aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h2
-rw-r--r--src/include/ndpi_protocols.h1
-rw-r--r--src/lib/ndpi_content_match.c.inc2
-rw-r--r--src/lib/ndpi_main.c11
-rw-r--r--src/lib/protocols/tailscale.c59
5 files changed, 70 insertions, 5 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 379a1560e..1ffe932d6 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -52,7 +52,7 @@ typedef enum {
NDPI_PROTOCOL_MS_OUTLOOK = 21, /* Hotmail / Microsoft Outlook / Exchange */
NDPI_PROTOCOL_FREE_22 = 22, /* FREE */
NDPI_PROTOCOL_MAIL_POPS = 23,
- NDPI_PROTOCOL_FREE_24 = 24, /* FREE */
+ NDPI_PROTOCOL_TAILSCALE = 24,
NDPI_PROTOCOL_FREE_25 = 25, /* FREE */
NDPI_PROTOCOL_NTOP = 26,
NDPI_PROTOCOL_COAP = 27,
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 9c768518e..9b98c82d1 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -237,6 +237,7 @@ void init_elasticsearch_dissector(struct ndpi_detection_module_struct *ndpi_stru
void init_tuya_lp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_tplink_shp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_merakicloud_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
+void init_tailscale_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
/* ndpi_main.c */
extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 7d52ddcf0..4a88ccbbd 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -1788,6 +1788,8 @@ static ndpi_protocol_match host_match[] =
{ "siriusxm.ca", "SiriusXMRadio", NDPI_PROTOCOL_SIRIUSXMRADIO, NDPI_PROTOCOL_CATEGORY_MUSIC, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
{ "siriusxm.com", "SiriusXMRadio", NDPI_PROTOCOL_SIRIUSXMRADIO, NDPI_PROTOCOL_CATEGORY_MUSIC, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "tailscale.com", "Tailscale", NDPI_PROTOCOL_TAILSCALE, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_content_match_host_match.c.inc"
#endif
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index bc53a7597..c2034afa8 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1138,10 +1138,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"Free22", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_24,
- "Free24", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT,
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_25,
"Free25", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
@@ -2082,6 +2078,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"TPLINK_SHP", NDPI_PROTOCOL_CATEGORY_IOT_SCADA,
ndpi_build_default_ports(ports_a, 9999, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 9999, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TAILSCALE,
+ "Tailscale", NDPI_PROTOCOL_CATEGORY_VPN,
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 41641, 0, 0, 0, 0) /* UDP */);
#ifdef CUSTOM_NDPI_PROTOCOLS
@@ -4765,6 +4765,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
/* Meraki Cloud */
init_merakicloud_dissector(ndpi_str, &a);
+ /* Tailscale */
+ init_tailscale_dissector(ndpi_str, &a);
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
#endif
diff --git a/src/lib/protocols/tailscale.c b/src/lib/protocols/tailscale.c
new file mode 100644
index 000000000..ac6669ccc
--- /dev/null
+++ b/src/lib/protocols/tailscale.c
@@ -0,0 +1,59 @@
+/*
+ * tailscale.c
+ *
+ * Copyright (C) 2022 - ntop.org
+ *
+ * nDPI is free software: you can zmqtribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_TAILSCALE
+
+#include "ndpi_api.h"
+
+/* https://github.com/tailscale/tailscale/blob/main/disco/disco.go
+ * https://tailscale.com/kb/1082/firewall-ports/
+ */
+
+static void ndpi_search_tailscale(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct *packet = &ndpi_struct->packet;
+ unsigned char magic[6] = { 0x54, 0x53, 0xf0, 0x9f, 0x92, 0xac };
+ unsigned short port = 41641;
+
+ NDPI_LOG_DBG(ndpi_struct, "search Tailscale\n");
+
+ if(packet->payload_packet_len > sizeof(magic) &&
+ (ntohs(flow->c_port) == port || ntohs(flow->s_port) == port) &&
+ memcmp(packet->payload, magic, sizeof(magic)) == 0) {
+ NDPI_LOG_INFO(ndpi_struct, "found Tailscale\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TAILSCALE, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+ return;
+ }
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_tailscale_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id) {
+ ndpi_set_bitmask_protocol_detection("Tailscale", ndpi_struct, *id,
+ NDPI_PROTOCOL_TAILSCALE,
+ ndpi_search_tailscale,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
Powered by cgit, Themed by Ted Yin.