From 0f089bd49a8bfa1e57e862cef1352c6514f4719f Mon Sep 17 00:00:00 2001 From: Campus Date: Fri, 24 Jun 2016 13:19:14 +0200 Subject: added git protocol dissector and pcap for test --- src/lib/protocols/git.c | 118 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 src/lib/protocols/git.c (limited to 'src/lib/protocols/git.c') diff --git a/src/lib/protocols/git.c b/src/lib/protocols/git.c new file mode 100644 index 000000000..63479b26a --- /dev/null +++ b/src/lib/protocols/git.c @@ -0,0 +1,118 @@ +/* + * git.c + * + * Copyright (C) 2012-16 - ntop.org + * + * This module is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This module is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License. + * If not, see . + * + */ +#include +#include "ndpi_api.h" + +#ifdef NDPI_PROTOCOL_GIT + +#define GIT_PORT 9418 + +/* read all the length even if there is a null byte inside */ +u_int16_t read_all_len(char * s, u_int16_t git_len) +{ + char * p = s; + int c = 0; + while(*p && c < git_len-4) { + c++; + p++; + if(!*p) { + if(c < git_len-4) { + p++; + c++; + } + } + } + return c; +} + +void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct * packet = &flow->packet; + const u_int8_t * pp = packet->payload; + u_int16_t payload_len = packet->payload_packet_len; + + u_int8_t * git_pkt_len_buff = NULL; + u_int8_t * git_pkt_data = NULL; + u_int16_t git_len = 0, count = 0 , is_git = 0; + + if(packet->tcp != NULL) { + + if((ntohs(packet->tcp->source) == GIT_PORT || + ntohs(packet->tcp->dest) == GIT_PORT)) { + + git_pkt_len_buff = malloc(4 * sizeof(u_int8_t)); + + do { + memcpy(git_pkt_len_buff, pp, 4); + git_len = (int)strtol(git_pkt_len_buff, NULL, 16); + + if(git_pkt_len_buff[0] == 48 && + git_pkt_len_buff[1] == 48 && + git_pkt_len_buff[2] == 48 && + git_pkt_len_buff[3] == 48) + /* Terminator packet */ + count += 4; + else { + git_pkt_data = malloc((git_len-4) * sizeof(u_int8_t)); + memcpy(git_pkt_data, pp+4, git_len-4); + u_int16_t data_len = read_all_len(git_pkt_data, git_len); + free(git_pkt_data); + + if(git_len != data_len+4) + goto no_git; + else { + count += git_len; + pp += git_len; + } + } + } while(count < payload_len); + } + else goto no_git; + } + else goto no_git; + + NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "found Git.\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GIT, NDPI_PROTOCOL_UNKNOWN); + return; + + no_git: + NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "exclude Git.\n"); + NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_GIT); +} + + +/* ***************************************************************** */ + + +void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, + NDPI_PROTOCOL_BITMASK *detection_bitmask) +{ + ndpi_set_bitmask_protocol_detection("Git", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_GIT, + ndpi_search_git, + NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} + +#endif /* NDPI_PROTOCOL_GIT */ -- cgit v1.2.3 From ff6b19382191941be442349bb55e90c15da818e6 Mon Sep 17 00:00:00 2001 From: Campus Date: Fri, 24 Jun 2016 13:45:43 +0200 Subject: minor fixes - deleted useless part on git and quic protos --- src/lib/protocols/bittorrent.c | 9 +++------ src/lib/protocols/dropbox.c | 2 +- src/lib/protocols/git.c | 2 +- src/lib/protocols/quic.c | 13 ------------- src/lib/protocols/tor.c | 2 +- 5 files changed, 6 insertions(+), 22 deletions(-) (limited to 'src/lib/protocols/git.c') diff --git a/src/lib/protocols/bittorrent.c b/src/lib/protocols/bittorrent.c index 6ac9ec69a..0eebe07ee 100644 --- a/src/lib/protocols/bittorrent.c +++ b/src/lib/protocols/bittorrent.c @@ -53,8 +53,7 @@ static u_int8_t is_utp_pkt(const u_int8_t *payload, u_int payload_len) { static void ndpi_add_connection_as_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, int bt_offset, int check_hash, - const u_int8_t save_detection, const u_int8_t encrypted_connection/* , */ - /* ndpi_protocol_type_t protocol_type */) + const u_int8_t save_detection, const u_int8_t encrypted_connection) { if(check_hash) { const char *bt_hash = NULL; /* 20 bytes long */ @@ -92,8 +91,7 @@ static u_int8_t ndpi_int_search_bittorrent_tcp_zero(struct ndpi_detection_module NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: plain BitTorrent protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, 19, 1, - NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION/* , */ - /* NDPI_REAL_PROTOCOL */); + NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } } @@ -125,8 +123,7 @@ static u_int8_t ndpi_int_search_bittorrent_tcp_zero(struct ndpi_detection_module NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: plain Bitcomet persistent seed protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, - NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION/* , */ - /* NDPI_CORRELATED_PROTOCOL */); + NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION); return 1; } diff --git a/src/lib/protocols/dropbox.c b/src/lib/protocols/dropbox.c index 3e53b4224..d8babfb1b 100644 --- a/src/lib/protocols/dropbox.c +++ b/src/lib/protocols/dropbox.c @@ -1,7 +1,7 @@ /* * dropbox.c * - * Copyright (C) 2011-13 by ntop.org + * Copyright (C) 2012-16 by ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH diff --git a/src/lib/protocols/git.c b/src/lib/protocols/git.c index 63479b26a..8cde52912 100644 --- a/src/lib/protocols/git.c +++ b/src/lib/protocols/git.c @@ -51,7 +51,7 @@ void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t * git_pkt_len_buff = NULL; u_int8_t * git_pkt_data = NULL; - u_int16_t git_len = 0, count = 0 , is_git = 0; + u_int16_t git_len = 0, count = 0; if(packet->tcp != NULL) { diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c index ac443951b..200f9024b 100644 --- a/src/lib/protocols/quic.c +++ b/src/lib/protocols/quic.c @@ -22,7 +22,6 @@ * */ - #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_QUIC @@ -38,18 +37,6 @@ static int quic_ports(u_int16_t sport, u_int16_t dport) /* ***************************************************************** */ -static int quic_payload(const u_int8_t *payload) { - if((payload[0] == 'Q') - && isdigit(payload[1]) - && isdigit(payload[2]) - && isdigit(payload[3])) - return(1); - - return(0); -} - -/* ***************************************************************** */ - static int quic_len(u_int8_t l) { switch(l) { case 0: diff --git a/src/lib/protocols/tor.c b/src/lib/protocols/tor.c index cb926d5f0..2152da328 100644 --- a/src/lib/protocols/tor.c +++ b/src/lib/protocols/tor.c @@ -1,7 +1,7 @@ /* * tor.c * - * Copyright (C) 2015 ntop.org + * Copyright (C) 2016 ntop.org * Copyright (C) 2013 Remy Mudingay * */ -- cgit v1.2.3 From 47bb46176bdd1455c74895d0935aae13756bb971 Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Tue, 5 Jul 2016 19:07:16 +0200 Subject: Fix for #225 --- src/lib/protocols/git.c | 87 +++++++++++++++---------------------------------- 1 file changed, 26 insertions(+), 61 deletions(-) (limited to 'src/lib/protocols/git.c') diff --git a/src/lib/protocols/git.c b/src/lib/protocols/git.c index 8cde52912..f3e015aef 100644 --- a/src/lib/protocols/git.c +++ b/src/lib/protocols/git.c @@ -24,76 +24,41 @@ #define GIT_PORT 9418 -/* read all the length even if there is a null byte inside */ -u_int16_t read_all_len(char * s, u_int16_t git_len) -{ - char * p = s; - int c = 0; - while(*p && c < git_len-4) { - c++; - p++; - if(!*p) { - if(c < git_len-4) { - p++; - c++; - } - } - } - return c; -} - void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) + struct ndpi_flow_struct *flow) { struct ndpi_packet_struct * packet = &flow->packet; - const u_int8_t * pp = packet->payload; - u_int16_t payload_len = packet->payload_packet_len; - - u_int8_t * git_pkt_len_buff = NULL; - u_int8_t * git_pkt_data = NULL; - u_int16_t git_len = 0, count = 0; - if(packet->tcp != NULL) { + if((packet->tcp != NULL) && (packet->payload_packet_len > 4)) { + if((ntohs(packet->tcp->source) == GIT_PORT) + || (ntohs(packet->tcp->dest) == GIT_PORT)) { + const u_int8_t * pp = packet->payload; + u_int16_t payload_len = packet->payload_packet_len; + u_int8_t found_git = 1; + u_int16_t git_len = 0, offset = 0; + + while((offset+4) < payload_len) { + char len[5]; + u_int32_t git_pkt_len; - if((ntohs(packet->tcp->source) == GIT_PORT || - ntohs(packet->tcp->dest) == GIT_PORT)) { + memcpy(&len, &pp[offset], 4), len[4] = 0; + git_pkt_len = atoi(len); - git_pkt_len_buff = malloc(4 * sizeof(u_int8_t)); + if(payload_len < git_pkt_len) { + found_git = 0; + break; + } else + offset += git_pkt_len, payload_len -= git_pkt_len; + } - do { - memcpy(git_pkt_len_buff, pp, 4); - git_len = (int)strtol(git_pkt_len_buff, NULL, 16); - - if(git_pkt_len_buff[0] == 48 && - git_pkt_len_buff[1] == 48 && - git_pkt_len_buff[2] == 48 && - git_pkt_len_buff[3] == 48) - /* Terminator packet */ - count += 4; - else { - git_pkt_data = malloc((git_len-4) * sizeof(u_int8_t)); - memcpy(git_pkt_data, pp+4, git_len-4); - u_int16_t data_len = read_all_len(git_pkt_data, git_len); - free(git_pkt_data); - - if(git_len != data_len+4) - goto no_git; - else { - count += git_len; - pp += git_len; - } - } - } while(count < payload_len); + if(found_git) { + NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "found Git.\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GIT, NDPI_PROTOCOL_UNKNOWN); + return; + } } - else goto no_git; } - else goto no_git; - NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "found Git.\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GIT, NDPI_PROTOCOL_UNKNOWN); - return; - - no_git: NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "exclude Git.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_GIT); } @@ -103,7 +68,7 @@ void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, - NDPI_PROTOCOL_BITMASK *detection_bitmask) + NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Git", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_GIT, -- cgit v1.2.3