From a2b163becad4e9ff68551d67df951af4007bdaca Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Wed, 25 Mar 2020 19:04:00 +0800 Subject: Update ndpi_protocol_ids.h --- src/include/ndpi_protocol_ids.h | 1 + 1 file changed, 1 insertion(+) diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index d2190afc1..ee71038cc 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -278,6 +278,7 @@ typedef enum { NDPI_PROTOCOL_BLOOMBERG = 246, NDPI_PROTOCOL_CAPWAP = 247, NDPI_PROTOCOL_ZABBIX = 248, + NDPI_PROTOCOL_S7COMM = 249, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" -- cgit v1.2.3 From 6c3cbe50e24c1d6b278643fb825e76ec09b7bb88 Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Wed, 25 Mar 2020 19:04:35 +0800 Subject: Update ndpi_protocols.h --- src/include/ndpi_protocols.h | 1 + 1 file changed, 1 insertion(+) diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 2cae4b203..a5113acf5 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -216,4 +216,5 @@ void init_wireguard_dissector(struct ndpi_detection_module_struct *ndpi_struct, void init_targus_getdata_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_dnp3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_104_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); #endif /* __NDPI_PROTOCOLS_H__ */ -- cgit v1.2.3 From 4d95dae2ae2beabbd9c4ceb86444a9643781ab8f Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Wed, 25 Mar 2020 19:05:49 +0800 Subject: Update ndpi_main.c --- src/lib/ndpi_main.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 21491c5e7..a9caf52ec 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1782,6 +1782,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_build_default_ports(ports_a, 10050, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */ ); + ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_S7COMM, + 1 /* no subprotocol */, no_master, + no_master, "s7comm", NDPI_PROTOCOL_CATEGORY_NETWORK, + ndpi_build_default_ports(ports_a, 102, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */ + ); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" -- cgit v1.2.3 From ac17e0bea7a4629477ab32b6624daa9c6484b9b6 Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Wed, 25 Mar 2020 19:06:36 +0800 Subject: Update ndpi_main.c --- src/lib/ndpi_main.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index a9caf52ec..e6d7385e5 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -3531,6 +3531,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n /* Targus Getdata */ init_targus_getdata_dissector(ndpi_str, &a, detection_bitmask); + + /* S7 comm */ + init_s7comm_dissector(ndpi_str, &a, detection_bitmask); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" -- cgit v1.2.3 From 779d9a6e517e742002b1bb096bc4757e37169c4d Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Wed, 25 Mar 2020 19:09:14 +0800 Subject: Add files via upload --- src/lib/protocols/s7comm.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+) create mode 100644 src/lib/protocols/s7comm.c diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c new file mode 100644 index 000000000..e8f637c97 --- /dev/null +++ b/src/lib/protocols/s7comm.c @@ -0,0 +1,58 @@ +/* + * ndpi_main.c + * + * Copyright (C) 2011-20 - ntop.org + * + * This file is part of nDPI, an open source deep packet inspection + * library based on the OpenDPI and PACE technology by ipoque GmbH + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see . + * + */ +#include "ndpi_protocol_ids.h" +#include "ndpi_api.h" +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_S7COMM +#define S7_COMMON_PORT 102 +void ndpi_search_s7comm_tcp(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { + struct ndpi_packet_struct *packet = &flow->packet + ; + NDPI_LOG_DBG(ndpi_struct, "search S7\n"); + u_int16_t s7comm_port = htons(S7_COMMON_PORT); + if(packet->tcp) { + + if((packet->payload[0]==0x03)&&(packet->payload[1]==0x00)&&((packet->tcp->dest == s7comm_port) || (packet->tcp->source == s7comm_port))) { + NDPI_LOG_INFO(ndpi_struct, "found S7\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_S7COMM, NDPI_PROTOCOL_UNKNOWN); + + return; + + } + } + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + +} + +void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct, + u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { + + ndpi_set_bitmask_protocol_detection("S7COMM", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_S7COMM, + ndpi_search_s7comm_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + *id += 1; +} + -- cgit v1.2.3 From 74825ffc6efd4c8c73af39d6eadcaa15b8b7185c Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Thu, 26 Mar 2020 13:06:02 +0800 Subject: Update s7comm.c --- src/lib/protocols/s7comm.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c index e8f637c97..9a9f4c52b 100644 --- a/src/lib/protocols/s7comm.c +++ b/src/lib/protocols/s7comm.c @@ -23,13 +23,12 @@ #include "ndpi_protocol_ids.h" #include "ndpi_api.h" #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_S7COMM -#define S7_COMMON_PORT 102 + void ndpi_search_s7comm_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { - struct ndpi_packet_struct *packet = &flow->packet - ; + struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG_DBG(ndpi_struct, "search S7\n"); - u_int16_t s7comm_port = htons(S7_COMMON_PORT); + u_int16_t s7comm_port = htons(102); if(packet->tcp) { if((packet->payload[0]==0x03)&&(packet->payload[1]==0x00)&&((packet->tcp->dest == s7comm_port) || (packet->tcp->source == s7comm_port))) { -- cgit v1.2.3 From efdac78ddc127fb081a2d31f9154e78f77eec2b1 Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Fri, 27 Mar 2020 11:19:50 +0800 Subject: Update s7comm.c --- src/lib/protocols/s7comm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c index 9a9f4c52b..7efe8665b 100644 --- a/src/lib/protocols/s7comm.c +++ b/src/lib/protocols/s7comm.c @@ -49,7 +49,7 @@ void init_s7comm_dissector(struct ndpi_detection_module_struct *ndpi_struct, ndpi_set_bitmask_protocol_detection("S7COMM", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_S7COMM, - ndpi_search_s7comm_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, + ndpi_search_s7comm_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; -- cgit v1.2.3 From 7841145d9cf5abe9393028b923f7ee6793ebd3cd Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Fri, 27 Mar 2020 12:28:15 +0800 Subject: Update tls_long_cert.pcap.out --- tests/result/tls_long_cert.pcap.out | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/result/tls_long_cert.pcap.out b/tests/result/tls_long_cert.pcap.out index 0255109ac..beae4a6f9 100644 --- a/tests/result/tls_long_cert.pcap.out +++ b/tests/result/tls_long_cert.pcap.out @@ -5,4 +5,4 @@ JA3 Host Stats: 1 192.168.2.126 1 - 1 TCP 192.168.2.126:60174 <-> 104.111.215.93:443 [proto: 91.251/TLS.Repubblica][cat: Web/5][86 pkts/8534 bytes <-> 96 pkts/109067 bytes][Goodput ratio: 33/94][71.34 sec][ALPN: h2,http/1.1][TLS Supported Versions: TLS (0A0A),TLSv1.3,TLSv1.2,TLSv1.1,TLSv1][bytes ratio: -0.855 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1046/930 45462/45488 6189/5865][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 99/1136 902/1514 118/525][TLSv1.2][Client: www.repubblica.it][JA3C: 66918128f1b9b03303d77c6f2eefd128][ServerNames: www.repstatic.it,repstatic.it,amp-video.lastampa.it,www.repubblica.it,amp-video.deejay.it,amp-video.d.repubblica.it,www.gelestatic.it,oasjs.kataweb.it,video.d.repubblica.it,www.test.capital.it,napoli.repubblica.it,video.ilsecoloxix.it,genova.repubblica.it,cdn.gelestatic.it,video.gelocal.it,media.deejay.it,media.m2o.it,amp-video.espresso.repubblica.it,download.gelocal.it,amp-video.m2o.it,bologna.repubblica.it,torino.repubblica.it,scripts.kataweb.it,palermo.repubblica.it,roma.repubblica.it,video.xl.repubblica.it,amp-video.gelocal.it,video.espresso.repubblica.it,www.capital.it,video.limesonline.com,media.capital.it,syndication-vod-pro.akamai.media.kataweb.it,test.capital.it,video.deejay.it,video.repubblica.it,milano.repubblica.it,video.lanuovasardegna.it,video.m2o.it,parma.repubblica.it,video.3nz.it,syndication-vod-hds.akamai.media.kataweb.it,amp-video.repubblica.it,video.lastampa.it,webfragments.repubblica.it,amp-video.xl.repubblica.it,amp-video.limesonline.com,media.kataweb.it,bari.repubblica.it,syndication-vod-hls.akamai.media.kataweb.it,amp-video.3nz.it,syndication3rd-vod-pro.akamai.media.kataweb.it,firenze.repubblica.it,amp-video.ilsecoloxix.it,amp-video.lanuovasardegna.it,cdn.flv.kataweb.it][JA3S: 35af4c8cd9495354f7d701ce8ad7fd2d][Organization: GEDI Digital S.r.l.][Certificate SHA-1: 0C:9F:21:DB:65:A1:BE:EB:D8:89:38:D3:FF:7A:D9:02:8B:F1:60:A1][Validity: 2019-03-07 00:00:00 - 2020-05-05 12:00:00][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384] + 1 TCP 192.168.2.126:60174 <-> 104.111.215.93:443 [proto: 91.252/TLS.Repubblica][cat: Web/5][86 pkts/8534 bytes <-> 96 pkts/109067 bytes][Goodput ratio: 33/94][71.34 sec][ALPN: h2,http/1.1][TLS Supported Versions: TLS (0A0A),TLSv1.3,TLSv1.2,TLSv1.1,TLSv1][bytes ratio: -0.855 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 1046/930 45462/45488 6189/5865][Pkt Len c2s/s2c min/avg/max/stddev: 54/66 99/1136 902/1514 118/525][TLSv1.2][Client: www.repubblica.it][JA3C: 66918128f1b9b03303d77c6f2eefd128][ServerNames: www.repstatic.it,repstatic.it,amp-video.lastampa.it,www.repubblica.it,amp-video.deejay.it,amp-video.d.repubblica.it,www.gelestatic.it,oasjs.kataweb.it,video.d.repubblica.it,www.test.capital.it,napoli.repubblica.it,video.ilsecoloxix.it,genova.repubblica.it,cdn.gelestatic.it,video.gelocal.it,media.deejay.it,media.m2o.it,amp-video.espresso.repubblica.it,download.gelocal.it,amp-video.m2o.it,bologna.repubblica.it,torino.repubblica.it,scripts.kataweb.it,palermo.repubblica.it,roma.repubblica.it,video.xl.repubblica.it,amp-video.gelocal.it,video.espresso.repubblica.it,www.capital.it,video.limesonline.com,media.capital.it,syndication-vod-pro.akamai.media.kataweb.it,test.capital.it,video.deejay.it,video.repubblica.it,milano.repubblica.it,video.lanuovasardegna.it,video.m2o.it,parma.repubblica.it,video.3nz.it,syndication-vod-hds.akamai.media.kataweb.it,amp-video.repubblica.it,video.lastampa.it,webfragments.repubblica.it,amp-video.xl.repubblica.it,amp-video.limesonline.com,media.kataweb.it,bari.repubblica.it,syndication-vod-hls.akamai.media.kataweb.it,amp-video.3nz.it,syndication3rd-vod-pro.akamai.media.kataweb.it,firenze.repubblica.it,amp-video.ilsecoloxix.it,amp-video.lanuovasardegna.it,cdn.flv.kataweb.it][JA3S: 35af4c8cd9495354f7d701ce8ad7fd2d][Organization: GEDI Digital S.r.l.][Certificate SHA-1: 0C:9F:21:DB:65:A1:BE:EB:D8:89:38:D3:FF:7A:D9:02:8B:F1:60:A1][Validity: 2019-03-07 00:00:00 - 2020-05-05 12:00:00][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384] -- cgit v1.2.3 From 803b13a7a8fa66f88f9f136ea8470c2b1372e19f Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Fri, 27 Mar 2020 12:58:56 +0800 Subject: Update s7comm.c --- src/lib/protocols/s7comm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c index 7efe8665b..143d44b27 100644 --- a/src/lib/protocols/s7comm.c +++ b/src/lib/protocols/s7comm.c @@ -1,5 +1,5 @@ /* - * ndpi_main.c + * s7comm.c * * Copyright (C) 2011-20 - ntop.org * -- cgit v1.2.3 From 24bb0b7f53675acc88200c094dfb0ca2e23e4673 Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Fri, 27 Mar 2020 13:09:46 +0800 Subject: Update s7comm.c --- src/lib/protocols/s7comm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c index 143d44b27..e73711fc0 100644 --- a/src/lib/protocols/s7comm.c +++ b/src/lib/protocols/s7comm.c @@ -1,8 +1,7 @@ /* * s7comm.c - * * Copyright (C) 2011-20 - ntop.org - * + * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * @@ -18,7 +17,7 @@ * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . - * + * */ #include "ndpi_protocol_ids.h" #include "ndpi_api.h" -- cgit v1.2.3 From 1bab8a1c2238860c655ebff2ace5cf79e7873e63 Mon Sep 17 00:00:00 2001 From: havup <42641299+havup@users.noreply.github.com> Date: Fri, 27 Mar 2020 14:02:10 +0800 Subject: Update s7comm.c --- src/lib/protocols/s7comm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/lib/protocols/s7comm.c b/src/lib/protocols/s7comm.c index e73711fc0..8a522a2c7 100644 --- a/src/lib/protocols/s7comm.c +++ b/src/lib/protocols/s7comm.c @@ -1,5 +1,6 @@ /* * s7comm.c + * * Copyright (C) 2011-20 - ntop.org * * This file is part of nDPI, an open source deep packet inspection -- cgit v1.2.3