aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h8
-rw-r--r--src/lib/ndpi_content_match.c.inc21
-rw-r--r--src/lib/protocols/dns.c2
-rw-r--r--src/lib/protocols/quic.c229
-rw-r--r--src/lib/protocols/rx.c4
5 files changed, 122 insertions, 142 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 23d659bd2..4e06da989 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -269,10 +269,12 @@
#define NDPI_SERVICE_OFFICE_365 219
#define NDPI_SERVICE_CLOUDFLARE 220
#define NDPI_SERVICE_MS_ONE_DRIVE 221
-#define NDPI_PROTOCOL_MQTT 222
-#define NDPI_PROTOCOL_RX 223 /* RX: RPC protocol used by AFS */
+#define NDPI_PROTOCOL_MQTT 222
+#define NDPI_PROTOCOL_RX 223
+#define NDPI_SERVICE_WEIBO 224
+#define NDPI_SERVICE_OPENDNS 225
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_RX
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_SERVICE_OPENDNS
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index af6215842..8c05bd87d 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -22,7 +22,13 @@
static ndpi_network host_protocol_list[] = {
- /*
+ /*
+ OpenDNS
+ 208.67.216.0/21
+ */
+ { 0xD043D800 /* 208.67.216.0/21 */, 21, NDPI_SERVICE_OPENDNS },
+
+ /*
Microsoft Corporation (MS One Drive)
204.79.195.0/24
204.79.196.0/23
@@ -40,7 +46,6 @@ static ndpi_network host_protocol_list[] = {
{ 0x83FD1200 /* 131.253.18.0/24 */, 24, NDPI_SERVICE_MS_ONE_DRIVE },
{ 0x4136BF00 /* 65.54.191.0/24 */, 24, NDPI_SERVICE_MS_ONE_DRIVE },
-
/*
Amazon-EU-AWS Elastic Compute Cloud, EC2 (also used by Netflix)
46.137.128.0/18
@@ -7253,6 +7258,7 @@ ndpi_protocol_match host_match[] = {
{ "images-amazon.com", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
{ "amazonaws.com", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
{ "amazon-adsystem.com", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".cloudfront.net", "Amazon", NDPI_SERVICE_AMAZON, NDPI_PROTOCOL_ACCEPTABLE },
{ ".apple.com", "Apple", NDPI_SERVICE_APPLE, NDPI_PROTOCOL_ACCEPTABLE },
{ ".mzstatic.com", "Apple", NDPI_SERVICE_APPLE, NDPI_PROTOCOL_ACCEPTABLE },
{ ".icloud.com", "AppleiCloud", NDPI_SERVICE_APPLE_ICLOUD, NDPI_PROTOCOL_ACCEPTABLE },
@@ -7333,6 +7339,12 @@ ndpi_protocol_match host_match[] = {
{ "tim.com.br", "TIM", NDPI_SERVICE_TIM, NDPI_PROTOCOL_ACCEPTABLE },
{ "tim.it", "TIM", NDPI_SERVICE_TIM, NDPI_PROTOCOL_ACCEPTABLE },
{ ".qq.com", "QQ", NDPI_PROTOCOL_QQ, NDPI_PROTOCOL_FUN },
+ { ".weibo.com", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sinaimg.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sinajs.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sina.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+ { ".sina.com.cn", "Weibo", NDPI_SERVICE_WEIBO, NDPI_PROTOCOL_FUN },
+
/* https://support.cipafilter.com/index.php?/Knowledgebase/Article/View/117/0/snapchat---how-to-block */
{ "feelinsonice.appspot.com", "Snapchat", NDPI_SERVICE_SNAPCHAT, NDPI_PROTOCOL_FUN },
@@ -7386,7 +7398,7 @@ ndpi_protocol_match host_match[] = {
{ "evsecure-ocsp.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ "evsecure-aia.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ "evsecure-crl.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
- { ".omniroot.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".omniroot.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ ".verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ ".symcb.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
{ ".symcd.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE },
@@ -7400,7 +7412,10 @@ ndpi_protocol_match host_match[] = {
{ "coby.ns.cloudflare.com", "Cloudflare", NDPI_SERVICE_CLOUDFLARE, NDPI_PROTOCOL_ACCEPTABLE },
{ "amanda.ns.cloudflare.com", "Cloudflare", NDPI_SERVICE_CLOUDFLARE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "d295hzzivaok4k.cloudfront.net", "OpenDNS", NDPI_SERVICE_OPENDNS, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".opendns.com", "OpenDNS", NDPI_SERVICE_OPENDNS, NDPI_PROTOCOL_ACCEPTABLE },
+
{ NULL, 0 }
};
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index c54c62f18..f8b50f733 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -75,7 +75,7 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
if((dns_header.flags & FLAGS_MASK) == 0x0000)
is_query = 1;
/* 0x8000 RESPONSE */
- else if((dns_header.flags & FLAGS_MASK) != 0x8000)
+ else if((dns_header.flags & FLAGS_MASK) == 0x8000)
is_query = 0;
else
invalid = 1;
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index fed4dc2ac..ac443951b 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1,11 +1,12 @@
/*
* quic.c
*
+ * Copyright (C) 2012-16 - ntop.org
+ *
+ * Based on code of:
* Andrea Buscarinu - <andrea.buscarinu@gmail.com>
* Michele Campus - <campus@ntop.org>
*
- * Copyright (C) 2012-15 - ntop.org
- *
* This module is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
@@ -24,163 +25,125 @@
#include "ndpi_api.h"
-#define QUIC_NO_V_RES_RSV 0xC3 // 1100 0011
-
-#define QUIC_CID_MASK 0x0C // 0000 1100
-#define QUIC_VER_MASK 0x01 // 0000 0001
-#define QUIC_SEQ_MASK 0x30 // 0011 0000
+#ifdef NDPI_PROTOCOL_QUIC
-#define CID_LEN_8 0x0C // 0000 1100
-#define CID_LEN_4 0x08 // 0000 1000
-#define CID_LEN_1 0x04 // 0000 0100
-#define CID_LEN_0 0x00 // 0000 0000
+static int quic_ports(u_int16_t sport, u_int16_t dport)
+{
+ if ((sport == 443 || dport == 443 || sport == 80 || dport == 80) &&
+ (sport != 123 && dport != 123))
+ return 1;
-#define SEQ_LEN_6 0x30 // 0011 0000
-#define SEQ_LEN_4 0x20 // 0010 0000
-#define SEQ_LEN_2 0x10 // 0001 0000
-#define SEQ_LEN_1 0x00 // 0000 0000
+ return 0;
+}
-#define SEQ_CONV(ARR) (ARR[0] | ARR[1] | ARR[2] | ARR[3] | ARR[4] | ARR[5] << 8)
+/* ***************************************************************** */
+static int quic_payload(const u_int8_t *payload) {
+ if((payload[0] == 'Q')
+ && isdigit(payload[1])
+ && isdigit(payload[2])
+ && isdigit(payload[3]))
+ return(1);
-#ifdef NDPI_PROTOCOL_QUIC
-static void ndpi_int_quic_add_connection(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN);
+ return(0);
}
-static int connect_id(const unsigned char pflags)
-{
- u_int cid_len;
-
- // Check CID length.
- switch (pflags & QUIC_CID_MASK)
- {
- case CID_LEN_8: cid_len = 8; break;
- case CID_LEN_4: cid_len = 4; break;
- case CID_LEN_1: cid_len = 1; break;
- case CID_LEN_0: cid_len = 0; break;
- default:
- return -1;
-
- }
- // Return offset.
- return cid_len + 1;
+/* ***************************************************************** */
+
+static int quic_len(u_int8_t l) {
+ switch(l) {
+ case 0:
+ return(1);
+ break;
+ case 1:
+ return(2);
+ break;
+ case 2:
+ return(4);
+ break;
+ case 3:
+ return(8);
+ break;
+ }
+
+ return(0); /* NOTREACHED */
}
-static int sequence(const unsigned char *payload)
+/* ***************************************************************** */
+
+void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
{
- unsigned char conv[6] = {0};
- u_int seq_value = -1;
- int seq_lens;
- int cid_offs;
+ struct ndpi_packet_struct *packet = &flow->packet;
+ u_int32_t udp_len = packet->payload_packet_len;
+ u_int version_len = ((packet->payload[0] & 0x01) == 0) ? 0 : 4;
+ u_int cid_len = quic_len((packet->payload[0] & 0x0C) >> 2);
+ u_int seq_len = quic_len((packet->payload[0] & 0x30) >> 4);
+ u_int quic_hlen = 1 /* flags */ + version_len + seq_len + cid_len;
+
+ if(packet->udp != NULL
+ && (udp_len > (quic_hlen+4 /* QXXX */))
+ && ((packet->payload[0] & 0xC2) == 0x00)
+ && (quic_ports(ntohs(packet->udp->source), ntohs(packet->udp->dest)))
+ ) {
+ char *begin;
int i;
- // Search SEQ bytes length.
- switch (payload[0] & QUIC_SEQ_MASK)
- {
- case SEQ_LEN_6: seq_lens = 6; break;
- case SEQ_LEN_4: seq_lens = 4; break;
- case SEQ_LEN_2: seq_lens = 2; break;
- case SEQ_LEN_1: seq_lens = 1; break;
- default:
- return -1;
- }
- // Retrieve SEQ offset.
- cid_offs = connect_id(payload[0]);
-
- if (cid_offs >= 0 && seq_lens > 0)
- {
- for (i = 0; i < seq_lens; i++)
- conv[i] = payload[cid_offs + i];
-
- seq_value = SEQ_CONV(conv);
- }
-
- // Return SEQ dec value;
- return seq_value;
-}
+ if((version_len > 0) && (packet->payload[1+cid_len] != 'Q'))
+ goto no_quic;
-void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- struct ndpi_packet_struct *packet = &flow->packet;
- int ver_offs;
-
- if(packet->udp != NULL) {
-
- u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest);
-
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "calculating quic over udp.\n");
-
- if((((sport == 80) || (dport == 80) || (sport == 443) || (dport == 443))))
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
-
-
- // Settings without version. First check if PUBLIC FLAGS & SEQ bytes are 0x0. SEQ must be 1 at least.
- if ((packet->payload[0] == 0x00 && packet->payload[1] != 0x00) || ((packet->payload[0] & QUIC_NO_V_RES_RSV) == 0))
- {
- if (sequence(packet->payload) < 1)
- {
-
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
- }
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN);
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
- ndpi_int_quic_add_connection(ndpi_struct, flow);
- }
+ if(!strncmp((char*)&packet->payload[quic_hlen+17], "CHLO" /* Client Hello */, 4)) {
+ /* Check if SNI (Server Name Identification) is present */
+ for(i=quic_hlen+12; i<udp_len-3; i++) {
+ if((packet->payload[i] == 'S')
+ && (packet->payload[i+1] == 'N')
+ && (packet->payload[i+2] == 'I')
+ && (packet->payload[i+3] == 0)) {
+ u_int32_t offset = *((u_int32_t*)&packet->payload[i+4]);
+ u_int32_t prev_offset = *((u_int32_t*)&packet->payload[i-4]);
+ int len = offset-prev_offset;
+ int sni_offset = i+prev_offset+1;
+
+ while((packet->payload[sni_offset] == '-') && (sni_offset < udp_len))
+ sni_offset++;
- // Check if version, than the CID length.
- else if (packet->payload[0] & QUIC_VER_MASK)
- {
- // Skip CID length.
- ver_offs = connect_id(packet->payload[0]);
-
- if (ver_offs >= 0)
- {
- unsigned char vers[] = {packet->payload[ver_offs], packet->payload[ver_offs + 1],
- packet->payload[ver_offs + 2], packet->payload[ver_offs + 3]};
-
- // Version Match.
- if ((vers[0] == 'Q' && vers[1] == '0') &&
- ((vers[2] == '3' && (vers[3] == '3' || vers[3] == '2' || vers[3] == '1' || vers[3] == '0' )) ||
- (vers[2] == '2' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
- vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
- vers[3] == '1' || vers[3] == '0')) ||
- (vers[2] == '1' && (vers[3] == '9' || vers[3] == '8' || vers[3] == '7' || vers[3] == '6' ||
- vers[3] == '5' || vers[3] == '4' || vers[3] == '3' || vers[3] == '2' ||
- vers[3] == '1' || vers[3] == '0')) ||
- (vers[2] == '0' && vers[3] == '9')))
-
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found quic.\n");
- ndpi_int_quic_add_connection(ndpi_struct, flow);
+ if((sni_offset+len) < udp_len) {
+ int max_len = sizeof(flow->host_server_name)-1, j = 0;
+
+ if(len > max_len) len = max_len;
+
+ while((len > 0) && (sni_offset < udp_len)) {
+ flow->host_server_name[j++] = packet->payload[sni_offset];
+ sni_offset++, len--;
}
}
+
+ break;
}
- }
- else
- {
- NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude quic.\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}
}
+ return;
+ }
+
+ no_quic:
+ NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC);
}
+/* ***************************************************************** */
-void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask)
{
- ndpi_set_bitmask_protocol_detection("Quic", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_QUIC,
- ndpi_search_quic,
+ ndpi_set_bitmask_protocol_detection("QUIC", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_QUIC, ndpi_search_quic,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
*id += 1;
}
-#endif
+#endif /* NDPI_PROTOCOL_QUIC */
diff --git a/src/lib/protocols/rx.c b/src/lib/protocols/rx.c
index b7ebd5a4b..8ae98aafd 100644
--- a/src/lib/protocols/rx.c
+++ b/src/lib/protocols/rx.c
@@ -150,8 +150,8 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct,
found = 1;
else {
NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX);
- return;
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX);
+ return;
}
}
else {
Powered by cgit, Themed by Ted Yin.