aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h2
-rw-r--r--src/include/ndpi_protocols.h1
-rw-r--r--src/lib/ndpi_main.c9
-rw-r--r--src/lib/protocols/bittorrent.c4
-rw-r--r--src/lib/protocols/discord.c3
-rw-r--r--src/lib/protocols/jabber.c13
-rw-r--r--src/lib/protocols/line.c9
-rw-r--r--src/lib/protocols/merakicloud.c62
8 files changed, 89 insertions, 14 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 856778dc8..379a1560e 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -94,7 +94,7 @@ typedef enum {
NDPI_PROTOCOL_OCSP = 63,
NDPI_PROTOCOL_VXLAN = 64,
NDPI_PROTOCOL_IRC = 65,
- NDPI_PROTOCOL_FREE_66 = 66, /* FREE */
+ NDPI_PROTOCOL_MERAKI_CLOUD = 66,
NDPI_PROTOCOL_JABBER = 67,
NDPI_PROTOCOL_NATS = 68,
NDPI_PROTOCOL_AMONG_US = 69,
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index d489b4cdf..9c768518e 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -236,6 +236,7 @@ void init_munin_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in
void init_elasticsearch_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_tuya_lp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_tplink_shp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
+void init_merakicloud_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
/* ndpi_main.c */
extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index dd54356cf..bc53a7597 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1322,10 +1322,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"IRC", NDPI_PROTOCOL_CATEGORY_CHAT,
ndpi_build_default_ports(ports_a, 194, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 194, 0, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_66,
- "Free66", NDPI_PROTOCOL_CATEGORY_NETWORK,
+ ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MERAKI_CLOUD,
+ "MerakiCloud", NDPI_PROTOCOL_CATEGORY_NETWORK,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 5072, 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_JABBER,
"Jabber", NDPI_PROTOCOL_CATEGORY_WEB,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
@@ -4762,6 +4762,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
/* TPLINK_SHP */
init_tplink_shp_dissector(ndpi_str, &a);
+ /* Meraki Cloud */
+ init_merakicloud_dissector(ndpi_str, &a);
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
#endif
diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c
index c618ea905..cdb62e8db 100644
--- a/src/lib/protocols/bittorrent.c
+++ b/src/lib/protocols/bittorrent.c
@@ -454,6 +454,8 @@ static void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_str
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
char *bt_proto = NULL;
+ NDPI_LOG_DBG(ndpi_struct, "Search bittorrent\n");
+
/* This is broadcast */
if(packet->iph) {
if((packet->iph->saddr == 0xFFFFFFFF) || (packet->iph->daddr == 0xFFFFFFFF))
@@ -491,7 +493,7 @@ static void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_str
wireshark/epan/dissectors/packet-bt-utp.c
*/
- if(packet->payload_packet_len >= 23 /* min header size */) {
+ if(packet->payload_packet_len >= 20 /* min header size */) {
if(
(strncmp((const char*)packet->payload, bt_search, strlen(bt_search)) == 0)
|| (strncmp((const char*)packet->payload, bt_search1, strlen(bt_search1)) == 0)
diff --git a/src/lib/protocols/discord.c b/src/lib/protocols/discord.c
index 36ba8274e..eede88b86 100644
--- a/src/lib/protocols/discord.c
+++ b/src/lib/protocols/discord.c
@@ -70,7 +70,8 @@ void ndpi_search_discord(struct ndpi_detection_module_struct *ndpi_struct,
}
}
- NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ if (flow->packet_counter >= 5)
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}
void init_discord_dissector(struct ndpi_detection_module_struct *ndpi_struct,
diff --git a/src/lib/protocols/jabber.c b/src/lib/protocols/jabber.c
index 54d13a6fb..7a8c3a3d7 100644
--- a/src/lib/protocols/jabber.c
+++ b/src/lib/protocols/jabber.c
@@ -78,6 +78,7 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st
if (flow->packet_counter > max_packets - 1)
{
ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI);
+ return;
}
for (i = 0; i < NDPI_ARRAY_LENGTH(valid_patterns); ++i)
{
@@ -86,6 +87,8 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st
return;
}
}
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
}
/* search for jabber here */
@@ -93,7 +96,7 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st
if (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("<presence ") &&
memcmp(packet->payload, "<presence ", NDPI_STATICSTRING_LEN("<presence ")) == 0 &&
ndpi_strnstr((const char *)&packet->payload[0],
- "xmlns='http://jabber.org/protocol/caps'", packet->payload_packet_len) != NULL)
+ "xmlns='http://jabber.org/protocol/", packet->payload_packet_len) != NULL)
{
ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI);
return;
@@ -128,14 +131,12 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st
/* search for subprotocols */
check_content_type_and_change_protocol(ndpi_struct, flow, 13);
- return;
}
- }
-
- if (flow->packet_counter > max_packets) {
- NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
return;
}
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ return;
}
diff --git a/src/lib/protocols/line.c b/src/lib/protocols/line.c
index 64cb7253b..e7e7f422b 100644
--- a/src/lib/protocols/line.c
+++ b/src/lib/protocols/line.c
@@ -65,8 +65,13 @@ void ndpi_search_line(struct ndpi_detection_module_struct *ndpi_struct,
if((u_int8_t)(flow->l4.udp.line_base_cnt[packet->packet_direction] +
flow->l4.udp.line_pkts[packet->packet_direction]) == packet->payload[3]) {
flow->l4.udp.line_pkts[packet->packet_direction] += 1;
- if(flow->l4.udp.line_pkts[0] >= 4 && flow->l4.udp.line_pkts[1] >= 4)
- ndpi_int_line_add_connection(ndpi_struct, flow);
+ if(flow->l4.udp.line_pkts[0] >= 4 && flow->l4.udp.line_pkts[1] >= 4) {
+ /* To avoid false positives: usually "base pkt numbers" per-direction are different */
+ if(flow->l4.udp.line_base_cnt[0] != flow->l4.udp.line_base_cnt[1])
+ ndpi_int_line_add_connection(ndpi_struct, flow);
+ else
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+ }
return;
}
}
diff --git a/src/lib/protocols/merakicloud.c b/src/lib/protocols/merakicloud.c
new file mode 100644
index 000000000..40fc1b5af
--- /dev/null
+++ b/src/lib/protocols/merakicloud.c
@@ -0,0 +1,62 @@
+/*
+ * merakicloud.c
+ *
+ * Copyright (C) 2011-23 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_MERAKI_CLOUD
+
+#include "ndpi_api.h"
+
+static void ndpi_int_merakicloud_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
+ struct ndpi_flow_struct * const flow)
+{
+ NDPI_LOG_INFO(ndpi_struct, "found MerakiCloud\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MERAKI_CLOUD,
+ NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+}
+
+static void ndpi_search_merakicloud(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct * const packet = &ndpi_struct->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search MerakiCloud\n");
+
+ if((flow->c_port == ntohs(7351) || flow->s_port == ntohs(7351)) &&
+ packet->payload_packet_len > 4 &&
+ get_u_int32_t(packet->payload, 0) == ntohl(0xfef72891)) {
+ ndpi_int_merakicloud_add_connection(ndpi_struct, flow);
+ return;
+ }
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_merakicloud_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id)
+{
+ ndpi_set_bitmask_protocol_detection("MerakiCloud", ndpi_struct, *id,
+ NDPI_PROTOCOL_MERAKI_CLOUD,
+ ndpi_search_merakicloud,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
Powered by cgit, Themed by Ted Yin.