From a2b163becad4e9ff68551d67df951af4007bdaca Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Wed, 25 Mar 2020 19:04:00 +0800
Subject: Update ndpi_protocol_ids.h
---
src/include/ndpi_protocol_ids.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index d2190afc1..ee71038cc 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -278,6 +278,7 @@ typedef enum {
NDPI_PROTOCOL_BLOOMBERG = 246,
NDPI_PROTOCOL_CAPWAP = 247,
NDPI_PROTOCOL_ZABBIX = 248,
+ NDPI_PROTOCOL_S7COMM = 249,
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
--
cgit v1.2.3
From 6c3cbe50e24c1d6b278643fb825e76ec09b7bb88 Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Wed, 25 Mar 2020 19:04:35 +0800
Subject: Update ndpi_protocols.h
---
src/include/ndpi_protocols.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 2cae4b203..a5113acf5 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -216,4 +216,5 @@ void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct,
void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_dnp3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_104_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
#endif /* __NDPI_PROTOCOLS_H__ */
--
cgit v1.2.3
From 4d95dae2ae2beabbd9c4ceb86444a9643781ab8f Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Wed, 25 Mar 2020 19:05:49 +0800
Subject: Update ndpi_main.c
---
src/lib/ndpi_main.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 21491c5e7..a9caf52ec 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1782,6 +1782,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
ndpi_build_default_ports(ports_a, 10050, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */
);
+ ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_S7COMM,
+ 1 /* no subprotocol */, no_master,
+ no_master, "s7comm", NDPI_PROTOCOL_CATEGORY_NETWORK,
+ ndpi_build_default_ports(ports_a, 102, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */
+ );
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main.c"
--
cgit v1.2.3
From ac17e0bea7a4629477ab32b6624daa9c6484b9b6 Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Wed, 25 Mar 2020 19:06:36 +0800
Subject: Update ndpi_main.c
---
src/lib/ndpi_main.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index a9caf52ec..e6d7385e5 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -3531,6 +3531,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* Targus Getdata */
init_targus_getdata_dissector(ndpi_str, &a, detection_bitmask);
+
+ /* S7 comm */
+ init_s7comm_dissector(ndpi_str, &a, detection_bitmask);
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
--
cgit v1.2.3
From 779d9a6e517e742002b1bb096bc4757e37169c4d Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Wed, 25 Mar 2020 19:09:14 +0800
Subject: Add files via upload
---
src/lib/protocols/s7comm.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 58 insertions(+)
create mode 100644 src/lib/protocols/s7comm.c
diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c
new file mode 100644
index 000000000..e8f637c97
--- /dev/null
+++ b/src/lib/protocols/s7comm.c
@@ -0,0 +1,58 @@
+/*
+ * ndpi_main.c
+ *
+ * Copyright (C) 2011-20 - ntop.org
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see .
+ *
+ */
+#include "ndpi_protocol_ids.h"
+#include "ndpi_api.h"
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_S7COMM
+#define S7_COMMON_PORT 102
+void ndpi_search_s7comm_tcp(struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow) {
+ struct ndpi_packet_struct *packet = &flow->packet
+ ;
+ NDPI_LOG_DBG(ndpi_struct, "search S7\n");
+ u_int16_t s7comm_port = htons(S7_COMMON_PORT);
+ if(packet->tcp) {
+
+ if((packet->payload[0]==0x03)&&(packet->payload[1]==0x00)&&((packet->tcp->dest == s7comm_port) || (packet->tcp->source == s7comm_port))) {
+ NDPI_LOG_INFO(ndpi_struct, "found S7\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_S7COMM, NDPI_PROTOCOL_UNKNOWN);
+
+ return;
+
+ }
+ }
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+
+}
+
+void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+
+ ndpi_set_bitmask_protocol_detection("S7COMM", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_S7COMM,
+ ndpi_search_s7comm_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+ *id += 1;
+}
+
--
cgit v1.2.3
From 74825ffc6efd4c8c73af39d6eadcaa15b8b7185c Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Thu, 26 Mar 2020 13:06:02 +0800
Subject: Update s7comm.c
---
src/lib/protocols/s7comm.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c
index e8f637c97..9a9f4c52b 100644
--- a/src/lib/protocols/s7comm.c
+++ b/src/lib/protocols/s7comm.c
@@ -23,13 +23,12 @@
#include "ndpi_protocol_ids.h"
#include "ndpi_api.h"
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_S7COMM
-#define S7_COMMON_PORT 102
+
void ndpi_search_s7comm_tcp(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
- struct ndpi_packet_struct *packet = &flow->packet
- ;
+ struct ndpi_packet_struct *packet = &flow->packet;
NDPI_LOG_DBG(ndpi_struct, "search S7\n");
- u_int16_t s7comm_port = htons(S7_COMMON_PORT);
+ u_int16_t s7comm_port = htons(102);
if(packet->tcp) {
if((packet->payload[0]==0x03)&&(packet->payload[1]==0x00)&&((packet->tcp->dest == s7comm_port) || (packet->tcp->source == s7comm_port))) {
--
cgit v1.2.3
From efdac78ddc127fb081a2d31f9154e78f77eec2b1 Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Fri, 27 Mar 2020 11:19:50 +0800
Subject: Update s7comm.c
---
src/lib/protocols/s7comm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c
index 9a9f4c52b..7efe8665b 100644
--- a/src/lib/protocols/s7comm.c
+++ b/src/lib/protocols/s7comm.c
@@ -49,7 +49,7 @@ void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct,
ndpi_set_bitmask_protocol_detection("S7COMM", ndpi_struct, detection_bitmask, *id,
NDPI_PROTOCOL_S7COMM,
- ndpi_search_s7comm_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD,
+ ndpi_search_s7comm_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
SAVE_DETECTION_BITMASK_AS_UNKNOWN,
ADD_TO_DETECTION_BITMASK);
*id += 1;
--
cgit v1.2.3
From 7841145d9cf5abe9393028b923f7ee6793ebd3cd Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Fri, 27 Mar 2020 12:28:15 +0800
Subject: Update tls_long_cert.pcap.out
---
tests/result/tls_long_cert.pcap.out | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/result/tls_long_cert.pcap.out b/tests/result/tls_long_cert.pcap.out
index 0255109ac..beae4a6f9 100644
--- a/tests/result/tls_long_cert.pcap.out
+++ b/tests/result/tls_long_cert.pcap.out
@@ -5,4 +5,4 @@ JA3 Host Stats:
1 192.168.2.126 1
- 1 TCP 192.168.2.126:60174 <-> 104.111.215.93:443 [proto: 91.251/TLS.Repubblica][cat: Web/5][86 pkts/8534 bytes <-> 96 pkts/109067 bytes][Goodput ratio: 33/94][71.34 sec][ALPN: h2,http/1.1][TLS Supported Versions: TLS (0A0A),TLSv1.3,TLSv1.2,TLSv1.1,TLSv1][bytes ratio: -0.855 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1046/930 45462/45488 6189/5865][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 99/1136 902/1514 118/525][TLSv1.2][Client: www.repubblica.it][JA3C: 66918128f1b9b03303d77c6f2eefd128][ServerNames: www.repstatic.it,repstatic.it,amp-video.lastampa.it,www.repubblica.it,amp-video.deejay.it,amp-video.d.repubblica.it,www.gelestatic.it,oasjs.kataweb.it,video.d.repubblica.it,www.test.capital.it,napoli.repubblica.it,video.ilsecoloxix.it,genova.repubblica.it,cdn.gelestatic.it,video.gelocal.it,media.deejay.it,media.m2o.it,amp-video.espresso.repubblica.it,download.gelocal.it,amp-video.m2o.it,bologna.repubblica.it,torino.repubblica.it,scripts.kataweb.it,palermo.repubblica.it,roma.repubblica.it,video.xl.repubblica.it,amp-video.gelocal.it,video.espresso.repubblica.it,www.capital.it,video.limesonline.com,media.capital.it,syndication-vod-pro.akamai.media.kataweb.it,test.capital.it,video.deejay.it,video.repubblica.it,milano.repubblica.it,video.lanuovasardegna.it,video.m2o.it,parma.repubblica.it,video.3nz.it,syndication-vod-hds.akamai.media.kataweb.it,amp-video.repubblica.it,video.lastampa.it,webfragments.repubblica.it,amp-video.xl.repubblica.it,amp-video.limesonline.com,media.kataweb.it,bari.repubblica.it,syndication-vod-hls.akamai.media.kataweb.it,amp-video.3nz.it,syndication3rd-vod-pro.akamai.media.kataweb.it,firenze.repubblica.it,amp-video.ilsecoloxix.it,amp-video.lanuovasardegna.it,cdn.flv.kataweb.it][JA3S: 35af4c8cd9495354f7d701ce8ad7fd2d][Organization: GEDI Digital S.r.l.][Certificate SHA-1: 0C:9F:21:DB:65:A1:BE:EB:D8:89:38:D3:FF:7A:D9:02:8B:F1:60:A1][Validity: 2019-03-07 00:00:00 - 2020-05-05 12:00:00][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384]
+ 1 TCP 192.168.2.126:60174 <-> 104.111.215.93:443 [proto: 91.252/TLS.Repubblica][cat: Web/5][86 pkts/8534 bytes <-> 96 pkts/109067 bytes][Goodput ratio: 33/94][71.34 sec][ALPN: h2,http/1.1][TLS Supported Versions: TLS (0A0A),TLSv1.3,TLSv1.2,TLSv1.1,TLSv1][bytes ratio: -0.855 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1046/930 45462/45488 6189/5865][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 99/1136 902/1514 118/525][TLSv1.2][Client: www.repubblica.it][JA3C: 66918128f1b9b03303d77c6f2eefd128][ServerNames: www.repstatic.it,repstatic.it,amp-video.lastampa.it,www.repubblica.it,amp-video.deejay.it,amp-video.d.repubblica.it,www.gelestatic.it,oasjs.kataweb.it,video.d.repubblica.it,www.test.capital.it,napoli.repubblica.it,video.ilsecoloxix.it,genova.repubblica.it,cdn.gelestatic.it,video.gelocal.it,media.deejay.it,media.m2o.it,amp-video.espresso.repubblica.it,download.gelocal.it,amp-video.m2o.it,bologna.repubblica.it,torino.repubblica.it,scripts.kataweb.it,palermo.repubblica.it,roma.repubblica.it,video.xl.repubblica.it,amp-video.gelocal.it,video.espresso.repubblica.it,www.capital.it,video.limesonline.com,media.capital.it,syndication-vod-pro.akamai.media.kataweb.it,test.capital.it,video.deejay.it,video.repubblica.it,milano.repubblica.it,video.lanuovasardegna.it,video.m2o.it,parma.repubblica.it,video.3nz.it,syndication-vod-hds.akamai.media.kataweb.it,amp-video.repubblica.it,video.lastampa.it,webfragments.repubblica.it,amp-video.xl.repubblica.it,amp-video.limesonline.com,media.kataweb.it,bari.repubblica.it,syndication-vod-hls.akamai.media.kataweb.it,amp-video.3nz.it,syndication3rd-vod-pro.akamai.media.kataweb.it,firenze.repubblica.it,amp-video.ilsecoloxix.it,amp-video.lanuovasardegna.it,cdn.flv.kataweb.it][JA3S: 35af4c8cd9495354f7d701ce8ad7fd2d][Organization: GEDI Digital S.r.l.][Certificate SHA-1: 0C:9F:21:DB:65:A1:BE:EB:D8:89:38:D3:FF:7A:D9:02:8B:F1:60:A1][Validity: 2019-03-07 00:00:00 - 2020-05-05 12:00:00][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384]
--
cgit v1.2.3
From 803b13a7a8fa66f88f9f136ea8470c2b1372e19f Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Fri, 27 Mar 2020 12:58:56 +0800
Subject: Update s7comm.c
---
src/lib/protocols/s7comm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c
index 7efe8665b..143d44b27 100644
--- a/src/lib/protocols/s7comm.c
+++ b/src/lib/protocols/s7comm.c
@@ -1,5 +1,5 @@
/*
- * ndpi_main.c
+ * s7comm.c
*
* Copyright (C) 2011-20 - ntop.org
*
--
cgit v1.2.3
From 24bb0b7f53675acc88200c094dfb0ca2e23e4673 Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Fri, 27 Mar 2020 13:09:46 +0800
Subject: Update s7comm.c
---
src/lib/protocols/s7comm.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c
index 143d44b27..e73711fc0 100644
--- a/src/lib/protocols/s7comm.c
+++ b/src/lib/protocols/s7comm.c
@@ -1,8 +1,7 @@
/*
* s7comm.c
- *
* Copyright (C) 2011-20 - ntop.org
- *
+ *
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
@@ -18,7 +17,7 @@
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
- *
+ *
*/
#include "ndpi_protocol_ids.h"
#include "ndpi_api.h"
--
cgit v1.2.3
From 1bab8a1c2238860c655ebff2ace5cf79e7873e63 Mon Sep 17 00:00:00 2001
From: havup <42641299+havup@users.noreply.github.com>
Date: Fri, 27 Mar 2020 14:02:10 +0800
Subject: Update s7comm.c
---
src/lib/protocols/s7comm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c
index e73711fc0..8a522a2c7 100644
--- a/src/lib/protocols/s7comm.c
+++ b/src/lib/protocols/s7comm.c
@@ -1,5 +1,6 @@
/*
* s7comm.c
+ *
* Copyright (C) 2011-20 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
--
cgit v1.2.3