From 471ea815943089e8132840164386cd3e13e0dbbe Mon Sep 17 00:00:00 2001 From: Pavel Odintsov Date: Wed, 29 Jul 2015 14:19:32 +0300 Subject: Enhance NTP support, add protocol version identification; Add pcap examples for NTPv2, NTPv3, NTPv4; Fix bug with identification of NTP monlist packets as QUIC --- src/include/ndpi_typedefs.h | 7 ++++++- src/lib/protocols/ntp.c | 13 +++++++++++-- tests/do.sh | 2 +- tests/pcap/NTPv2.pcap | Bin 0 -> 450 bytes tests/pcap/NTPv3.pcap | Bin 0 -> 130 bytes tests/pcap/NTPv4.pcap | Bin 0 -> 130 bytes tests/result/NTPv2.pcap.out | 3 +++ tests/result/NTPv3.pcap.out | 3 +++ tests/result/NTPv4.pcap.out | 3 +++ 9 files changed, 27 insertions(+), 4 deletions(-) create mode 100644 tests/pcap/NTPv2.pcap create mode 100644 tests/pcap/NTPv3.pcap create mode 100644 tests/pcap/NTPv4.pcap create mode 100644 tests/result/NTPv2.pcap.out create mode 100644 tests/result/NTPv3.pcap.out create mode 100644 tests/result/NTPv4.pcap.out diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 8404daa2e..3553df9a3 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -722,7 +722,12 @@ typedef struct ndpi_flow_struct { u_int8_t bad_packet /* the received packet looks bad */; u_int16_t query_type, query_class, rsp_type; } dns; - + + struct { + u_int8_t request_code; + u_int8_t version; + } ntp; + struct { char client_certificate[48], server_certificate[48]; } ssl; diff --git a/src/lib/protocols/ntp.c b/src/lib/protocols/ntp.c index 8a2a8aa25..233317a57 100644 --- a/src/lib/protocols/ntp.c +++ b/src/lib/protocols/ntp.c @@ -46,14 +46,23 @@ void ndpi_search_ntp_udp(struct ndpi_detection_module_struct *ndpi_struct, struc NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP port detected\n"); - if (packet->payload_packet_len != 48) - goto exclude_ntp; + // It's not correct because packets could be bigger + //if (packet->payload_packet_len != 48) + // goto exclude_ntp; NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP length detected\n"); if ((((packet->payload[0] & 0x38) >> 3) <= 4)) { NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "detected NTP."); + + // 38 in binary representation is 00111000 + flow->protos.ntp.version = (packet->payload[0] & 0x38) >> 3; + + if (flow->protos.ntp.version == 2) { + flow->protos.ntp.request_code = packet->payload[3]; + } + ndpi_int_ntp_add_connection(ndpi_struct, flow); return; } diff --git a/tests/do.sh b/tests/do.sh index 764b049f9..bbd44edc6 100755 --- a/tests/do.sh +++ b/tests/do.sh @@ -36,4 +36,4 @@ check_results() { build_results check_results -exit $RC \ No newline at end of file +exit $RC diff --git a/tests/pcap/NTPv2.pcap b/tests/pcap/NTPv2.pcap new file mode 100644 index 000000000..ec22e2cda Binary files /dev/null and b/tests/pcap/NTPv2.pcap differ diff --git a/tests/pcap/NTPv3.pcap b/tests/pcap/NTPv3.pcap new file mode 100644 index 000000000..483e349af Binary files /dev/null and b/tests/pcap/NTPv3.pcap differ diff --git a/tests/pcap/NTPv4.pcap b/tests/pcap/NTPv4.pcap new file mode 100644 index 000000000..6f91a111e Binary files /dev/null and b/tests/pcap/NTPv4.pcap differ diff --git a/tests/result/NTPv2.pcap.out b/tests/result/NTPv2.pcap.out new file mode 100644 index 000000000..960fbe062 --- /dev/null +++ b/tests/result/NTPv2.pcap.out @@ -0,0 +1,3 @@ +NTP 1 410 1 + + 1 UDP 78.46.76.2:80 <-> 208.104.95.10:123 [proto: 9/NTP][1 pkts/410 bytes] diff --git a/tests/result/NTPv3.pcap.out b/tests/result/NTPv3.pcap.out new file mode 100644 index 000000000..91d817e5e --- /dev/null +++ b/tests/result/NTPv3.pcap.out @@ -0,0 +1,3 @@ +NTP 1 90 1 + + 1 UDP 78.46.76.2:80 <-> 175.144.140.29:123 [proto: 9/NTP][1 pkts/90 bytes] diff --git a/tests/result/NTPv4.pcap.out b/tests/result/NTPv4.pcap.out new file mode 100644 index 000000000..fba0fd419 --- /dev/null +++ b/tests/result/NTPv4.pcap.out @@ -0,0 +1,3 @@ +NTP 1 90 1 + + 1 UDP 78.46.76.11:123 <-> 85.22.62.120:123 [proto: 9/NTP][1 pkts/90 bytes] -- cgit v1.2.3