aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h3
-rw-r--r--src/include/ndpi_protocols.h2
-rw-r--r--src/lib/Makefile.am8
-rw-r--r--src/lib/ndpi_content_match.c.inc3
-rw-r--r--src/lib/ndpi_main.c101
-rw-r--r--src/lib/protocols/bittorrent.c9
-rw-r--r--src/lib/protocols/coap.c38
-rw-r--r--src/lib/protocols/drda.c106
-rw-r--r--src/lib/protocols/dropbox.c3
-rw-r--r--src/lib/protocols/git.c83
-rw-r--r--src/lib/protocols/quic.c19
-rw-r--r--src/lib/protocols/rx.c10
-rw-r--r--src/lib/protocols/teredo.c2
-rw-r--r--src/lib/protocols/tor.c7
14 files changed, 297 insertions, 97 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index adc56fc11..58253e9ce 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -274,8 +274,9 @@
#define NDPI_SERVICE_WEIBO 224
#define NDPI_SERVICE_OPENDNS 225
#define NDPI_PROTOCOL_GIT 226
+#define NDPI_PROTOCOL_DRDA 227
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_GIT
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_DRDA
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 04121347f..82d5bdb69 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -195,6 +195,7 @@ void ndpi_search_coap(struct ndpi_detection_module_struct *ndpi_struct, struct n
void ndpi_search_mqtt (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_rx(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
+void ndpi_search_drda(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
/* --- INIT FUNCTIONS --- */
void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
@@ -336,4 +337,5 @@ void init_coap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
void init_mqtt_dissector (struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_rx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_drda_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
#endif /* __NDPI_PROTOCOLS_H__ */
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index d83fdd5c0..18c195dbe 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -26,6 +26,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/bittorrent.c \
protocols/ciscovpn.c \
protocols/citrix.c \
+ protocols/coap.c \
protocols/collectd.c \
protocols/corba.c \
protocols/crossfire.c \
@@ -36,6 +37,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/directdownloadlink.c \
protocols/dns.c \
protocols/dofus.c \
+ protocols/drda.c \
protocols/dropbox.c \
protocols/eaq.c \
protocols/edonkey.c \
@@ -45,6 +47,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/florensia.c \
protocols/ftp_control.c \
protocols/ftp_data.c \
+ protocols/git.c \
protocols/gnutella.c \
protocols/gtp.c \
protocols/guildwars.c \
@@ -74,6 +77,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/mgcp.c \
protocols/mms.c \
protocols/mpegts.c \
+ protocols/mqtt.c \
protocols/msn.c \
protocols/mssql.c \
protocols/mysql.c \
@@ -104,6 +108,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/rtmp.c \
protocols/rtp.c \
protocols/rtsp.c \
+ protocols/rx.c \
protocols/sflow.c \
protocols/shoutcast.c \
protocols/sip.c \
@@ -152,9 +157,6 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/yahoo.c \
protocols/zattoo.c \
protocols/zeromq.c \
- protocols/coap.c \
- protocols/mqtt.c \
- protocols/rx.c \
third_party/include/actypes.h \
third_party/include/ahocorasick.h \
third_party/include/node.h \
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index ce56b79a6..aa806751b 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -7291,6 +7291,7 @@ ndpi_protocol_match host_match[] = {
{ "googleadservices.", "Google", NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE },
{ "googleapis.com", "Google", NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE },
{ "ggpht.com", "Google", NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "1e100.net", "Google", NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE },
{ "maps.google.", "GoogleMaps", NDPI_SERVICE_GOOGLE_MAPS, NDPI_PROTOCOL_ACCEPTABLE },
{ "maps.gstatic.com", "GoogleMaps", NDPI_SERVICE_GOOGLE_MAPS, NDPI_PROTOCOL_ACCEPTABLE },
{ ".gmail.", "GMail", NDPI_SERVICE_GMAIL, NDPI_PROTOCOL_SAFE },
@@ -7541,7 +7542,7 @@ static const char *ndpi_en_bigrams[] = {
static const char *ndpi_en_impossible_bigrams[] = {
"bk", "bq", "bx", "cb", "cf", "cg", "cj", "cp", "cv", "cw", "cx", "dx", "fk", "fq", "fv", "fx", "ee",
"fz", "gq", "gv", "gx", "hh", "hk", "hv", "hx", "hz", "iy", "jb", "jc", "jd", "jf", "jg", "jh", "jk",
- "jl", "jm", "jn", "jp", "jq", "jr", "js", "jt", "jv", "jw", "jx", "jy", "jz", "kg", "kq", "kv", "kx",
+ "jl", "jm", "jn", "jp", "jq", "jr", /* "js", */ "jt", "jv", "jw", "jx", "jy", "jz", "kg", "kq", "kv", "kx",
"kz", "lq", "lx", "mg", "mj", "mq", "mx", "mz", "pq", "pv", "px", "qb", "qc", "qd", "qe", "qf", "ii",
"qg", "qh", "qj", "qk", "ql", "qm", "qn", "qo", "qp", "qr", "qs", "qt", "qv", "qw", "qx", "qy", "uu",
"qz", "sx", "sz", "tq", "tx", "vb", "vc", "vd", "vf", "vg", "vh", "vj", "vk", "vm", "vn", "vp", "bw",
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2c4b491ed..f97a2fffc 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1365,6 +1365,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "QUIC",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 443, 80, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DROPBOX,
+ no_master,
+ no_master, "Dropbox",
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 17500, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_EAQ,
no_master,
no_master, "EAQ",
@@ -1454,43 +1459,43 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WHOIS_DAS,
no_master,
no_master, "Whois-DAS",
- ndpi_build_default_ports(ports_a, 43, 4343, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 43, 4343, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_COLLECTD,
no_master,
no_master, "Collectd",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 25826, 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 25826, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SOCKS,
no_master,
no_master, "SOCKS",
- ndpi_build_default_ports(ports_a, 1080, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 1080, 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 1080, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 1080, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TFTP,
no_master,
no_master, "TFTP",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 69, 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 69, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RTMP,
no_master,
no_master, "RTMP",
- ndpi_build_default_ports(ports_a, 1935, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 1935, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_PANDO,
no_master,
no_master, "Pando_Media_Booster",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MEGACO,
no_master,
no_master, "Megaco",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 2944 , 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 2944 , 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_REDIS,
no_master,
no_master, "Redis",
- ndpi_build_default_ports(ports_a, 6379, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0 , 0, 0, 0, 0) /* UDP */);
+ ndpi_build_default_ports(ports_a, 6379, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0 , 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_ZMQ,
no_master,
no_master, "ZeroMQ",
@@ -1509,13 +1514,13 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_UBNTAC2,
no_master,
no_master, "UBNTAC2",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
- ndpi_build_default_ports(ports_b, 10001, 0, 0, 0, 0)); /* UDP */
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 10001, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_MS_LYNC,
no_master,
no_master, "Lync",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_VIBER,
no_master,
no_master, "Viber",
@@ -1526,19 +1531,27 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "COAP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 5683, 5684, 0, 0, 0)); /* UDP */
- ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_MQTT,
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MQTT,
no_master,
no_master, "MQTT",
ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0);
- ports_b[0].port_low = 7000;
- ports_b[0].port_high = 7032; /* See https://www-01.ibm.com/support/docview.wss?uid=swg21044407 */
- ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_RX,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RX,
no_master,
no_master, "RX",
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
- ports_b); /* UDP */
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_GIT,
+ no_master,
+ no_master, "Git",
+ ndpi_build_default_ports(ports_a, 9418, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DRDA,
+ no_master,
+ no_master, "DRDA",
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+
/* calling function for host and content matched protocols */
init_string_based_protocols(ndpi_mod);
@@ -2317,7 +2330,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* SSDP */
init_ssdp_dissector(ndpi_struct, &a, detection_bitmask);
-/* WORLD_OF_WARCRAFT */
+ /* WORLD_OF_WARCRAFT */
init_world_of_warcraft_dissector(ndpi_struct, &a, detection_bitmask);
/* POSTGRES */
@@ -2551,7 +2564,13 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* RX */
init_rx_dissector(ndpi_struct, &a, detection_bitmask);
- /* Put false-positive sensitive protocols at the end */
+ /* GIT */
+ init_git_dissector(ndpi_struct, &a, detection_bitmask);
+
+ /* DRDA */
+ init_drda_dissector(ndpi_struct, &a, detection_bitmask);
+
+ /*** Put false-positive sensitive protocols at the end ***/
/* SKYPE */
init_skype_dissector(ndpi_struct, &a, detection_bitmask);
@@ -3277,8 +3296,6 @@ ndpi_protocol ndpi_l4_detection_process_packet(struct ndpi_detection_module_stru
flow->packet.iphv6 ||
#endif
flow->packet.iph)) {
- u_int32_t saddr, daddr;
-
flow->protocol_id_already_guessed = 1;
flow->guessed_protocol_id = (int16_t)ndpi_guess_protocol_id(ndpi_struct, l4_proto, sport, dport);
@@ -4470,7 +4487,6 @@ static int ndpi_automa_match_string_subprotocol(struct ndpi_detection_module_str
u_int8_t is_host_match) {
int matching_protocol_id = ndpi_match_string_subprotocol(ndpi_struct, string_to_match, string_to_match_len, is_host_match);
struct ndpi_packet_struct *packet = &flow->packet;
- AC_TEXT_t ac_input_text;
#ifdef DEBUG
{
@@ -4566,25 +4582,6 @@ char* ndpi_revision() { return(NDPI_GIT_RELEASE); }
#ifdef WIN32
-/*
- int pthread_mutex_init(pthread_mutex_t *mutex, void *unused) {
- unused = NULL;
- *mutex = CreateMutex(NULL, FALSE, NULL);
- return *mutex == NULL ? -1 : 0;
- }
-
- int pthread_mutex_destroy(pthread_mutex_t *mutex) {
- return CloseHandle(*mutex) == 0 ? -1 : 0;
- }
-
- int pthread_mutex_lock(pthread_mutex_t *mutex) {
- return WaitForSingleObject(*mutex, INFINITE) == WAIT_OBJECT_0 ? 0 : -1;
- }
-
- int pthread_mutex_unlock(pthread_mutex_t *mutex) {
- return ReleaseMutex(*mutex) == 0 ? -1 : 0;
- }
-*/
/* http://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=src/port/gettimeofday.c;h=75a91993b74414c0a1c13a2a09ce739cb8aa8a08;hb=HEAD */
int gettimeofday(struct timeval * tp, struct timezone * tzp) {
/* FILETIME of Jan 1 1970 00:00:00. */
diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c
index 6ac9ec69a..0eebe07ee 100644
--- a/src/lib/protocols/bittorrent.c
+++ b/src/lib/protocols/bittorrent.c
@@ -53,8 +53,7 @@ static u_int8_t is_utp_pkt(const u_int8_t *payload, u_int payload_len) {
static void ndpi_add_connection_as_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow,
int bt_offset, int check_hash,
- const u_int8_t save_detection, const u_int8_t encrypted_connection/* , */
- /* ndpi_protocol_type_t protocol_type */)
+ const u_int8_t save_detection, const u_int8_t encrypted_connection)
{
if(check_hash) {
const char *bt_hash = NULL; /* 20 bytes long */
@@ -92,8 +91,7 @@ static u_int8_t ndpi_int_search_bittorrent_tcp_zero(struct ndpi_detection_module
NDPI_LOG(NDPI_PROTOCOL_BITTORRENT,
ndpi_struct, NDPI_LOG_TRACE, "BT: plain BitTorrent protocol detected\n");
ndpi_add_connection_as_bittorrent(ndpi_struct, flow, 19, 1,
- NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION/* , */
- /* NDPI_REAL_PROTOCOL */);
+ NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION);
return 1;
}
}
@@ -125,8 +123,7 @@ static u_int8_t ndpi_int_search_bittorrent_tcp_zero(struct ndpi_detection_module
NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct,
NDPI_LOG_TRACE, "BT: plain Bitcomet persistent seed protocol detected\n");
ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1,
- NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION/* , */
- /* NDPI_CORRELATED_PROTOCOL */);
+ NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION);
return 1;
}
diff --git a/src/lib/protocols/coap.c b/src/lib/protocols/coap.c
index cddf31b7e..5f8e97863 100644
--- a/src/lib/protocols/coap.c
+++ b/src/lib/protocols/coap.c
@@ -72,7 +72,7 @@ struct ndpi_coap_hdr
[164] = "5.04 Gateway Timeout",
[165] = "5.05 Proxying Not Supported"
**/
-
+
/**
* Entry point when protocol is identified.
@@ -84,6 +84,20 @@ static void ndpi_int_coap_add_connection (struct ndpi_detection_module_struct *n
}
/**
+ * Check if the default port is acceptable
+ *
+ * UDP Port 5683 (mandatory)
+ * UDP Ports 61616-61631 compressed 6lowPAN
+ */
+static int isCoAPport(u_int16_t port) {
+ if((port == 5683)
+ || ((port >= 61616) && (port <= 61631)))
+ return(1);
+ else
+ return(0);
+}
+
+/**
* Dissector function that searches CoAP headers
*/
void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct,
@@ -91,22 +105,24 @@ void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct,
{
struct ndpi_packet_struct *packet = &flow->packet;
struct ndpi_coap_hdr * h = (struct ndpi_coap_hdr*) packet->payload;
-
+
if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
return;
}
// search for udp packet
if(packet->udp != NULL) {
-
- // header too short
- if(packet->payload_packet_len < 4) {
-
+ u_int16_t s_port = ntohs(flow->packet.udp->source);
+ u_int16_t d_port = ntohs(flow->packet.udp->dest);
+
+ if((!isCoAPport(s_port) && !isCoAPport(s_port))
+ || (packet->payload_packet_len < 4) // header too short
+ ) {
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "excluding Coap\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
return;
}
-
+
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "calculating coap over udp.\n");
// check values in header
@@ -116,21 +132,21 @@ void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct,
if((h->code >= 0 && h->code <= 5) || (h->code >= 65 && h->code <= 69) ||
(h->code >= 128 && h->code <= 134) || (h->code >= 140 && h->code <= 143) ||
(h->code >= 160 && h->code <= 165)) {
-
+
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found...\n");
ndpi_int_coap_add_connection(ndpi_struct,flow);
return;
}
}
}
- }
+ }
}
-
+
NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap ...\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP);
return;
-
}
+
/**
* Entry point for the ndpi library
*/
diff --git a/src/lib/protocols/drda.c b/src/lib/protocols/drda.c
new file mode 100644
index 000000000..9240e8364
--- /dev/null
+++ b/src/lib/protocols/drda.c
@@ -0,0 +1,106 @@
+/*
+ * drda.c
+ *
+ * Copyright (C) 2012-16 - ntop.org
+ *
+ * This module is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This module is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License.
+ * If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include "ndpi_api.h"
+
+#ifdef NDPI_PROTOCOL_DRDA
+
+#define DRDA_PORT 50000
+
+struct ndpi_drda_hdr {
+ u_int16_t length;
+ u_int8_t magic;
+ u_int8_t format;
+ u_int16_t correlID;
+ u_int16_t length2;
+ u_int16_t code_pnt;
+};
+
+
+void ndpi_search_drda(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct * packet = &flow->packet;
+ u_int16_t payload_len = packet->payload_packet_len;
+ u_int16_t count = 0;
+
+ if(packet->tcp != NULL) {
+
+ /* check port */
+ if((ntohs(packet->tcp->source) == DRDA_PORT ||
+ ntohs(packet->tcp->dest) == DRDA_PORT)) {
+
+ struct ndpi_drda_hdr * drda = (struct ndpi_drda_hdr *) packet->payload;
+
+ u_int16_t len = ntohs(drda->length);
+
+ /* check first header */
+ if(len - 6 != ntohs(drda->length2) &&
+ drda->magic != 0xd0)
+ goto no_drda;
+
+ /* check if there are more drda headers */
+ if(payload_len > len) {
+
+ count = len;
+ const u_int8_t * pp = packet->payload + len;
+
+ while(count < payload_len)
+ {
+ /* update info */
+ drda = (struct ndpi_drda_hdr *) pp;
+ len = ntohs(drda->length);
+
+ if(len - 6 != ntohs(drda->length2) &&
+ drda->magic != 0xd0)
+ goto no_drda;
+
+ count += len;
+ }
+ if(count != payload_len) goto no_drda;
+ }
+ NDPI_LOG(NDPI_PROTOCOL_DRDA, ndpi_struct, NDPI_LOG_DEBUG, "found DRDA.\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DRDA, NDPI_PROTOCOL_UNKNOWN);
+ return;
+ }
+ }
+
+ no_drda:
+ NDPI_LOG(NDPI_PROTOCOL_DRDA, ndpi_struct, NDPI_LOG_DEBUG, "exclude DRDA.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DRDA);
+}
+
+
+/* ***************************************************************** */
+
+
+void init_drda_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("DRDA", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_DRDA,
+ ndpi_search_drda,
+ NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
+#endif /* NDPI_PROTOCOL_DRDA */
diff --git a/src/lib/protocols/dropbox.c b/src/lib/protocols/dropbox.c
index f51de95d2..d8babfb1b 100644
--- a/src/lib/protocols/dropbox.c
+++ b/src/lib/protocols/dropbox.c
@@ -1,7 +1,7 @@
/*
* dropbox.c
*
- * Copyright (C) 2011-13 by ntop.org
+ * Copyright (C) 2012-16 by ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -44,7 +44,6 @@ static void ndpi_check_dropbox(struct ndpi_detection_module_struct *ndpi_struct,
u_int32_t payload_len = packet->payload_packet_len;
if(packet->udp != NULL) {
-
u_int16_t dropbox_port = htons(DB_LSP_PORT);
if((packet->udp->source == dropbox_port)
diff --git a/src/lib/protocols/git.c b/src/lib/protocols/git.c
new file mode 100644
index 000000000..f3e015aef
--- /dev/null
+++ b/src/lib/protocols/git.c
@@ -0,0 +1,83 @@
+/*
+ * git.c
+ *
+ * Copyright (C) 2012-16 - ntop.org
+ *
+ * This module is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This module is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License.
+ * If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#include <stdlib.h>
+#include "ndpi_api.h"
+
+#ifdef NDPI_PROTOCOL_GIT
+
+#define GIT_PORT 9418
+
+void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct * packet = &flow->packet;
+
+ if((packet->tcp != NULL) && (packet->payload_packet_len > 4)) {
+ if((ntohs(packet->tcp->source) == GIT_PORT)
+ || (ntohs(packet->tcp->dest) == GIT_PORT)) {
+ const u_int8_t * pp = packet->payload;
+ u_int16_t payload_len = packet->payload_packet_len;
+ u_int8_t found_git = 1;
+ u_int16_t git_len = 0, offset = 0;
+
+ while((offset+4) < payload_len) {
+ char len[5];
+ u_int32_t git_pkt_len;
+
+ memcpy(&len, &pp[offset], 4), len[4] = 0;
+ git_pkt_len = atoi(len);
+
+ if(payload_len < git_pkt_len) {
+ found_git = 0;
+ break;
+ } else
+ offset += git_pkt_len, payload_len -= git_pkt_len;
+ }
+
+ if(found_git) {
+ NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "found Git.\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GIT, NDPI_PROTOCOL_UNKNOWN);
+ return;
+ }
+ }
+ }
+
+ NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "exclude Git.\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_GIT);
+}
+
+
+/* ***************************************************************** */
+
+
+void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+ NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("Git", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_GIT,
+ ndpi_search_git,
+ NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
+#endif /* NDPI_PROTOCOL_GIT */
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index ac443951b..6e1ad77cc 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -22,7 +22,6 @@
*
*/
-
#include "ndpi_api.h"
#ifdef NDPI_PROTOCOL_QUIC
@@ -38,18 +37,6 @@ static int quic_ports(u_int16_t sport, u_int16_t dport)
/* ***************************************************************** */
-static int quic_payload(const u_int8_t *payload) {
- if((payload[0] == 'Q')
- && isdigit(payload[1])
- && isdigit(payload[2])
- && isdigit(payload[3]))
- return(1);
-
- return(0);
-}
-
-/* ***************************************************************** */
-
static int quic_len(u_int8_t l) {
switch(l) {
case 0:
@@ -119,6 +106,12 @@ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct,
flow->host_server_name[j++] = packet->payload[sni_offset];
sni_offset++, len--;
}
+
+ ndpi_match_host_subprotocol(ndpi_struct, flow,
+ (char *)flow->host_server_name,
+ strlen((const char*)flow->host_server_name),
+ NDPI_PROTOCOL_QUIC);
+
}
break;
diff --git a/src/lib/protocols/rx.c b/src/lib/protocols/rx.c
index 319dd6d4d..9d27d5e18 100644
--- a/src/lib/protocols/rx.c
+++ b/src/lib/protocols/rx.c
@@ -30,7 +30,8 @@
/* See http://web.mit.edu/kolya/afs/rx/rx-spec for procotol description. */
/* The should be no need for explicit packing, but just in case... */
-struct __attribute__((__packed__)) ndpi_rx_header {
+PACK_ON
+struct ndpi_rx_header {
u_int32_t conn_epoch;
u_int32_t conn_id;
u_int32_t call_number;
@@ -42,7 +43,7 @@ struct __attribute__((__packed__)) ndpi_rx_header {
u_int8_t security;
u_int16_t checksum;
u_int16_t service_id;
-};
+} PACK_OFF;
/* Type values */
#define DATA 1
@@ -108,7 +109,7 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct,
**/
/* TYPE field */
- if((header->type < DATA) && (header->type > VERSION)) {
+ if((header->type < DATA) || (header->type > VERSION)) {
NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX);
return;
@@ -170,8 +171,7 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct,
security:
/* SECURITY field */
- if(header->security != 0 && header->security != 1 &&
- header->security != 2 && header->security != 3)
+ if(header->security > 3)
{
NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n");
NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX);
diff --git a/src/lib/protocols/teredo.c b/src/lib/protocols/teredo.c
index 9fb2c6483..079d1fbcd 100644
--- a/src/lib/protocols/teredo.c
+++ b/src/lib/protocols/teredo.c
@@ -29,6 +29,8 @@ void ndpi_search_teredo(struct ndpi_detection_module_struct *ndpi_struct, struct
struct ndpi_packet_struct *packet = &flow->packet;
if(packet->udp
+ && packet->iph
+ && ((ntohl(packet->iph->daddr) & 0xF0000000) == 0xE0000000 /* A multicast address */)
&& ((ntohs(packet->udp->source) == 3544) || (ntohs(packet->udp->dest) == 3544))
&& (packet->payload_packet_len >= 40 /* IPv6 header */))
ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TEREDO, NDPI_PROTOCOL_UNKNOWN);
diff --git a/src/lib/protocols/tor.c b/src/lib/protocols/tor.c
index 1a538eefd..2152da328 100644
--- a/src/lib/protocols/tor.c
+++ b/src/lib/protocols/tor.c
@@ -1,7 +1,7 @@
/*
* tor.c
*
- * Copyright (C) 2015 ntop.org
+ * Copyright (C) 2016 ntop.org
* Copyright (C) 2013 Remy Mudingay <mudingay@ill.fr>
*
*/
@@ -39,10 +39,11 @@ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
len = strlen(name);
- if(len > 6) {
+ if(len >= 5) {
for(i = 0; name[i+1] != '\0'; i++) {
+ // printf("***** [SSL] %s(): [%d][%c]", __FUNCTION__, i, name[i]);
+
if((name[i] >= '0') && (name[i] <= '9')) {
-
if(prev_num != 1) {
numbers_found++;
Powered by cgit, Themed by Ted Yin.