aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h4
-rw-r--r--src/include/ndpi_protocols.h1
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_main.c8
-rw-r--r--src/lib/protocols/bittorrent.c18
-rw-r--r--src/lib/protocols/teredo.c52
6 files changed, 74 insertions, 10 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index f077be76f..891354745 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -200,7 +200,7 @@
#define NDPI_PROTOCOL_QUIC 188 /* Andrea Buscarinu <andrea.buscarinu@gmail.com> - Michele Campus <michelecampus5@gmail.com> */
#define NDPI_PROTOCOL_WHATSAPP_VOICE 189
#define NDPI_PROTOCOL_STARCRAFT 213 /* Matteo Bracci <matteobracci1@gmail.com> */
-
+#define NDPI_PROTOCOL_TEREDO 214
#define NDPI_CONTENT_AVI 39
#define NDPI_CONTENT_FLASH 40
@@ -262,7 +262,7 @@
#define NDPI_SERVICE_MICROSOFT 212
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_STARCRAFT
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_TEREDO
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index a0a897dee..6171f00bc 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -206,6 +206,7 @@ void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in
void init_battlefield_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_bgp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_teredo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_ciscovpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_citrix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_corba_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 941b5048c..4e8b1f6c4 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -135,6 +135,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/tftp.c \
protocols/thunder.c \
protocols/tor.c \
+ protocols/teredo.c \
protocols/tvants.c \
protocols/tvuplayer.c \
protocols/twitter.c \
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index f36537b49..f88651443 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -978,6 +978,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "BitTorrent",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 6771, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TEREDO,
+ no_master,
+ no_master, "Teredo",
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 3544, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_EPP,
no_master,
no_master, "EPP",
@@ -2241,6 +2246,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* BITTORRENT */
init_bittorrent_dissector(ndpi_struct, &a, detection_bitmask);
+ /* Teredo */
+ init_teredo_dissector(ndpi_struct, &a, detection_bitmask);
+
/* EDONKEY */
init_edonkey_dissector(ndpi_struct, &a, detection_bitmask);
diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c
index 5fa7c11b2..e7f55a78d 100644
--- a/src/lib/protocols/bittorrent.c
+++ b/src/lib/protocols/bittorrent.c
@@ -41,10 +41,6 @@ static u_int8_t ndpi_int_search_bittorrent_tcp_zero(struct ndpi_detection_module
*ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
-
- // struct ndpi_id_struct *src = flow->src;
- // struct ndpi_id_struct *dst = flow->dst;
-
u_int16_t a = 0;
if (packet->payload_packet_len == 1 && packet->payload[0] == 0x13) {
@@ -370,12 +366,18 @@ static void ndpi_int_search_bittorrent_tcp(struct ndpi_detection_module_struct *
void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
+ int no_bittorrent = 0;
/* This is broadcast */
- if(packet->iph
- && ((packet->iph->saddr == 0xFFFFFFFF) || (packet->iph->daddr == 0xFFFFFFFF)))
+ if(packet->iph
+ && (((packet->iph->saddr == 0xFFFFFFFF) || (packet->iph->daddr == 0xFFFFFFFF))
+ || (packet->udp
+ && ((ntohs(packet->udp->source) == 3544) /* teredo.c */
+ || (ntohs(packet->udp->dest) == 3544))))) {
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_BITTORRENT);
return;
-
+ }
+
if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_BITTORRENT) {
/* check for tcp retransmission here */
@@ -482,7 +484,7 @@ void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct,
ndpi_set_bitmask_protocol_detection("BitTorrent", ndpi_struct, detection_bitmask, *id,
NDPI_PROTOCOL_BITTORRENT,
ndpi_search_bittorrent,
- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP,
+ NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
ADD_TO_DETECTION_BITMASK);
*id += 1;
diff --git a/src/lib/protocols/teredo.c b/src/lib/protocols/teredo.c
new file mode 100644
index 000000000..9fb2c6483
--- /dev/null
+++ b/src/lib/protocols/teredo.c
@@ -0,0 +1,52 @@
+/*
+ * teredo.c
+ *
+ * Copyright (C) 2015 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocols.h"
+
+#ifdef NDPI_PROTOCOL_TEREDO
+
+/* https://en.wikipedia.org/wiki/Teredo_tunneling */
+void ndpi_search_teredo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ if(packet->udp
+ && ((ntohs(packet->udp->source) == 3544) || (ntohs(packet->udp->dest) == 3544))
+ && (packet->payload_packet_len >= 40 /* IPv6 header */))
+ ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TEREDO, NDPI_PROTOCOL_UNKNOWN);
+ else
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TEREDO);
+}
+
+
+void init_teredo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("TEREDO", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_TEREDO,
+ ndpi_search_teredo,
+ NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
+#endif
Powered by cgit, Themed by Ted Yin.