aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_protocol_ids.h5
-rw-r--r--src/include/ndpi_protocols.h1
-rw-r--r--src/include/ndpi_typedefs.h7
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_content_match.c.inc112
-rw-r--r--src/lib/ndpi_main.c10
-rw-r--r--src/lib/protocols/apple_push.c81
7 files changed, 146 insertions, 71 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 30d138d3f..acc510d49 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -210,7 +210,6 @@
#define NDPI_PROTOCOL_WHOIS_DAS 170
#define NDPI_PROTOCOL_COLLECTD 171
#define NDPI_PROTOCOL_SOCKS 172 /* Tomasz Bujlow <tomasz@skatnet.dk> */
-/* The Lync protocol is now skype for business and this the old id 173 can now be recycled */
#define NDPI_PROTOCOL_NINTENDO 173
#define NDPI_PROTOCOL_RTMP 174 /* Tomasz Bujlow <tomasz@skatnet.dk> */
#define NDPI_PROTOCOL_FTP_DATA 175 /* Tomasz Bujlow <tomasz@skatnet.dk> */
@@ -276,9 +275,11 @@
#define NDPI_PROTOCOL_CSGO 235 /* Counter-Strike Global Offensive, Dota 2 */
#define NDPI_PROTOCOL_LISP 236
#define NDPI_PROTOCOL_DIAMETER 237
+#define NDPI_PROTOCOL_APPLE_PUSH 238
+#define NDPI_PROTOCOL_GOOGLE_SERVICES 239
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_DIAMETER
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_GOOGLE_SERVICES
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 2fb105afe..3268488e1 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -352,5 +352,6 @@ void init_fix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int3
void init_nintendo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_csgo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_checkmk_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_apple_push_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
#endif /* __NDPI_PROTOCOLS_H__ */
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 66026dbbb..052cdce0f 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -756,11 +756,12 @@ typedef struct {
} ndpi_port_range;
typedef enum {
- NDPI_PROTOCOL_SAFE = 0, /* Surely doesn’t provide risks for the network. (e.g., a news site) */
- NDPI_PROTOCOL_ACCEPTABLE, /* Probably doesn’t provide risks, but could be malicious (e.g., Dropbox) */
+ NDPI_PROTOCOL_SAFE = 0, /* Surely doesn't provide risks for the network. (e.g., a news site) */
+ NDPI_PROTOCOL_ACCEPTABLE, /* Probably doesn't provide risks, but could be malicious (e.g., Dropbox) */
NDPI_PROTOCOL_FUN, /* Pure fun protocol, which may be prohibited by the user policy (e.g., Netflix) */
NDPI_PROTOCOL_UNSAFE, /* Probably provides risks, but could be a normal traffic. Unencrypted protocols with clear pass should be here (e.g., telnet) */
NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, /* Surely is dangerous (ex. Tor). Be prepared to troubles */
+ NDPI_PROTOCOL_TRACKER_ADS, /* Trackers, Advertisements... */
NDPI_PROTOCOL_UNRATED /* No idea, not implemented or impossible to classify */
} ndpi_protocol_breed_t;
@@ -773,7 +774,7 @@ typedef enum {
NDPI_PROTOCOL_CATEGORY_VPN, /* Virtual Private Networks */
NDPI_PROTOCOL_CATEGORY_MAIL, /* Protocols to send/receive/sync emails */
NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, /* AFS/NFS and similar protocols */
- NDPI_PROTOCOL_CATEGORY_WEB, /* Web protocols and services */
+ NDPI_PROTOCOL_CATEGORY_WEB, /* Web/mobile protocols and services */
NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, /* Social networks */
NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, /* Download, FTP, file transfer/sharing */
NDPI_PROTOCOL_CATEGORY_GAME, /* Online games */
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 749caef35..4b25e0162 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -20,6 +20,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/afp.c \
protocols/aimini.c \
protocols/applejuice.c \
+ protocols/apple_push.c \
protocols/armagetron.c \
protocols/ayiya.c \
protocols/amqp.c \
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index e1f46c110..7b868a764 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -216,59 +216,9 @@ static ndpi_network host_protocol_list[] = {
{ 0x344D0000 /* 52.77.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON },
{ 0x344E0000 /* 52.78.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON },
{ 0x344F0000 /* 52.79.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON },
- { 0x3452BB00 /* 52.82.187.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x34530000 /* 52.83.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON },
- { 0x34540000 /* 52.84.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON },
- { 0x34560000 /* 52.86.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON },
- { 0x34580000 /* 52.88.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON },
+ { 0x3452BB00 /* 52.82.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON },
+ { 0x34580000 /* 52.88.0.0/13 */, 13, NDPI_PROTOCOL_AMAZON },
{ 0x345A0000 /* 52.90.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON },
- { 0x345C0000 /* 52.92.0.0/20 */, 20, NDPI_PROTOCOL_AMAZON },
- { 0x345C1000 /* 52.92.16.0/20 */, 20, NDPI_PROTOCOL_AMAZON },
- { 0x345C2000 /* 52.92.32.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C2800 /* 52.92.40.0/21 */, 21, NDPI_PROTOCOL_AMAZON },
- { 0x345C3000 /* 52.92.48.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C3400 /* 52.92.52.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C3800 /* 52.92.56.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C3C00 /* 52.92.60.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C4000 /* 52.92.64.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C4400 /* 52.92.68.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C4800 /* 52.92.72.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C4C00 /* 52.92.76.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C5400 /* 52.92.84.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345C5800 /* 52.92.88.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345CF800 /* 52.92.248.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345CFC00 /* 52.92.252.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345D0000 /* 52.93.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON },
- { 0x345E0000 /* 52.94.0.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345E0400 /* 52.94.4.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0500 /* 52.94.5.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0600 /* 52.94.6.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0700 /* 52.94.7.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0800 /* 52.94.8.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0900 /* 52.94.9.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0A00 /* 52.94.10.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0B00 /* 52.94.11.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0C00 /* 52.94.12.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0D00 /* 52.94.13.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0E00 /* 52.94.14.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E0F00 /* 52.94.15.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E1100 /* 52.94.17.0/24 */, 24, NDPI_PROTOCOL_AMAZON },
- { 0x345E1800 /* 52.94.24.0/23 */, 23, NDPI_PROTOCOL_AMAZON },
- { 0x345E1C00 /* 52.94.28.0/23 */, 23, NDPI_PROTOCOL_AMAZON },
- { 0x345E2000 /* 52.94.32.0/20 */, 20, NDPI_PROTOCOL_AMAZON },
- { 0x345E3000 /* 52.94.48.0/20 */, 20, NDPI_PROTOCOL_AMAZON },
- { 0x345E4000 /* 52.94.64.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345E5000 /* 52.94.80.0/20 */, 20, NDPI_PROTOCOL_AMAZON },
- { 0x345E6000 /* 52.94.96.0/20 */, 20, NDPI_PROTOCOL_AMAZON },
- { 0x345E7000 /* 52.94.112.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345ECC00 /* 52.94.204.0/23 */, 23, NDPI_PROTOCOL_AMAZON },
- { 0x345ECE00 /* 52.94.206.0/23 */, 23, NDPI_PROTOCOL_AMAZON },
- { 0x345ED000 /* 52.94.208.0/21 */, 21, NDPI_PROTOCOL_AMAZON },
- { 0x345ED800 /* 52.94.216.0/21 */, 21, NDPI_PROTOCOL_AMAZON },
- { 0x345EE000 /* 52.94.224.0/20 */, 20, NDPI_PROTOCOL_AMAZON },
- { 0x345EF000 /* 52.94.240.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
- { 0x345EFC00 /* 52.94.252.0/23 */, 23, NDPI_PROTOCOL_AMAZON },
- { 0x345EFE00 /* 52.94.254.0/23 */, 23, NDPI_PROTOCOL_AMAZON },
{ 0x345F0000 /* 52.95.0.0/21 */, 21, NDPI_PROTOCOL_AMAZON },
{ 0x345F0A00 /* 52.95.10.0/23 */, 23, NDPI_PROTOCOL_AMAZON },
{ 0x345F0C00 /* 52.95.12.0/22 */, 22, NDPI_PROTOCOL_AMAZON },
@@ -636,7 +586,7 @@ static ndpi_network host_protocol_list[] = {
/* Teamviewer 159.122.189.32-63 */
{ 0x9F7ABD30 /* 159.122.189.32 */, 21, NDPI_PROTOCOL_TEAMVIEWER },
-
+
/*
IFLIX services -by www.vizuamatix.com R&D team
*/
@@ -852,7 +802,7 @@ static ndpi_network host_protocol_list[] = {
{ 0x5B6C1400 /* 91.108.20.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM },
{ 0x5B6C3800 /* 91.108.56.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM },
{ 0x959AA000 /* 149.154.160.0/20 */, 20, NDPI_PROTOCOL_TELEGRAM },
-
+
/*
BitTorrent
*/
@@ -8030,11 +7980,10 @@ ndpi_protocol_match host_match[] = {
{ "amazon-adsystem.com", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".cloudfront.net", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { ".apple.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
+ { ".push.apple.com", "ApplePush", NDPI_PROTOCOL_APPLE_PUSH, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_SAFE },
{ ".apple-dns.net", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
{ ".mzstatic.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
{ ".aaplimg.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
- { ".icloud.com", "AppleiCloud", NDPI_PROTOCOL_APPLE_ICLOUD, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "iosapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, /* iOS */
{ "osxapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, /* MacOS */
{ "buy.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE },
@@ -8045,6 +7994,8 @@ ndpi_protocol_match host_match[] = {
{ "itunes-apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE },
{ "itunes.apple.com", "AppleiTunes", NDPI_PROTOCOL_APPLE_ITUNES, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN },
{ "aaplimg.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE },
+ { ".apple.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
+ { ".icloud.com", "AppleiCloud", NDPI_PROTOCOL_APPLE_ICLOUD, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".cnn.c", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
{ ".cnn.net", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
@@ -8078,20 +8029,50 @@ ndpi_protocol_match host_match[] = {
{ "android.clients.google.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE },
{ "ggpht.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE },
+ /*
+ See https://better.fyi/trackers/
+
+ DoubleClick by Google (2mdn.net)
+ DoubleClick by Google (doubleclick.net)
+ DoubleClick by Google, Inc. (dmtry.com)
+ Google AdSense by Google (google.com)
+ Google AdSense by Google (google.se)
+ Google AdSense by Google (googleadservices.com)
+ Google Analytics by Google (google-analytics.com)
+ Google APIs by Google (ajax.googleapis.com)
+ Google Fonts by Google (fonts.googleapis.com)
+ Google Interactive Media Ads (imasdk.googleapis.com)
+ Google Syndication (googlesyndication.com)
+ Google Tag Manager by Google (googletagmanager.com)
+ Google Tag Manager by Google (googletagservices.com)
+ Gstatic by Google (gstatic.com)
+ */
+
+ /* Google Advertisements */
+ { ".googlesyndication.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_TRACKER_ADS },
+ { "googleads.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_TRACKER_ADS },
+ { ".doubleclick.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_TRACKER_ADS },
+ { "googleadservices.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_TRACKER_ADS },
+ { ".2mdn.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_TRACKER_ADS },
+ { ".dmtry.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_TRACKER_ADS },
+ { "google-analytics.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_TRACKER_ADS },
+
+ /* Google Services */
+ { "googleapis.com", "GoogleServices", NDPI_PROTOCOL_GOOGLE_SERVICES, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".googletagservices.com", "GoogleServices", NDPI_PROTOCOL_GOOGLE_SERVICES, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+ { "mtalk.google.com", "GoogleServices", NDPI_PROTOCOL_GOOGLE_SERVICES, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+
{ "plus.google.com", "GooglePlus", NDPI_PROTOCOL_GOOGLE_PLUS, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN },
{ "plus.url.google.com", "GooglePlus", NDPI_PROTOCOL_GOOGLE_PLUS, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN },
{ "google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
{ ".google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
{ ".gstatic.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
- { ".googlesyndication.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
- { ".googletagservices.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { ".2mdn.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { ".doubleclick.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, /* Ads */
- { "googleads.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { "google-analytics.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
+
+ /* http://check.googlezip.net/connect [check browser connectivity] */
+ { ".googlezip.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
+
{ "googleusercontent.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { "googleadservices.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { "googleapis.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+
{ "1e100.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "maps.google.", "GoogleMaps", NDPI_PROTOCOL_GOOGLE_MAPS, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
@@ -8104,7 +8085,7 @@ ndpi_protocol_match host_match[] = {
{ ".last.fm", "LastFM", NDPI_PROTOCOL_LASTFM, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN },
- { "msn.com", "MSN", NDPI_PROTOCOL_MSN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, /*News site*/
+ { "msn.com", "MSN", NDPI_PROTOCOL_MSN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, /* News site */
{ "netflix.com", "NetFlix", NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN },
{ "nflxext.com", "NetFlix", NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN },
@@ -8219,6 +8200,7 @@ ndpi_protocol_match host_match[] = {
{ ".anchorfree.", "HotspotShield", NDPI_PROTOCOL_HOTSPOT_SHIELD, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS },
{ "hotspotshield.com", "HotspotShield", NDPI_PROTOCOL_HOTSPOT_SHIELD, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS },
+ { ".northghost.com", "HotspotShield", NDPI_PROTOCOL_HOTSPOT_SHIELD, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS },
{ ".webex.com", "Webex", NDPI_PROTOCOL_WEBEX, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE },
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index e1979fbb2..27eddfd1a 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1451,11 +1451,16 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "QUIC", NDPI_PROTOCOL_CATEGORY_WEB,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 443, 80, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DIAMETER,
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DIAMETER,
no_master,
no_master, "Diameter", NDPI_PROTOCOL_CATEGORY_WEB,
ndpi_build_default_ports(ports_a, 3868, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_APPLE_PUSH,
+ no_master,
+ no_master, "ApplePush", NDPI_PROTOCOL_CATEGORY_CLOUD,
+ ndpi_build_default_ports(ports_a, 1, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DROPBOX,
no_master,
no_master, "Dropbox", NDPI_PROTOCOL_CATEGORY_CLOUD,
@@ -2777,6 +2782,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* DIAMETER */
init_diameter_dissector(ndpi_struct, &a, detection_bitmask);
+ /* APPLE_PUSH */
+ init_apple_push_dissector(ndpi_struct, &a, detection_bitmask);
+
/* EAQ */
init_eaq_dissector(ndpi_struct, &a, detection_bitmask);
diff --git a/src/lib/protocols/apple_push.c b/src/lib/protocols/apple_push.c
new file mode 100644
index 000000000..734be6e96
--- /dev/null
+++ b/src/lib/protocols/apple_push.c
@@ -0,0 +1,81 @@
+/*
+ * apple_push.c
+ *
+ * Copyright (C) 2018 by ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#ifdef NDPI_PROTOCOL_APPLE_PUSH
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_APPLE_PUSH
+
+#include "ndpi_api.h"
+
+static void ndpi_check_apple_push(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ /* https://support.apple.com/en-us/HT203609 */
+ if(((ntohl(packet->iph->saddr) & 0xFF000000 /* 255.0.0.0 */) == 0x11000000 /* 17.0.0.0/8 */)
+ || ((ntohl(packet->iph->daddr) & 0xFF000000 /* 255.0.0.0 */) == 0x11000000 /* 17.0.0.0/8 */)) {
+ u_int16_t apple_push_port = ntohs(5223);
+ u_int16_t notification_apn_port = ntohs(2195);
+ u_int16_t apn_feedback_port = ntohs(2196);
+
+ if(((packet->tcp->source == apple_push_port) || (packet->tcp->dest == apple_push_port))
+ || ((packet->tcp->source == notification_apn_port) || (packet->tcp->dest == notification_apn_port))
+ || ((packet->tcp->source == apn_feedback_port) || (packet->tcp->dest == apn_feedback_port))
+ ) {
+ NDPI_LOG_INFO(ndpi_struct, "found apple_push\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_APPLE_PUSH, NDPI_PROTOCOL_UNKNOWN);
+ return;
+ }
+ }
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void ndpi_search_apple_push(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
+{
+ struct ndpi_packet_struct *packet = &flow->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search apple_push\n");
+
+ /* skip marked packets */
+ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_APPLE_PUSH)
+ ndpi_check_apple_push(ndpi_struct, flow);
+}
+
+
+void init_apple_push_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("APPLE_PUSH", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_APPLE_PUSH,
+ ndpi_search_apple_push,
+ NDPI_SELECTION_BITMASK_PROTOCOL_TCP,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
+
+
+
+#endif
Powered by cgit, Themed by Ted Yin.