aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h13
-rw-r--r--src/include/ndpi_protocols.h2
-rw-r--r--src/include/ndpi_typedefs.h1
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_content_match.c.inc25
-rw-r--r--src/lib/ndpi_main.c33
-rw-r--r--src/lib/protocols/SOMEIP.c223
-rw-r--r--src/lib/protocols/mdns.c37
8 files changed, 294 insertions, 41 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index c32613777..1e088ceaa 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -255,25 +255,24 @@
#define NDPI_PROTOCOL_TEREDO 214
#define NDPI_PROTOCOL_HOTSPOT_SHIELD 215
#define NDPI_PROTOCOL_HEP 216 /* sipcapture.org QXIP BV */
-
#define NDPI_PROTOCOL_GOOGLE_DRIVE 217
-
#define NDPI_PROTOCOL_OCS 218
#define NDPI_PROTOCOL_OFFICE_365 219
#define NDPI_PROTOCOL_CLOUDFLARE 220
#define NDPI_PROTOCOL_MS_ONE_DRIVE 221
#define NDPI_PROTOCOL_MQTT 222
#define NDPI_PROTOCOL_RX 223
-
-/* 224 is free */
-#define NDPI_PROTOCOL_FREE_224 224
-
+#define NDPI_PROTOCOL_APPLESTORE 224
#define NDPI_PROTOCOL_OPENDNS 225
#define NDPI_PROTOCOL_GIT 226
#define NDPI_PROTOCOL_DRDA 227
+#define NDPI_PROTOCOL_PLAYSTORE 228 /* Google Play Store */
+
+#define NDPI_PROTOCOL_SOMEIP 229
+
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_DRDA
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_SOMEIP
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index f1d34f75e..2ac9485ab 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -190,6 +190,7 @@ void ndpi_search_starcraft(struct ndpi_detection_module_struct *ndpi_struct, str
void ndpi_search_ubntac2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_coap(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_mqtt (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
+void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_rx(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_drda(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
@@ -332,6 +333,7 @@ void init_stracraft_dissector(struct ndpi_detection_module_struct *ndpi_struct,
void init_ubntac2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_coap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_mqtt_dissector (struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_someip_dissector (struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_rx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_hangout_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 0bede5cb2..c10101d42 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -762,6 +762,7 @@ typedef enum {
NDPI_PROTOCOL_CATEGORY_RPC, /* High level network communication protocols */
NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, /* Network administration and monitor protocols */
NDPI_PROTOCOL_CATEGORY_SYSTEM, /* System level applications */
+ NDPI_PROTOCOL_CATEGORY_SW_UPDATE, /* Software update */
NDPI_PROTOCOL_NUM_CATEGORIES /*
NOTE: Keep this as last member
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 375e9ce48..3af5881b7 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -158,6 +158,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/zeromq.c \
protocols/smpp.c \
protocols/tinc.c \
+ protocols/SOMEIP.c \
third_party/include/actypes.h \
third_party/include/ahocorasick.h \
third_party/include/ndpi_patricia.h \
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 077a04ff0..528bf84a5 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -91,7 +91,7 @@ static ndpi_network host_protocol_list[] = {
{ 0xC60BFB20 /* 198.11.251.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP },
{ 0xD02B73C0 /* 208.43.115.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP },
{ 0xD02B7A80 /* 208.43.122.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP },
-
+
/*
WeChat
@@ -859,7 +859,7 @@ static ndpi_network host_protocol_list[] = {
{ 0xAC100010 /* 172.16.0.16/32 */, 32, NDPI_PROTOCOL_BITTORRENT },
{ 0xB2A4F550 /* 178.164.245.80/32 */, 32, NDPI_PROTOCOL_BITTORRENT },
{ 0xAE597B3E /* 174.89.123.62/32 */, 32, NDPI_PROTOCOL_BITTORRENT },
-
+
/*
Tor
@@ -7983,7 +7983,16 @@ ndpi_protocol_match host_match[] = {
{ ".apple.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".mzstatic.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".aaplimg.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".icloud.com", "AppleiCloud", NDPI_PROTOCOL_APPLE_ICLOUD, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+ { "iosapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE }, /* iOS */
+ { "osxapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE }, /* MacOS */
+ { "buy.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "su.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "se.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "myapp.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "swscan.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "itunes-apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
{ "itunes.apple.com", "AppleiTunes", NDPI_PROTOCOL_APPLE_ITUNES, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_FUN },
{ ".cnn.c", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_FUN },
@@ -8013,6 +8022,9 @@ ndpi_protocol_match host_match[] = {
{ ".docs.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, NDPI_PROTOCOL_SAFE },
{ "drive.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, NDPI_PROTOCOL_SAFE },
+ { "android.clients.google.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "ggpht.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+
{ "google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".gstatic.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
@@ -8025,7 +8037,6 @@ ndpi_protocol_match host_match[] = {
{ "googleusercontent.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "googleadservices.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "googleapis.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { "ggpht.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "1e100.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "maps.google.", "GoogleMaps", NDPI_PROTOCOL_GOOGLE_MAPS, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
@@ -8089,7 +8100,7 @@ ndpi_protocol_match host_match[] = {
{ ".spotify.", "Spotify", NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN },
{ "audio-fa.scdn.co", "Spotify", NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN },
-
+
{ ".pandora.com", "Pandora", NDPI_PROTOCOL_PANDORA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN },
@@ -8144,8 +8155,8 @@ ndpi_protocol_match host_match[] = {
{ "skyapi.live.net", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE },
{ "d.docs.live.net", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE },
- { "update.microsoft.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SYSTEM, NDPI_PROTOCOL_ACCEPTABLE },
- { ".windowsupdate.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SYSTEM, NDPI_PROTOCOL_ACCEPTABLE },
+ { "update.microsoft.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".windowsupdate.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
{ "worldofwarcraft.com", "WorldOfWarcraft", NDPI_PROTOCOL_WORLDOFWARCRAFT, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
@@ -8301,7 +8312,7 @@ ndpi_protocol_match content_match[] = {
- www.fgd2iwya7vinfutj5wq5we.net
See also DGA (Domain Generation Algorithm)
-
+
In essence www.<name>.com|net
To do things properly we should check if host name in the certificate
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 9c6432de0..8ff3855af 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1571,6 +1571,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "MQTT", NDPI_PROTOCOL_CATEGORY_RPC,
ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SOMEIP,
+ no_master,
+ no_master, "SOME/IP", NDPI_PROTOCOL_CATEGORY_RPC,
+ ndpi_build_default_ports(ports_a, 30491, 30501, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 30491, 30501, 30490, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RX,
no_master,
no_master, "RX", NDPI_PROTOCOL_CATEGORY_RPC,
@@ -1622,9 +1627,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
ndpi_build_default_ports(ports_a, 655, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 655, 0, 0, 0, 0) /* UDP */);
-/* To be removed as soon as we define new protocols */
- ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_224);
-
/* calling function for host and content matched protocols */
init_string_based_protocols(ndpi_mod);
@@ -1640,11 +1642,14 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
static int ac_match_handler(AC_MATCH_t *m, void *param) {
int *matching_protocol_id = (int*)param;
- /* Stopping to the first match. We might consider searching
- * for the more specific match, paying more cpu cycles. */
+ /*
+ Return 1 for stopping to the first match.
+ We might consider searching for the more
+ specific match, paying more cpu cycles.
+ */
*matching_protocol_id = m->patterns[0].rep.number;
- return 1; /* 0 to continue searching, !0 to stop */
+ return 0; /* 0 to continue searching, !0 to stop */
}
/* ******************************************************************** */
@@ -2691,6 +2696,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* MQTT */
init_mqtt_dissector(ndpi_struct, &a, detection_bitmask);
+ /* SOME/IP */
+ init_someip_dissector(ndpi_struct, &a, detection_bitmask);
+
/* RX */
init_rx_dissector(ndpi_struct, &a, detection_bitmask);
@@ -4493,6 +4501,9 @@ const char* ndpi_category_str(ndpi_protocol_category_t category) {
case NDPI_PROTOCOL_CATEGORY_UNSPECIFIED:
return("Unspecified");
break;
+ case NDPI_PROTOCOL_CATEGORY_SW_UPDATE:
+ return("SoftwareUpdate");
+ break;
case NDPI_PROTOCOL_NUM_CATEGORIES:
return("Code should not use this internal constant");
break;
@@ -4615,9 +4626,9 @@ char* ndpi_strnstr(const char *s, const char *find, size_t slen) {
int ndpi_match_prefix(const u_int8_t *payload, size_t payload_len,
const char *str, size_t str_len)
{
- return str_len <= payload_len
- ? memcmp(payload, str, str_len) == 0
- : 0;
+ int rc = str_len <= payload_len ? memcmp(payload, str, str_len) == 0 : 0;
+
+ return rc;
}
/* ****************************************************** */
@@ -4628,7 +4639,8 @@ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_stru
int matching_protocol_id = NDPI_PROTOCOL_UNKNOWN;
AC_TEXT_t ac_input_text;
ndpi_automa *automa = is_host_match ? &ndpi_struct->host_automa : &ndpi_struct->content_automa;
-
+ int rc;
+
if((automa->ac_automa == NULL) || (string_to_match_len == 0)) return(NDPI_PROTOCOL_UNKNOWN);
if(!automa->ac_automa_finalized) {
@@ -4638,6 +4650,7 @@ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_stru
ac_input_text.astring = string_to_match, ac_input_text.length = string_to_match_len;
ac_automata_search(((AC_AUTOMATA_t*)automa->ac_automa), &ac_input_text, (void*)&matching_protocol_id);
+
ac_automata_reset(((AC_AUTOMATA_t*)automa->ac_automa));
return(matching_protocol_id);
diff --git a/src/lib/protocols/SOMEIP.c b/src/lib/protocols/SOMEIP.c
new file mode 100644
index 000000000..adffb0c33
--- /dev/null
+++ b/src/lib/protocols/SOMEIP.c
@@ -0,0 +1,223 @@
+/*
+ * SOMEIP.c
+ *
+ * Copyright (C) 2016 Sorin Zamfir <sorin.zamfir@yahoo.com>
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your omessage_typeion) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocols.h"
+#ifdef NDPI_PROTOCOL_SOMEIP
+
+enum SOMEIP_MESSAGE_TYPES {
+ REQUEST = 0x00,
+ REQUEST_NO_RETURN = 0x01,
+ NOTIFICATION = 0x02,
+ REQUEST_ACK = 0x40,
+ REQUEST_NO_RETURN_ACK = 0x41,
+ NOTIFICATION_ACK = 0x42,
+ RESPONSE = 0x80,
+ ERROR = 0x81,
+ RESPONSE_ACK = 0xc0,
+ ERROR_ACK = 0xc1
+};
+
+enum SOMEIP_RETURN_CODES {
+ E_OK = 0x00,
+ E_NOT_OK = 0x01,
+ E_UNKNOWN_SERVICE = 0x02,
+ E_UNKNOWN_METHOD = 0x03,
+ E_NOT_READY = 0x04,
+ E_NOT_REACHABLE = 0x05,
+ E_TIMEOUT = 0x06,
+ E_WRONG_PROTOCOL_VERSION = 0x07,
+ E_WRONG_INTERFACE_VERSION = 0x08,
+ E_MALFORMED_MESSAGE = 0x09,
+ E_WRONG_MESSAGE_TYPE = 0x0a,
+ E_RETURN_CODE_LEGAL_THRESHOLD = 0x40 //return codes from 0x40 (inclusive) and upwards are illegal.
+};
+
+enum SPECIAL_MESSAGE_IDS {
+ MSG_MAGIC_COOKIE = 0xffff0000,
+ MSG_MAGIC_COOKIE_ACK = 0xffff8000,
+ MSG_SD = 0xffff8100
+};
+
+enum PROTOCOL_VERSION{
+ LEGAL_PROTOCOL_VERSION = 0x01
+};
+
+enum MAGIC_COOKIE_CONSTANTS{
+ MC_REQUEST_ID = 0xDEADBEEF,
+ MC_LENGTH = 0x08,
+ MC_INTERFACE_VERSION = 0x01
+};
+
+enum DEFAULT_PROTOCOL_PORTS{
+ PORT_DEFAULT_CLIENT = 30491,
+ PORT_DEFAULT_SERVER = 30501,
+ PORT_DEFAULT_SD = 30490
+};
+
+/**
+ * Entry point when protocol is identified.
+ */
+static void ndpi_int_someip_add_connection (struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_SOMEIP,NDPI_PROTOCOL_UNKNOWN);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found.\n");
+}
+
+/**
+ * Dissector function that searches SOME/IP headers
+ */
+void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+
+ //####Maybe check carrier protocols?####
+
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP search called...\n");
+ const struct ndpi_packet_struct *packet = &flow->packet;
+ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
+ return;
+ }
+
+ //we extract the Message ID and Request ID and check for special cases later
+ u_int32_t message_id = ntohl(*((u_int32_t *)&packet->payload[0]));
+ u_int32_t request_id = ntohl(*((u_int32_t *)&packet->payload[8]));
+
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> SOME/IP Message ID: %08x [len: %u]\n",
+ message_id, packet->payload_packet_len);
+ if (packet->payload_packet_len < 16) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. mandatory header not found (not enough data for all fields)\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ //####Maximum packet size in SOMEIP depends on the carrier protocol, and I'm not certain how well enforced it is, so let's leave that for round 2####
+
+ // we extract the remaining length
+ u_int32_t someip_len = ntohl(*((u_int32_t *)&packet->payload[4]));
+ if (packet->payload_packet_len != (someip_len + 8)) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. Length field invalid!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ u_int8_t protocol_version = (u_int8_t) (packet->payload[12]);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP protocol version: [%d]\n",protocol_version);
+ if (protocol_version != LEGAL_PROTOCOL_VERSION){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid protocol version!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ u_int8_t interface_version = (packet->payload[13]);
+
+ u_int8_t message_type = (u_int8_t) (packet->payload[14]);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP message type: [%d]\n",message_type);
+
+ if ((message_type != REQUEST) && (message_type != REQUEST_NO_RETURN) && (message_type != NOTIFICATION) && (message_type != REQUEST_ACK) &&
+ (message_type != REQUEST_NO_RETURN_ACK) && (message_type != NOTIFICATION_ACK) && (message_type != RESPONSE) &&
+ (message_type != ERROR) && (message_type != RESPONSE_ACK) && (message_type != ERROR_ACK)) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid message type!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ u_int8_t return_code = (u_int8_t) (packet->payload[15]);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP return code: [%d]\n", return_code);
+ if ((return_code >= E_RETURN_CODE_LEGAL_THRESHOLD)) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid return code!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ if (message_id == MSG_MAGIC_COOKIE){
+ if ((someip_len == MC_LENGTH) && (request_id == MC_REQUEST_ID) && (interface_version == MC_INTERFACE_VERSION) &&
+ (message_type == REQUEST_NO_RETURN) && (return_code == E_OK)){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found Magic Cookie\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ else{
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP, invalid header for Magic Cookie\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+ }
+
+ if (message_id == MSG_MAGIC_COOKIE_ACK){
+ if ((someip_len == MC_LENGTH) && (request_id == MC_REQUEST_ID) && (interface_version == MC_INTERFACE_VERSION) &&
+ (message_type == REQUEST_NO_RETURN) && (return_code == E_OK)){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found Magic Cookie ACK\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ else{
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP, invalid header for Magic Cookie ACK\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+ }
+
+ if (message_id == MSG_SD){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP-SD currently not supported\n", message_type);
+ }
+
+ //Filtering by port.
+ //This check is NOT a 100% thing - these ports are mentioned in the documentation but the documentation also states they haven't been approved by IANA yet, and that the user is free to use different ports.
+ //This is is PURELY for demo purposes and the rest of the check must be filled in later on!
+ if (packet->l4_protocol == IPPROTO_UDP){
+ if ((packet->udp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SERVER)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SD))) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ }
+ if (packet->l4_protocol == IPPROTO_TCP){
+ if ((packet->tcp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->tcp->dest == ntohs(PORT_DEFAULT_SERVER))) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ }
+
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Reached the end without confirming SOME/IP ...\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+}
+/**
+ * Entry point for the ndpi library
+ */
+void init_someip_dissector (struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP dissector init...\n");
+ ndpi_set_bitmask_protocol_detection ("SOME/IP", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_SOMEIP,
+ ndpi_search_someip,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
+ *id +=1;
+}
+
+#endif // NDPI_PROTOCOL_SOMEIP
+
diff --git a/src/lib/protocols/mdns.c b/src/lib/protocols/mdns.c
index 0692b3252..d805a0bca 100644
--- a/src/lib/protocols/mdns.c
+++ b/src/lib/protocols/mdns.c
@@ -1,7 +1,7 @@
/*
* mdns.c
*
- * Copyright (C) 2016 - ntop.org
+ * Copyright (C) 2016-17 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -26,6 +26,10 @@
#define NDPI_MAX_MDNS_REQUESTS 128
+PACK_ON
+struct mdns_header {
+ u_int16_t transaction_id, flags, questions, answers, authority_rr, additional_rr;
+} PACK_OFF;
/**
MDNS header is similar to dns header
@@ -48,27 +52,26 @@
static void ndpi_int_mdns_add_connection(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+ *ndpi_struct, struct ndpi_flow_struct *flow) {
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MDNS, NDPI_PROTOCOL_UNKNOWN);
}
static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+ *ndpi_struct, struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &flow->packet;
-
- if((packet->payload[2] & 0x80) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
-
+ struct mdns_header *h = (struct mdns_header*)packet->payload;
+ u_int16_t questions = ntohs(h->questions), answers = ntohs(h->answers);
+
+ if(((packet->payload[2] & 0x80) == 0)
+ && (questions <= NDPI_MAX_MDNS_REQUESTS)
+ && (answers <= NDPI_MAX_MDNS_REQUESTS)) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n");
return 1;
}
- else if((packet->payload[2] & 0x80) != 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
+ else if(((packet->payload[2] & 0x80) != 0)
+ && (questions == 0)
+ && (answers <= NDPI_MAX_MDNS_REQUESTS)
+ && (answers != 0)) {
char answer[256];
int i, j, len;
@@ -77,7 +80,7 @@ static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
answer[j] = '\0';
- /* printf("==> [%d] %s\n", j, answer); */
+ /* printf("==> [%d] %s\n", j, answer); */
len = ndpi_min(sizeof(flow->protos.mdns.answer)-1, j);
strncpy(flow->protos.mdns.answer, (const char *)answer, len);
@@ -107,7 +110,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
/* check standard MDNS ON port 5353 */
if(dport == 5353 && packet->payload_packet_len >= 12) {
/* mdns protocol must have destination address 224.0.0.251 */
- if(packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
+ if(packet->iph != NULL /* && ntohl(packet->iph->daddr) == 0xe00000fb */) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
@@ -120,7 +123,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if(packet->iphv6 != NULL) {
const u_int32_t *daddr = packet->iphv6->ip6_dst.u6_addr.u6_addr32;
- if(daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
+ if(daddr[0] == htonl(0xff020000) /* && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb) */) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n");
Powered by cgit, Themed by Ted Yin.