 237, + NDPI_PROTOCOL_LISP = 236, + NDPI_PROTOCOL_DIAMETER = 237, NDPI_PROTOCOL_APPLE_PUSH = 238, NDPI_PROTOCOL_GOOGLE_SERVICES = 239, NDPI_PROTOCOL_AMAZON_VIDEO = 240, @@ -284,6 +284,7 @@ typedef enum { NDPI_PROTOCOL_SOAP = 253, /* Toni Uhlig <matzeton@googlemail.com> */ NDPI_PROTOCOL_APPLE_SIRI = 254, /* Zied Aouini <aouinizied@gmail.com> */ NDPI_PROTOCOL_SNAPCHAT_CALL = 255, + NDPI_PROTOCOL_HPVIRTGRP = 256, /* Toni Uhlig <matzeton@googlemail.com> */ #ifdef CUSTOM_NDPI_PROTOCOLS diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 1b541360e..b753def52 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -212,5 +212,6 @@ void init_soap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int void init_dnscrypt_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mongodb_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_among_us_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +void init_hpvirtgrp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); #endif /* __NDPI_PROTOCOLS_H__ */ diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 3ae724391..42d867fd0 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1620,6 +1620,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "SnapchatCall", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HPVIRTGRP, + "HP Virtual Machine Group Management", NDPI_PROTOCOL_CATEGORY_NETWORK, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" @@ -3765,8 +3769,12 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n /* MongoDB */ init_mongodb_dissector(ndpi_str, &a, detection_bitmask); + /* AmongUS */ init_among_us_dissector(ndpi_str, &a, detection_bitmask); + /* HP Virtual Machine Group Management */ + init_hpvirtgrp_dissector(ndpi_str, &a, detection_bitmask); + #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" #endif diff --git a/src/lib/protocols/hpvirtgrp.c b/src/lib/protocols/hpvirtgrp.c new file mode 100644 index 000000000..b1ce092e7 --- /dev/null +++ b/src/lib/protocols/hpvirtgrp.c @@ -0,0 +1,71 @@ +/* + * hpvirtgrp.c + * + * Copyright (C) 2012-21 - ntop.org + * + * This module is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This module is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License. + * If not, see <http://www.gnu.org/licenses/>. + * + */ + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_HPVIRTGRP + +#include <stdlib.h> +#include "ndpi_api.h" + + +static void ndpi_int_hpvirtgrp_add_connection( + struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HPVIRTGRP, NDPI_PROTOCOL_UNKNOWN); +} + +static void ndpi_search_hpvirtgrp(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct * packet = &flow->packet; + + NDPI_LOG_DBG(ndpi_struct, "search hpvirtgrp\n"); + + if (packet->tcp != NULL) + { + if (flow->packet_counter == 1 && packet->payload_packet_len >= 4 && + packet->payload_packet_len == ntohs(*(u_int16_t*)&packet->payload[1]) && + packet->payload[0] == 0x16 && packet->payload[3] == 0x00) + { + ndpi_int_hpvirtgrp_add_connection(ndpi_struct, flow); + } + } + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); +} + + +/* ***************************************************************** */ + +void init_hpvirtgrp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, + NDPI_PROTOCOL_BITMASK *detection_bitmask) +{ + ndpi_set_bitmask_protocol_detection("HP Virtual Machine Group Management", + ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_HPVIRTGRP, + ndpi_search_hpvirtgrp, + NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} |