From 0809956e5f9ebbe11d5e11bebaf0c390eb993464 Mon Sep 17 00:00:00 2001 From: Luca Date: Wed, 20 Jan 2021 09:53:30 +0100 Subject: Rewored UPnP protocol that in essence was WSD hence it has been renamed Cleaned up TLS code for DTLS detection by defining a new DTLS protocol --- src/lib/protocols/stun.c | 5 ++-- src/lib/protocols/tls.c | 13 ++++++---- src/lib/protocols/upnp.c | 65 ---------------------------------------------- src/lib/protocols/wsd.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 77 insertions(+), 73 deletions(-) delete mode 100644 src/lib/protocols/upnp.c create mode 100644 src/lib/protocols/wsd.c (limited to 'src/lib/protocols') diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index cc1836a9b..cf7a4d0a4 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -202,9 +202,8 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * total_len = ntohs(*((u_int16_t*) &packet->payload[11])) + 13; if(payload_length == total_len) { - /* This is DTLS and the only protocol we know behaves like this is signal */ - flow->guessed_host_protocol_id = NDPI_PROTOCOL_SIGNAL; - return(NDPI_IS_STUN); + flow->guessed_host_protocol_id = NDPI_PROTOCOL_DTLS; + return(NDPI_IS_NOT_STUN); } } } diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index 1e2027712..9933ca8b2 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -858,7 +858,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct, // handshake_type = packet->payload[13]; handshake_len = (packet->payload[14] << 16) + (packet->payload[15] << 8) + packet->payload[16]; - + if((handshake_len+25) != packet->payload_packet_len) goto no_dtls; @@ -871,7 +871,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct, packet->payload = p; packet->payload_packet_len = p_len; /* Restore */ - ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS); + ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DTLS); return(1); /* Keep working */ } @@ -895,6 +895,9 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp printf("[TLS] %s()\n", __FUNCTION__); #endif + if((flow->packet.udp != NULL) && (protocol == NDPI_PROTOCOL_TLS)) + protocol = NDPI_PROTOCOL_DTLS; + if((flow->detected_protocol_stack[0] == protocol) || (flow->detected_protocol_stack[1] == protocol)) { if(!flow->check_extra_packets) @@ -907,7 +910,7 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp else protocol = ndpi_tls_refine_master_protocol(ndpi_struct, flow, protocol); - ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_TLS); + ndpi_set_detected_protocol(ndpi_struct, flow, protocol, protocol); tlsInitExtraPacketProcessing(ndpi_struct, flow); } @@ -1637,8 +1640,8 @@ void init_tls_dissector(struct ndpi_detection_module_struct *ndpi_struct, /* *************************************************** */ - ndpi_set_bitmask_protocol_detection("TLS", ndpi_struct, detection_bitmask, *id, - NDPI_PROTOCOL_TLS, + ndpi_set_bitmask_protocol_detection("DTLS", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_DTLS, ndpi_search_tls_wrapper, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, diff --git a/src/lib/protocols/upnp.c b/src/lib/protocols/upnp.c deleted file mode 100644 index 1706d021d..000000000 --- a/src/lib/protocols/upnp.c +++ /dev/null @@ -1,65 +0,0 @@ -/* - * upnp.c - * - * Copyright (C) 2018 - ntop.org - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see . - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_UPNP - -#include "ndpi_api.h" - -#define UPNP_PORT 3702 - -void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) { - struct ndpi_packet_struct *packet = &flow->packet; - - NDPI_LOG_DBG(ndpi_struct, "search upnp\n"); - - if(packet->udp - && ( - (packet->iph && ((ntohl(packet->iph->daddr) & 0xF0000000) == 0xE0000000 /* A multicast address */)) -#ifdef NDPI_DETECTION_SUPPORT_IPV6 - || - (packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000) -#endif - ) - && (ntohs(packet->udp->dest) == UPNP_PORT) - && (packet->payload_packet_len >= 40) - && (strncmp((char*)packet->payload, ". + * + */ + +/* https://en.wikipedia.org/wiki/WS-Discovery */ + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_WSD + +#include "ndpi_api.h" + +#define WSD_PORT 3702 + +void ndpi_search_wsd(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) { + struct ndpi_packet_struct *packet = &flow->packet; + + NDPI_LOG_DBG(ndpi_struct, "search wsd\n"); + + if(packet->udp + && ( + (packet->iph && ((ntohl(packet->iph->daddr) & 0xF0000000) == 0xE0000000 /* A multicast address */)) +#ifdef NDPI_DETECTION_SUPPORT_IPV6 + || + (packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000) +#endif + ) + && (ntohs(packet->udp->dest) == WSD_PORT) + && (packet->payload_packet_len >= 40) + && (strncmp((char*)packet->payload, "