diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/include/ndpi_protocol_ids.h | 1 | ||||
| -rw-r--r-- | src/include/ndpi_protocols.h | 1 | ||||
| -rw-r--r-- | src/lib/inc_generated/ndpi_asn_threema.c.inc | 34 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 9 | ||||
| -rw-r--r-- | src/lib/protocols/threema.c | 103 |
5 files changed, 148 insertions, 0 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 599b5be7f..256fd8f24 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -333,6 +333,7 @@ typedef enum { NDPI_PROTOCOL_RIOTGAMES = 302, NDPI_PROTOCOL_PSIPHON = 303, NDPI_PROTOCOL_ULTRASURF = 304, + NDPI_PROTOCOL_THREEMA = 305, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 98bf36789..9336d08c0 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -231,6 +231,7 @@ void init_collectd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u void init_i3d_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_riotgames_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ultrasurf_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +void init_threema_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); /* ndpi_main.c */ extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port); diff --git a/src/lib/inc_generated/ndpi_asn_threema.c.inc b/src/lib/inc_generated/ndpi_asn_threema.c.inc new file mode 100644 index 000000000..9795a002d --- /dev/null +++ b/src/lib/inc_generated/ndpi_asn_threema.c.inc @@ -0,0 +1,34 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_threema_protocol_list[] = { + { 0x0594A000 /* 5.148.160.0/19 */, 19, NDPI_PROTOCOL_THREEMA }, + { 0x2D09A000 /* 45.9.160.0/23 */, 23, NDPI_PROTOCOL_THREEMA }, + { 0x5C2AB800 /* 92.42.184.0/21 */, 21, NDPI_PROTOCOL_THREEMA }, + { 0x5EE6D000 /* 94.230.208.0/20 */, 20, NDPI_PROTOCOL_THREEMA }, + { 0xB2D12000 /* 178.209.32.0/19 */, 19, NDPI_PROTOCOL_THREEMA }, + { 0xB958EC00 /* 185.88.236.0/22 */, 22, NDPI_PROTOCOL_THREEMA }, + { 0xC1115500 /* 193.17.85.0/24 */, 24, NDPI_PROTOCOL_THREEMA }, + { 0xD996F000 /* 217.150.240.0/20 */, 20, NDPI_PROTOCOL_THREEMA }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 2b9f46139..ee338ce76 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -85,6 +85,7 @@ #include "inc_generated/ndpi_asn_edgecast.c.inc" #include "inc_generated/ndpi_asn_goto.c.inc" #include "inc_generated/ndpi_asn_riotgames.c.inc" +#include "inc_generated/ndpi_asn_threema.c.inc" /* Third party libraries */ #include "third_party/include/ndpi_patricia.h" @@ -1944,6 +1945,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "UltraSurf", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_THREEMA, + "Threema", NDPI_PROTOCOL_CATEGORY_CHAT, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" @@ -2587,6 +2592,7 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_edgecast_protocol_list); ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_goto_protocol_list); ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_riotgames_protocol_list); + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_threema_protocol_list); } } @@ -4427,6 +4433,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* UltraSurf */ init_ultrasurf_dissector(ndpi_str, &a, detection_bitmask); + /* Threema */ + init_threema_dissector(ndpi_str, &a, detection_bitmask); + #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" #endif diff --git a/src/lib/protocols/threema.c b/src/lib/protocols/threema.c new file mode 100644 index 000000000..348b70988 --- /dev/null +++ b/src/lib/protocols/threema.c @@ -0,0 +1,103 @@ +/* + * threema.c + * + * Copyright (C) 2022 - ntop.org + * + * nDPI is free software: you can zmqtribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see <http://www.gnu.org/licenses/>. + * + */ +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_THREEMA + +#include "ndpi_api.h" + + +static void ndpi_int_threema_add_connection(struct ndpi_detection_module_struct * const ndpi_struct, + struct ndpi_flow_struct * const flow) +{ + NDPI_LOG_INFO(ndpi_struct, "found Threema\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, + NDPI_PROTOCOL_UNKNOWN, + NDPI_PROTOCOL_THREEMA, + NDPI_CONFIDENCE_DPI); +} + +static void ndpi_search_threema(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct *packet = &ndpi_struct->packet; + + NDPI_LOG_DBG(ndpi_struct, "search Threema\n"); + + if (ntohs(packet->tcp->source) != 5222 && ntohs(packet->tcp->dest) != 5222) { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + + switch (flow->packet_counter) + { + case 1: + if (packet->payload_packet_len != 48) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + } + return; + case 2: + if (packet->payload_packet_len != 80) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + } + return; + case 3: + if (packet->payload_packet_len != 191) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + } + return; + case 4: + return; // packet length varies + default: + break; + } + + if (packet->payload_packet_len < 2) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + + uint16_t len = le16toh(get_u_int16_t(packet->payload, 0)); + if (len + 2 != packet->payload_packet_len) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + + ndpi_int_threema_add_connection(ndpi_struct, flow); +} + +void init_threema_dissector(struct ndpi_detection_module_struct *ndpi_struct, + u_int32_t *id, + NDPI_PROTOCOL_BITMASK *detection_bitmask) +{ + ndpi_set_bitmask_protocol_detection("Threema", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_THREEMA, + ndpi_search_threema, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK + ); + *id += 1; +} |