aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h2
-rw-r--r--src/include/ndpi_protocols.h1
-rw-r--r--src/lib/ndpi_main.c9
-rw-r--r--src/lib/protocols/sd_rtn.c97
4 files changed, 105 insertions, 4 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 918e567c7..f1ff5b30b 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -199,7 +199,7 @@ typedef enum {
NDPI_PROTOCOL_CORBA = 168,
NDPI_PROTOCOL_UBUNTUONE = 169,
NDPI_PROTOCOL_WHOIS_DAS = 170,
- NDPI_PROTOCOL_FREE_171 = 171, /* FREE */
+ NDPI_PROTOCOL_SD_RTN = 171, /* Agora SD-RTN: https://www.agora.io/en */
NDPI_PROTOCOL_SOCKS = 172,
NDPI_PROTOCOL_NINTENDO = 173,
NDPI_PROTOCOL_RTMP = 174,
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index e225ba04a..4e9509cac 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -222,6 +222,7 @@ void init_avast_securedns_dissector(struct ndpi_detection_module_struct *ndpi_st
void init_cassandra_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_ethernet_ip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_toca_boca_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_sd_rtn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
/* ndpi_main.c */
extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2bd3c0a5a..7cbc9b316 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1619,9 +1619,9 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"Whois-DAS", NDPI_PROTOCOL_CATEGORY_NETWORK,
ndpi_build_default_ports(ports_a, 43, 4343, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
- ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_171,
- "FREE171", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS,
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SD_RTN,
+ "SD-RTN", NDPI_PROTOCOL_CATEGORY_MEDIA,
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SOCKS,
"SOCKS", NDPI_PROTOCOL_CATEGORY_WEB,
@@ -4311,6 +4311,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
/* TocaBoca */
init_toca_boca_dissector(ndpi_str, &a, detection_bitmask);
+ /* SD-RTN Software Defined Real-time Network */
+ init_sd_rtn_dissector(ndpi_str, &a, detection_bitmask);
+
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
#endif
diff --git a/src/lib/protocols/sd_rtn.c b/src/lib/protocols/sd_rtn.c
new file mode 100644
index 000000000..1ddd6af06
--- /dev/null
+++ b/src/lib/protocols/sd_rtn.c
@@ -0,0 +1,97 @@
+/*
+ * sd_rtn.c
+ *
+ * Copyright (C) 2011-22 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_SD_RTN
+
+#include "ndpi_api.h"
+
+static void ndpi_int_sd_rtn_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
+ struct ndpi_flow_struct * const flow)
+{
+ NDPI_LOG_INFO(ndpi_struct, "found Software Defined Real-time Network (SD-RTN)\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow,
+ NDPI_PROTOCOL_SD_RTN,
+ NDPI_PROTOCOL_UNKNOWN,
+ NDPI_CONFIDENCE_DPI);
+}
+
+static int ndpi_int_sd_rtn_dissect_sni(struct ndpi_flow_struct * const flow,
+ u_int8_t const * const payload,
+ u_int32_t payload_len)
+{
+ u_int32_t sni_len = ntohs(get_u_int16_t(payload, 16));
+
+ if (sni_len + 19 > payload_len)
+ {
+ return -1;
+ }
+
+ if (payload[18] != 0x00)
+ {
+ return -1;
+ }
+
+ ndpi_hostname_sni_set(flow, &payload[19], sni_len);
+
+ return 0;
+}
+
+void ndpi_search_sd_rtn(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct * const packet = &ndpi_struct->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search Software Defined Real-time Network (SD-RTN)\n");
+
+ if (packet->udp != NULL)
+ {
+ if (packet->payload_packet_len >= 20
+ && packet->payload[6] == 0x21
+ && ntohl(get_u_int32_t(packet->payload, 12)) == 0x04534e49 /* "\x04SNI" */)
+ {
+ int ret = ndpi_int_sd_rtn_dissect_sni(flow, packet->payload,
+ packet->payload_packet_len);
+
+ if (ret == 0)
+ {
+ ndpi_int_sd_rtn_add_connection(ndpi_struct, flow);
+ return;
+ }
+ }
+ }
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_sd_rtn_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("SD-RTN", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_SD_RTN,
+ ndpi_search_sd_rtn,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
Powered by cgit, Themed by Ted Yin.