aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_typedefs.h2
-rw-r--r--src/lib/ndpi_main.c415
2 files changed, 212 insertions, 205 deletions
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 1bd8fd2db..fc80a675b 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -1027,7 +1027,7 @@ struct ndpi_flow_struct {
u_int16_t protocol_stack_info;
/* init parameter, internal used to set up timestamp,... */
- u_int16_t guessed_protocol_id, guessed_host_protocol_id, guessed_category;
+ u_int16_t guessed_protocol_id, guessed_host_protocol_id, guessed_category, guessed_header_category;
u_int8_t protocol_id_already_guessed:1, host_already_guessed:1, init_finished:1, setup_packet_direction:1, packet_direction:1, check_extra_packets:1;
/*
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 866f65a10..bdd28f666 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -320,110 +320,110 @@ int strncasecmp(s1, s2, n)
/* Keep it in order and in sync with ndpi_protocol_category_t in ndpi_typedefs.h */
static const char* categories[] = {
- "Unspecified",
- "Media",
- "VPN",
- "Email",
- "DataTransfer",
- "Web",
- "SocialNetwork",
- "Download-FileTransfer-FileSharing",
- "Game",
- "Chat",
- "VoIP",
- "Database",
- "RemoteAccess",
- "Cloud",
- "Network",
- "Collaborative",
- "RPC",
- "Streaming",
- "System",
- "SoftwareUpdate",
- "",
- "",
- "",
- "",
- "",
- "Music",
- "Video",
- "Shopping",
- "Productivity",
- "FileSharing",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "",
- "Mining", /* 99 */
- "Malware",
- "Advertisement",
- "Banned_Site",
- "Site_Unavailable"
+ "Unspecified",
+ "Media",
+ "VPN",
+ "Email",
+ "DataTransfer",
+ "Web",
+ "SocialNetwork",
+ "Download-FileTransfer-FileSharing",
+ "Game",
+ "Chat",
+ "VoIP",
+ "Database",
+ "RemoteAccess",
+ "Cloud",
+ "Network",
+ "Collaborative",
+ "RPC",
+ "Streaming",
+ "System",
+ "SoftwareUpdate",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "Music",
+ "Video",
+ "Shopping",
+ "Productivity",
+ "FileSharing",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "",
+ "Mining", /* 99 */
+ "Malware",
+ "Advertisement",
+ "Banned_Site",
+ "Site_Unavailable"
};
/* ****************************************** */
@@ -597,11 +597,11 @@ void ndpi_set_proto_category(struct ndpi_detection_module_struct *ndpi_mod,
Example:
- DNS is informative as if we see a DNS request for www.facebook.com, the
- returned protocol is DNS.Facebook, but Facebook isn't a real subprotocol but
- rather it indicates a query for Facebook and not Facebook traffic.
+ returned protocol is DNS.Facebook, but Facebook isn't a real subprotocol but
+ rather it indicates a query for Facebook and not Facebook traffic.
- HTTP/SSL are NOT informative as SSL.Facebook (likely) means that this is
- SSL (HTTPS) traffic containg Facebook traffic.
- */
+ SSL (HTTPS) traffic containg Facebook traffic.
+*/
u_int8_t ndpi_is_subprotocol_informative(struct ndpi_detection_module_struct *ndpi_mod,
u_int16_t protoId) {
if(protoId >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS)
@@ -619,21 +619,21 @@ u_int8_t ndpi_is_subprotocol_informative(struct ndpi_detection_module_struct *nd
/* ********************************************************************************** */
void ndpi_exclude_protocol(struct ndpi_detection_module_struct *ndpi_struct,
- struct ndpi_flow_struct *flow,
- u_int16_t protocol_id,
- const char *_file, const char *_func,int _line) {
+ struct ndpi_flow_struct *flow,
+ u_int16_t protocol_id,
+ const char *_file, const char *_func,int _line) {
if(protocol_id < NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) {
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
- if( ndpi_struct &&
- ndpi_struct->ndpi_log_level >= NDPI_LOG_DEBUG &&
- ndpi_struct->ndpi_debug_printf != NULL) {
+ if( ndpi_struct &&
+ ndpi_struct->ndpi_log_level >= NDPI_LOG_DEBUG &&
+ ndpi_struct->ndpi_debug_printf != NULL) {
- (*(ndpi_struct->ndpi_debug_printf))(protocol_id, ndpi_struct, NDPI_LOG_DEBUG,
- _file, _func, _line, "exclude %s\n",ndpi_get_proto_name(ndpi_struct, protocol_id));
- }
+ (*(ndpi_struct->ndpi_debug_printf))(protocol_id, ndpi_struct, NDPI_LOG_DEBUG,
+ _file, _func, _line, "exclude %s\n",ndpi_get_proto_name(ndpi_struct, protocol_id));
+ }
#endif
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, protocol_id);
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, protocol_id);
}
}
@@ -736,7 +736,7 @@ static void addDefaultPort(struct ndpi_detection_module_struct *ndpi_mod,
if(ret != node) {
NDPI_LOG_DBG(ndpi_mod, "[NDPI] %s:%d found duplicate for port %u: overwriting it with new value\n",
- _func, _line, port);
+ _func, _line, port);
ret->proto = def;
ndpi_free(node);
@@ -860,8 +860,8 @@ void ndpi_init_protocol_match(struct ndpi_detection_module_struct *ndpi_mod,
if(ndpi_mod->proto_defaults[match->protocol_id].protoName == NULL) {
if(match->protocol_id == NDPI_PROTOCOL_GENERIC)
ndpi_mod->proto_defaults[match->protocol_id].protoName = ndpi_strdup(NDPI_CONST_GENERIC_PROTOCOL_NAME);
- else
- ndpi_mod->proto_defaults[match->protocol_id].protoName = ndpi_strdup(match->proto_name);
+ else
+ ndpi_mod->proto_defaults[match->protocol_id].protoName = ndpi_strdup(match->proto_name);
ndpi_mod->proto_defaults[match->protocol_id].protoId = match->protocol_id;
ndpi_mod->proto_defaults[match->protocol_id].protoCategory = match->protocol_category;
@@ -2113,7 +2113,7 @@ static int ac_match_handler(AC_MATCH_t *m, AC_TEXT_t *txt, AC_REP_t *match) {
The patch below allows in case of pattern ws.amazon.com
to avoid matching aws.amazon.com whereas a.ws.amazon.com
has to match
- */
+ */
if(whatfound && (whatfound != buf)
&& (m->patterns->astring[0] != '.') /* The searched patter does not start with . */
&& strchr(m->patterns->astring, '.') /* The matched pattern has a . (e.g. numeric or sym IPs) */
@@ -2133,8 +2133,8 @@ static int ac_match_handler(AC_MATCH_t *m, AC_TEXT_t *txt, AC_REP_t *match) {
|| (strncmp(buf, m->patterns->astring, min_len) == 0) /* begins with */
) {
#ifdef MATCH_DEBUG
- printf("Found match [%s][%s] [len: %u][proto_id: %u]\n",
- buf, m->patterns->astring, min_len , *matching_protocol_id);
+ printf("Found match [%s][%s] [len: %u][proto_id: %u]\n",
+ buf, m->patterns->astring, min_len , *matching_protocol_id);
#endif
return(1); /* If the pattern found matches the string at the beginning we stop here */
} else
@@ -2269,23 +2269,23 @@ void set_ndpi_free(void (*__ndpi_free)(void *ptr)) { _ndpi_free = __ndpi_
void set_ndpi_flow_free(void (*__ndpi_flow_free)(void *ptr)) { _ndpi_flow_free = __ndpi_flow_free; }
void ndpi_debug_printf(unsigned int proto, struct ndpi_detection_module_struct *ndpi_str,
- ndpi_log_level_t log_level, const char *file_name, const char *func_name, int line_number,
- const char * format, ...)
+ ndpi_log_level_t log_level, const char *file_name, const char *func_name, int line_number,
+ const char * format, ...)
{
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
va_list args;
#define MAX_STR_LEN 250
char str[MAX_STR_LEN];
if(ndpi_str != NULL && log_level > NDPI_LOG_ERROR &&
- proto > 0 && proto < NDPI_MAX_SUPPORTED_PROTOCOLS &&
- !NDPI_ISSET(&ndpi_str->debug_bitmask,proto)) return;
+ proto > 0 && proto < NDPI_MAX_SUPPORTED_PROTOCOLS &&
+ !NDPI_ISSET(&ndpi_str->debug_bitmask,proto)) return;
va_start(args, format);
vsnprintf(str,sizeof(str)-1, format, args);
va_end(args);
if(ndpi_str != NULL) {
printf("%s:%s:%-3u - [%s]: %s",
- file_name, func_name, line_number, ndpi_get_proto_name(ndpi_str, proto), str);
+ file_name, func_name, line_number, ndpi_get_proto_name(ndpi_str, proto), str);
} else {
printf("Proto: %u, %s", proto, str);
}
@@ -2679,7 +2679,7 @@ static ndpi_default_ports_tree_node_t* ndpi_get_guessed_protocol_id(struct ndpi_
These are UDP protocols that must fit a single packet
and thus that if have NOT been detected they cannot be guessed
as they have been excluded
- */
+*/
u_int8_t is_udp_guessable_protocol(u_int16_t l7_guessed_proto) {
switch(l7_guessed_proto) {
case NDPI_PROTOCOL_QUIC:
@@ -2829,7 +2829,7 @@ int ndpi_handle_rule(struct ndpi_detection_module_struct *ndpi_mod,
if(ndpi_mod->ndpi_num_custom_protocols >= (NDPI_MAX_NUM_CUSTOM_PROTOCOLS-1)) {
NDPI_LOG_ERR(ndpi_mod, "Too many protocols defined (%u): skipping protocol %s\n",
- ndpi_mod->ndpi_num_custom_protocols, proto);
+ ndpi_mod->ndpi_num_custom_protocols, proto);
return(-2);
}
@@ -2983,17 +2983,17 @@ void ndpi_set_bitmask_protocol_detection(char * label,
if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, ndpi_protocol_id) != 0) {
#ifdef DEBUG
NDPI_LOG_DBG2(ndpi_struct
- "[NDPI] ndpi_set_bitmask_protocol_detection: %s : [callback_buffer] idx= %u, [proto_defaults] protocol_id=%u\n",
- label, idx, ndpi_protocol_id);
+ "[NDPI] ndpi_set_bitmask_protocol_detection: %s : [callback_buffer] idx= %u, [proto_defaults] protocol_id=%u\n",
+ label, idx, ndpi_protocol_id);
#endif
if(ndpi_struct->proto_defaults[ndpi_protocol_id].protoIdx != 0) {
NDPI_LOG_DBG2(ndpi_struct,
- "[NDPI] Internal error: protocol %s/%u has been already registered\n", label, ndpi_protocol_id);
+ "[NDPI] Internal error: protocol %s/%u has been already registered\n", label, ndpi_protocol_id);
#ifdef DEBUG
} else {
NDPI_LOG_DBG2(ndpi_struct,
- "[NDPI] Adding %s with protocol id %d\n", label, ndpi_protocol_id);
+ "[NDPI] Adding %s with protocol id %d\n", label, ndpi_protocol_id);
#endif
}
@@ -3501,7 +3501,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
ndpi_struct->callback_buffer_size = a;
NDPI_LOG_DBG2(ndpi_struct,
- "callback_buffer_size is %u\n", ndpi_struct->callback_buffer_size);
+ "callback_buffer_size is %u\n", ndpi_struct->callback_buffer_size);
/* now build the specific buffer for tcp, udp and non_tcp_udp */
ndpi_struct->callback_buffer_size_tcp_payload = 0;
@@ -3512,8 +3512,8 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP |
NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC)) != 0) {
if(_ndpi_debug_callbacks) NDPI_LOG_DBG2(ndpi_struct,
- "callback_buffer_tcp_payload, adding buffer %u as entry %u\n", a,
- ndpi_struct->callback_buffer_size_tcp_payload);
+ "callback_buffer_tcp_payload, adding buffer %u as entry %u\n", a,
+ ndpi_struct->callback_buffer_size_tcp_payload);
memcpy(&ndpi_struct->callback_buffer_tcp_payload[ndpi_struct->callback_buffer_size_tcp_payload],
&ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct));
@@ -3522,7 +3522,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
if((ndpi_struct->
callback_buffer[a].ndpi_selection_bitmask & NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) == 0) {
if(_ndpi_debug_callbacks) NDPI_LOG_DBG2(ndpi_struct,
- "\tcallback_buffer_tcp_no_payload, additional adding buffer %u to no_payload process\n", a);
+ "\tcallback_buffer_tcp_no_payload, additional adding buffer %u to no_payload process\n", a);
memcpy(&ndpi_struct->callback_buffer_tcp_no_payload
[ndpi_struct->callback_buffer_size_tcp_no_payload], &ndpi_struct->callback_buffer[a],
@@ -3539,7 +3539,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC))
!= 0) {
if(_ndpi_debug_callbacks) NDPI_LOG_DBG2(ndpi_struct,
- "callback_buffer_size_udp: adding buffer : %u as entry %u\n", a, ndpi_struct->callback_buffer_size_udp);
+ "callback_buffer_size_udp: adding buffer : %u as entry %u\n", a, ndpi_struct->callback_buffer_size_udp);
memcpy(&ndpi_struct->callback_buffer_udp[ndpi_struct->callback_buffer_size_udp],
&ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct));
@@ -3556,7 +3556,7 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
|| (ndpi_struct->
callback_buffer[a].ndpi_selection_bitmask & NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC) != 0) {
if(_ndpi_debug_callbacks) NDPI_LOG_DBG2(ndpi_struct,
- "callback_buffer_non_tcp_udp: adding buffer : %u as entry %u\n", a, ndpi_struct->callback_buffer_size_non_tcp_udp);
+ "callback_buffer_non_tcp_udp: adding buffer : %u as entry %u\n", a, ndpi_struct->callback_buffer_size_non_tcp_udp);
memcpy(&ndpi_struct->callback_buffer_non_tcp_udp[ndpi_struct->callback_buffer_size_non_tcp_udp],
&ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct));
@@ -3744,11 +3744,10 @@ static int ndpi_init_packet_header(struct ndpi_detection_module_struct *ndpi_str
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
}
- if(flow) {
+ if(flow)
ndpi_apply_flow_protocol_to_packet(flow, &flow->packet);
- } else {
+ else
ndpi_int_reset_packet_protocol(&flow->packet);
- }
l3len = flow->packet.l3_packet_len;
@@ -3756,7 +3755,7 @@ static int ndpi_init_packet_header(struct ndpi_detection_module_struct *ndpi_str
if(flow->packet.iph != NULL) {
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
- decaps_iph =flow->packet.iph;
+ decaps_iph = flow->packet.iph;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
}
@@ -3833,7 +3832,7 @@ static int ndpi_init_packet_header(struct ndpi_detection_module_struct *ndpi_str
flow->guessed_host_protocol_id = backup2;
NDPI_LOG_DBG(ndpi_struct,
- "tcp syn packet for unknown protocol, reset detection state\n");
+ "tcp syn packet for unknown protocol, reset detection state\n");
}
} else {
/* tcp header not complete */
@@ -4057,7 +4056,7 @@ void check_ndpi_udp_flow_func(struct ndpi_detection_module_struct *ndpi_struct,
break; /* Stop after detecting the first protocol */
} else
if(_ndpi_debug_callbacks) NDPI_LOG_DBG2(ndpi_struct,
- "[UDP,SKIP] dissector of protocol as callback_buffer idx = %d\n",a);
+ "[UDP,SKIP] dissector of protocol as callback_buffer idx = %d\n",a);
}
}
@@ -4169,7 +4168,7 @@ static ndpi_protocol ndpi_process_partial_detection(struct ndpi_detection_module
struct ndpi_flow_struct *flow) {
ndpi_protocol ret;
ndpi_protocol_match_result ret_match;
-
+
ret.master_protocol = flow->guessed_protocol_id;
ret.app_protocol = ndpi_match_host_subprotocol(ndpi_struct, flow,
(char *)flow->host_server_name,
@@ -4181,11 +4180,12 @@ static ndpi_protocol ndpi_process_partial_detection(struct ndpi_detection_module
ret.category = flow->category;
else
ret.category = ret_match.protocol_category;
-
+
if(ret.app_protocol == NDPI_PROTOCOL_UNKNOWN)
ret.app_protocol = ret.master_protocol;
ndpi_fill_protocol_category(ndpi_struct, flow, &ret);
+
ndpi_int_change_protocol(ndpi_struct, flow, ret.app_protocol, ret.master_protocol);
return(ret);
@@ -4196,7 +4196,7 @@ static ndpi_protocol ndpi_process_partial_detection(struct ndpi_detection_module
/*
You can call this function at any time in case of unknown match to see if there is
a partial match that has been prevented by the current nDPI preferences configuration
- */
+*/
ndpi_protocol ndpi_get_partial_detection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
if((flow->guessed_protocol_id == NDPI_PROTOCOL_HTTP)
@@ -4215,7 +4215,7 @@ ndpi_protocol ndpi_get_partial_detection(struct ndpi_detection_module_struct *nd
NDPI_PROTOCOL_CATEGORY_UNSPECIFIED };
if(flow) ret.category = flow->category;
-
+
return(ret);
}
}
@@ -4230,7 +4230,7 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
return(ret);
else
ret.category = flow->category;
-
+
/* TODO: add the remaining stage_XXXX protocols */
if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
u_int16_t guessed_protocol_id, guessed_host_protocol_id;
@@ -4409,7 +4409,7 @@ void ndpi_load_ip_category(struct ndpi_detection_module_struct *ndpi_struct,
*
*/
int ndpi_load_hostname_category(struct ndpi_detection_module_struct *ndpi_struct,
- char *name, ndpi_protocol_category_t category) {
+ char *name, ndpi_protocol_category_t category) {
if(name == NULL)
return(-1);
@@ -4563,31 +4563,32 @@ int ndpi_enable_loaded_categories(struct ndpi_detection_module_struct *ndpi_str)
/* ********************************************************************************* */
int ndpi_fill_ip_protocol_category(struct ndpi_detection_module_struct *ndpi_struct,
- u_int32_t saddr,
- u_int32_t daddr,
- ndpi_protocol *ret) {
+ u_int32_t saddr,
+ u_int32_t daddr,
+ ndpi_protocol *ret) {
if(ndpi_struct->custom_categories.categories_loaded) {
- prefix_t prefix;
- patricia_node_t *node;
+ prefix_t prefix;
+ patricia_node_t *node;
+
+ /* Make sure all in network byte order otherwise compares wont work */
+ fill_prefix_v4(&prefix, (struct in_addr *)&saddr,
+ 32, ((patricia_tree_t*)ndpi_struct->protocols_ptree)->maxbits);
+ node = ndpi_patricia_search_best(ndpi_struct->custom_categories.ipAddresses, &prefix);
- /* Make sure all in network byte order otherwise compares wont work */
- fill_prefix_v4(&prefix, (struct in_addr *)&saddr,
+ if(!node) {
+ fill_prefix_v4(&prefix, (struct in_addr *)&daddr,
32, ((patricia_tree_t*)ndpi_struct->protocols_ptree)->maxbits);
node = ndpi_patricia_search_best(ndpi_struct->custom_categories.ipAddresses, &prefix);
+ }
- if(!node) {
- fill_prefix_v4(&prefix, (struct in_addr *)&daddr,
- 32, ((patricia_tree_t*)ndpi_struct->protocols_ptree)->maxbits);
- node = ndpi_patricia_search_best(ndpi_struct->custom_categories.ipAddresses, &prefix);
- }
-
- if(node) {
- ret->category = (ndpi_protocol_category_t)node->value.user_value;
- return 1;
- }
+ if(node) {
+ ret->category = (ndpi_protocol_category_t)node->value.user_value;
+ return 1;
+ }
}
ret->category = ndpi_get_proto_category(ndpi_struct, *ret);
+
return 0;
}
@@ -4597,12 +4598,10 @@ void ndpi_fill_protocol_category(struct ndpi_detection_module_struct *ndpi_struc
struct ndpi_flow_struct *flow,
ndpi_protocol *ret) {
if(ndpi_struct->custom_categories.categories_loaded) {
- if(flow->packet.iph) {
- if(ndpi_fill_ip_protocol_category(ndpi_struct, flow->packet.iph->saddr, flow->packet.iph->daddr, ret)) {
- flow->category = ret->category;
- return;
- }
- }
+ if(flow->guessed_header_category != NDPI_PROTOCOL_CATEGORY_UNSPECIFIED) {
+ flow->category = flow->guessed_header_category;
+ return;
+ }
if(flow->host_server_name[0] != '\0') {
unsigned long id;
@@ -4642,14 +4641,14 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
ndpi_protocol ret = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED };
if(ndpi_struct->ndpi_log_level >= NDPI_LOG_TRACE)
- NDPI_LOG(flow ? flow->detected_protocol_stack[0]:NDPI_PROTOCOL_UNKNOWN,
- ndpi_struct, NDPI_LOG_TRACE, "START packet processing\n");
+ NDPI_LOG(flow ? flow->detected_protocol_stack[0]:NDPI_PROTOCOL_UNKNOWN,
+ ndpi_struct, NDPI_LOG_TRACE, "START packet processing\n");
if(flow == NULL)
return(ret);
else
ret.category = flow->category;
-
+
flow->num_processed_pkts++;
if(flow->server_id == NULL) flow->server_id = dst; /* Default */
@@ -4731,6 +4730,14 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
flow->guessed_protocol_id = (int16_t) ndpi_guess_protocol_id(ndpi_struct, flow, protocol, sport, dport, &user_defined_proto);
flow->guessed_host_protocol_id = ndpi_guess_host_protocol_id(ndpi_struct, flow);
+ if(ndpi_struct->custom_categories.categories_loaded && flow->packet.iph) {
+ ndpi_protocol ret;
+
+ ndpi_fill_ip_protocol_category(ndpi_struct, flow->packet.iph->saddr, flow->packet.iph->daddr, &ret);
+ flow->guessed_header_category = ret.category;
+ } else
+ flow->guessed_header_category = NDPI_PROTOCOL_CATEGORY_UNSPECIFIED;
+
if(flow->guessed_protocol_id >= (NDPI_MAX_SUPPORTED_PROTOCOLS-1)) {
/* This is a custom protocol and it has priority over everything else */
ret.master_protocol = NDPI_PROTOCOL_UNKNOWN,
@@ -4812,7 +4819,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
&& (ret.app_protocol == NDPI_PROTOCOL_UNKNOWN)
&& flow->packet.tcp
&& (flow->packet.tcp->syn == 0)
- ) {
+ ) {
/*
This is a TCP flow
- whose first packet is NOT a SYN
@@ -5025,7 +5032,7 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc
for(a = 0; a < packet->payload_packet_len; a++) {
if((a + 1) == packet->payload_packet_len)
- return; /* Return if only one byte remains (prevent invalid reads past end-of-buffer) */
+ return; /* Return if only one byte remains (prevent invalid reads past end-of-buffer) */
if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) { /* If end of line char sequence CR+NL "\r\n", process line */
packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr));
@@ -5056,8 +5063,8 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc
/* "Server:" header line in HTTP response */
if(packet->line[packet->parsed_lines].len > NDPI_STATICSTRING_LEN("Server:") + 1
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Server:", NDPI_STATICSTRING_LEN("Server:")) == 0) {
- // some stupid clients omit a space and place the servername directly after the colon
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Server:", NDPI_STATICSTRING_LEN("Server:")) == 0) {
+ // some stupid clients omit a space and place the servername directly after the colon
if(packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:")] == ' ') {
packet->server_line.ptr =
&packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:") + 1];
@@ -5072,7 +5079,7 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc
/* "Host:" header line in HTTP request */
if(packet->line[packet->parsed_lines].len > 6
&& strncasecmp((const char *)packet->line[packet->parsed_lines].ptr,
- "Host:", 5) == 0) {
+ "Host:", 5) == 0) {
// some stupid clients omit a space and place the hostname directly after the colon
if(packet->line[packet->parsed_lines].ptr[5] == ' ') {
packet->host_line.ptr = &packet->line[packet->parsed_lines].ptr[6];
@@ -5085,7 +5092,7 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc
}
/* "X-Forwarded-For:" header line in HTTP request. Commonly used for HTTP proxies. */
if(packet->line[packet->parsed_lines].len > 17
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "X-Forwarded-For:", 16) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "X-Forwarded-For:", 16) == 0) {
// some stupid clients omit a space and place the hostname directly after the colon
if(packet->line[packet->parsed_lines].ptr[16] == ' ') {
packet->forwarded_line.ptr = &packet->line[packet->parsed_lines].ptr[17];
@@ -5098,58 +5105,58 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc
}
/* "Content-Type:" header line in HTTP. */
if(packet->line[packet->parsed_lines].len > 14
- && (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Type: ", 14) == 0
- || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-type: ", 14) == 0)) {
+ && (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Type: ", 14) == 0
+ || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-type: ", 14) == 0)) {
packet->content_line.ptr = &packet->line[packet->parsed_lines].ptr[14];
packet->content_line.len = packet->line[packet->parsed_lines].len - 14;
packet->http_num_headers++;
}
/* "Content-Type:" header line in HTTP AGAIN. Probably a bogus response without space after ":" */
if(packet->line[packet->parsed_lines].len > 13
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-type:", 13) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-type:", 13) == 0) {
packet->content_line.ptr = &packet->line[packet->parsed_lines].ptr[13];
packet->content_line.len = packet->line[packet->parsed_lines].len - 13;
packet->http_num_headers++;
}
/* "Accept:" header line in HTTP request. */
if(packet->line[packet->parsed_lines].len > 8
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Accept: ", 8) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Accept: ", 8) == 0) {
packet->accept_line.ptr = &packet->line[packet->parsed_lines].ptr[8];
packet->accept_line.len = packet->line[packet->parsed_lines].len - 8;
packet->http_num_headers++;
}
/* "Referer:" header line in HTTP request. */
if(packet->line[packet->parsed_lines].len > 9
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Referer: ", 9) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Referer: ", 9) == 0) {
packet->referer_line.ptr = &packet->line[packet->parsed_lines].ptr[9];
packet->referer_line.len = packet->line[packet->parsed_lines].len - 9;
packet->http_num_headers++;
}
/* "User-Agent:" header line in HTTP request. */
if(packet->line[packet->parsed_lines].len > 12
- && (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "User-Agent: ", 12) == 0
- || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "User-agent: ", 12) == 0)) {
+ && (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "User-Agent: ", 12) == 0
+ || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "User-agent: ", 12) == 0)) {
packet->user_agent_line.ptr = &packet->line[packet->parsed_lines].ptr[12];
packet->user_agent_line.len = packet->line[packet->parsed_lines].len - 12;
packet->http_num_headers++;
}
/* "Content-Encoding:" header line in HTTP response (and request?). */
if(packet->line[packet->parsed_lines].len > 18
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Encoding: ", 18) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Encoding: ", 18) == 0) {
packet->http_encoding.ptr = &packet->line[packet->parsed_lines].ptr[18];
packet->http_encoding.len = packet->line[packet->parsed_lines].len - 18;
packet->http_num_headers++;
}
/* "Transfer-Encoding:" header line in HTTP. */
if(packet->line[packet->parsed_lines].len > 19
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Transfer-Encoding: ", 19) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Transfer-Encoding: ", 19) == 0) {
packet->http_transfer_encoding.ptr = &packet->line[packet->parsed_lines].ptr[19];
packet->http_transfer_encoding.len = packet->line[packet->parsed_lines].len - 19;
packet->http_num_headers++;
}
/* "Content-Length:" header line in HTTP. */
if(packet->line[packet->parsed_lines].len > 16
- && ((strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Length: ", 16) == 0)
+ && ((strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Length: ", 16) == 0)
|| (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "content-length: ", 16) == 0))) {
packet->http_contentlen.ptr = &packet->line[packet->parsed_lines].ptr[16];
packet->http_contentlen.len = packet->line[packet->parsed_lines].len - 16;
@@ -5157,21 +5164,21 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc
}
/* "Cookie:" header line in HTTP. */
if(packet->line[packet->parsed_lines].len > 8
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Cookie: ", 8) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Cookie: ", 8) == 0) {
packet->http_cookie.ptr = &packet->line[packet->parsed_lines].ptr[8];
packet->http_cookie.len = packet->line[packet->parsed_lines].len - 8;
packet->http_num_headers++;
}
/* "Origin:" header line in HTTP. */
if(packet->line[packet->parsed_lines].len > 8
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Origin: ", 8) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Origin: ", 8) == 0) {
packet->http_origin.ptr = &packet->line[packet->parsed_lines].ptr[8];
packet->http_origin.len = packet->line[packet->parsed_lines].len - 8;
packet->http_num_headers++;
}
/* "X-Session-Type:" header line in HTTP. */
if(packet->line[packet->parsed_lines].len > 16
- && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "X-Session-Type: ", 16) == 0) {
+ && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "X-Session-Type: ", 16) == 0) {
packet->http_x_session_type.ptr = &packet->line[packet->parsed_lines].ptr[16];
packet->http_x_session_type.len = packet->line[packet->parsed_lines].len - 16;
packet->http_num_headers++;
@@ -5773,7 +5780,7 @@ ndpi_protocol ndpi_guess_undetected_protocol(struct ndpi_detection_module_struct
/* ****************************************************** */
char* ndpi_protocol2id(struct ndpi_detection_module_struct *ndpi_mod,
- ndpi_protocol proto, char *buf, u_int buf_len) {
+ ndpi_protocol proto, char *buf, u_int buf_len) {
if((proto.master_protocol != NDPI_PROTOCOL_UNKNOWN)
&& (proto.master_protocol != proto.app_protocol)) {
if(proto.app_protocol != NDPI_PROTOCOL_UNKNOWN)
@@ -5894,7 +5901,7 @@ ndpi_protocol_category_t ndpi_get_proto_category(struct ndpi_detection_module_st
return proto.category;
/* simple rule: sub protocol first, master after */
else if((proto.master_protocol == NDPI_PROTOCOL_UNKNOWN) ||
- (ndpi_mod->proto_defaults[proto.app_protocol].protoCategory != NDPI_PROTOCOL_CATEGORY_UNSPECIFIED))
+ (ndpi_mod->proto_defaults[proto.app_protocol].protoCategory != NDPI_PROTOCOL_CATEGORY_UNSPECIFIED))
return ndpi_mod->proto_defaults[proto.app_protocol].protoCategory;
else
return ndpi_mod->proto_defaults[proto.master_protocol].protoCategory;
@@ -6113,14 +6120,14 @@ static int ndpi_automa_match_string_subprotocol(struct ndpi_detection_module_str
/*
TODO HYPERSCAN
In case of match fill up ret_match and set flow protocol + category
- */
+ */
status = hs_scan(hs->database, string_to_match,
string_to_match_len, 0, hs->scratch,
hyperscanEventHandler, &matching_protocol_id);
if(status == HS_SUCCESS) {
NDPI_LOG_DBG2(ndpi_struct, "[NDPI] Hyperscan engine completed normally. Result: %s [%d][%s]\n",
- ndpi_get_proto_name(ndpi_struct, matching_protocol_id), matching_protocol_id, string_to_match);
+ ndpi_get_proto_name(ndpi_struct, matching_protocol_id), matching_protocol_id, string_to_match);
} else if(status == HS_SCAN_TERMINATED) {
NDPI_LOG_DBG2(ndpi_struct, "[NDPI] Hyperscan engine was terminated by callback. Result: %s [%d][%s]\n",
ndpi_get_proto_name(ndpi_struct, matching_protocol_id), matching_protocol_id, string_to_match);
@@ -6142,7 +6149,7 @@ static int ndpi_automa_match_string_subprotocol(struct ndpi_detection_module_str
m[len] = '\0';
NDPI_LOG_DBG2(ndpi_struct, "[NDPI] ndpi_match_host_subprotocol(%s): %s\n",
- m, ndpi_struct->proto_defaults[matching_protocol_id].protoName);
+ m, ndpi_struct->proto_defaults[matching_protocol_id].protoName);
}
#endif
@@ -6355,7 +6362,7 @@ void ndpi_lru_add_to_cache(struct ndpi_lru_cache *c, u_int32_t key) {
- Leave fields empty/zero when information is missing (e.g. with ICMP ports are zero)
- The hash_buf most be 30+1 bits or longer
- Return code: 0 = OK, -1 otherwise
- */
+*/
int ndpi_flowv4_flow_hash(u_int8_t l4_proto, u_int32_t src_ip,
u_int32_t dst_ip, u_int16_t src_port, u_int16_t dst_port,
Powered by cgit, Themed by Ted Yin.