From 95fffec1729f30748970e6d2bc5fb72137bb9685 Mon Sep 17 00:00:00 2001 From: Campus Date: Sun, 20 Mar 2016 16:10:26 +0100 Subject: fix for pull request https://github.com/ntop/nDPI/pull/161 --- src/lib/Makefile.am | 1 - src/lib/ndpi_main.c | 16 ++++------------ 2 files changed, 4 insertions(+), 13 deletions(-) (limited to 'src/lib') diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am index 2e8b0551a..37ee80dea 100644 --- a/src/lib/Makefile.am +++ b/src/lib/Makefile.am @@ -154,7 +154,6 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \ protocols/zattoo.c \ protocols/zeromq.c \ protocols/coap.c \ - protocols/mqtt.c \ third_party/include/actypes.h \ third_party/include/ahocorasick.h \ third_party/include/node.h \ diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 8d40fe9aa..dc4ff74a5 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1524,15 +1524,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 7985, 7987, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_COAP, - no_master, - no_master, "COAP", - ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ - ndpi_build_default_ports(ports_b, 5683, 5684, 0, 0, 0)); /* UDP */ - ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_MQTT, - no_master, - no_master, "MQTT", - ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */ - ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ + no_master, + no_master, "COAP", + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ + ndpi_build_default_ports(ports_b, 5683, 5684, 0, 0, 0)); /* UDP */ /* calling function for host and content matched protocols */ init_string_based_protocols(ndpi_mod); @@ -2500,9 +2495,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n /* COAP */ init_coap_dissector(ndpi_struct, &a, detection_bitmask); - /* MQTT */ - init_mqtt_dissector(ndpi_struct, &a, detection_bitmask); - /* Put false-positive sensitive protocols at the end */ /* SKYPE */ -- cgit v1.2.3 From 46a526ce260e1d628bae194ba0bf26cb6997d4f1 Mon Sep 17 00:00:00 2001 From: Campus Date: Wed, 23 Mar 2016 00:35:22 +0100 Subject: deleted mqtt.c --- src/lib/protocols/mqtt.c | 215 ----------------------------------------------- 1 file changed, 215 deletions(-) delete mode 100644 src/lib/protocols/mqtt.c (limited to 'src/lib') diff --git a/src/lib/protocols/mqtt.c b/src/lib/protocols/mqtt.c deleted file mode 100644 index 238f07e64..000000000 --- a/src/lib/protocols/mqtt.c +++ /dev/null @@ -1,215 +0,0 @@ -/* - * mqtt.c - * - * Copyright (C) 2016 Sorin Zamfir - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see . - * - */ - -#include "ndpi_protocols.h" -#ifdef NDPI_PROTOCOL_MQTT - -/** - * The type of control messages in mqtt version 3.1.1 - * see http://docs.oasis-open.org/mqtt/mqtt/v3.1.1 - */ -enum MQTT_PACKET_TYPES { - CONNECT = 1, - CONNACK = 2, - PUBLISH = 3, - PUBACK = 4, - PUBREC = 5, - PUBREL = 6, - PUBCOMP = 7, - SUBSCRIBE = 8, - SUBACK = 9, - UNSUBSCRIBE = 10, - UNSUBACK = 11, - PINGREQ = 12, - PINGRESP = 13, - DISCONNECT = 14 -}; - - -/** - * Entry point when protocol is identified. - */ -static void ndpi_int_mqtt_add_connection (struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_MQTT,NDPI_PROTOCOL_UNKNOWN); - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found.\n"); -} - -/** - * Dissector function that searches Mqtt headers - */ -void ndpi_search_mqtt (struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt search called...\n"); - struct ndpi_packet_struct *packet = &flow->packet; - if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { - return; - } - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt detection...\n"); - if (flow->packet_counter > 10) { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. mandatory header not found!\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - - // searching for request - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> Mqtt header: %4x%4x%4x%4x [len: %u]\n", - packet->payload[0], packet->payload[1], packet->payload[2], packet->payload[3], packet->payload_packet_len); - if (packet->payload_packet_len < 2) { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. mandatory header not found!\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - // we first extract the packet type - u_int8_t pt = (u_int8_t) ((packet->payload[0] & 0xF0) >> 4); - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Mqtt packet type: [%d]\n",pt); - if ((pt == 0) || (pt == 15)) { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. invalid packet type!\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - u_int8_t flags = (u_int8_t) (packet->payload[0] & 0x0F); - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Mqtt flags type: [%d]\n",flags); - // first stage verification - if ((pt == CONNECT) || (pt == CONNACK) || (pt == PUBACK) || (pt == PUBREC) || - (pt == PUBCOMP) || (pt == SUBACK) || (pt == UNSUBACK) || (pt == PINGREQ) || - (pt == PINGRESP) || (pt == DISCONNECT)) { - if (flags > 0) { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Flag combination flag!=0\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - } - if (((pt == PUBREL) || (pt == SUBSCRIBE) || (pt == UNSUBSCRIBE)) && (flags != 2)) { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Flag combination flag!=2\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Passed first stage of identification\n"); - // second stage verification (no payload) - if (((pt == CONNACK) || (pt == PUBACK) || (pt == PUBREL) || - (pt == PUBREC) || (pt == PUBCOMP) || (pt == UNSUBACK)) && (packet->payload_packet_len > 4)){ - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Length < 4 \n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } else { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found \n"); - ndpi_int_mqtt_add_connection(ndpi_struct,flow); - return; - } - if (((pt == PINGREQ) || (pt == PINGRESP) || (pt == DISCONNECT)) && (packet->payload_packet_len > 2)) - { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Length <2 \n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } else { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found PING/PINGRESP/DISCONNECT\n"); - ndpi_int_mqtt_add_connection(ndpi_struct,flow); - return; - } - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Passed second stage of identification\n"); - // third stage verification (payload) - if ((pt == CONNECT) && (memcmp(&(packet->payload[4]),"MQTT",4) == 0) ){ - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found CONNECT\n"); - ndpi_int_mqtt_add_connection(ndpi_struct,flow); - return; - } else { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid CONNECT\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - if (pt == PUBLISH){ - u_int8_t qos = (u_int8_t) (flags & 0x06); - if (((qos == 1) || (qos == 2)) && (packet->payload_packet_len < 4)){ // at least topic + pkt identifier - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH qos1&2\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - if ((qos == 0) && (packet->payload_packet_len < 3)){ // at least topic - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH qos0\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - if ((qos == 3)){ // this should never happen - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH qos3\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found PUBLISH\n"); - ndpi_int_mqtt_add_connection(ndpi_struct,flow); - return; - - } - if ((pt == SUBSCRIBE) && (packet->payload_packet_len < 8)){ // at least one topic+filter is required in the payload - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid SUBSCRIBE\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } else { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found SUBSCRIBE\n"); - ndpi_int_mqtt_add_connection(ndpi_struct,flow); - return; - } - - if ((pt == SUBACK ) && (packet->payload_packet_len <5 )){ // must have at least a response code - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid SUBACK\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } else { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found SUBACK\n"); - ndpi_int_mqtt_add_connection(ndpi_struct,flow); - return; - } - - if ((pt == UNSUBSCRIBE) && (packet->payload_packet_len < 7)) { // at least a topic - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid UNSUBSCRIBE\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; - } else { - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found UNSUBSCRIBE\n",pt); - ndpi_int_mqtt_add_connection(ndpi_struct,flow); - return; - } - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Passed third stage of identification"); - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Reached the end excluding Mqtt ...\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); - return; -} -/** - * Entry point for the ndpi library - */ -void init_mqtt_dissector (struct ndpi_detection_module_struct *ndpi_struct, - u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) -{ - NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt dissector init...\n"); - ndpi_set_bitmask_protocol_detection ("MQTT", ndpi_struct, detection_bitmask, *id, - NDPI_PROTOCOL_MQTT, - ndpi_search_mqtt, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); - *id +=1; -} - -#endif // NDPI_PROTOCOL_MQTT - -- cgit v1.2.3 From 2998b787979c0e4a80b8483325d6bb16dc8f74c9 Mon Sep 17 00:00:00 2001 From: Campus Date: Wed, 23 Mar 2016 01:27:36 +0100 Subject: deleted winmx protocol due to abandoned development since July 2, 2004 --- src/include/ndpi_protocol_ids.h | 5 +- src/include/ndpi_protocols.h | 2 - src/include/ndpi_typedefs.h | 3 -- src/lib/ndpi_main.c | 8 --- src/lib/protocols/winmx.c | 117 ---------------------------------------- tests/result/coap.pcap.out | 8 +-- 6 files changed, 6 insertions(+), 137 deletions(-) delete mode 100644 src/lib/protocols/winmx.c (limited to 'src/lib') diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 5bd5434a9..a60cd5603 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -83,7 +83,7 @@ #define NDPI_PROTOCOL_APPLEJUICE 24 #define NDPI_PROTOCOL_DIRECTCONNECT 25 #define NDPI_PROTOCOL_SOCRATES 26 -#define NDPI_PROTOCOL_WINMX 27 +#define NDPI_PROTOCOL_COAP 27 #define NDPI_PROTOCOL_VMWARE 28 #define NDPI_PROTOCOL_MAIL_SMTPS 29 #define NDPI_PROTOCOL_FILETOPIA 30 @@ -270,10 +270,9 @@ #define NDPI_SERVICE_OFFICE_365 219 #define NDPI_SERVICE_CLOUDFLARE 220 #define NDPI_SERVICE_MS_ONE_DRIVE 221 -#define NDPI_PROTOCOL_COAP 222 /* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */ -#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_COAP +#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_SERVICE_MS_ONE_DRIVE #define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1) #define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL) diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 673725678..cb83633bd 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -60,7 +60,6 @@ int ndpi_bittorrent_gc(struct hash_ip4p_table *ht,int key,time_t now); void ndpi_search_edonkey(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_fasttrack_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_gnutella(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); -void ndpi_search_winmx_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_directconnect(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_applejuice_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_i23v5(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); @@ -327,7 +326,6 @@ void init_vmware_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i void init_vnc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_warcraft3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_whois_das_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); -void init_winmx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_world_of_warcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_world_of_kung_fu_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_xbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 620c9685d..ed74b9a07 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -474,9 +474,6 @@ struct ndpi_flow_tcp_struct { u_int32_t irc_direction:2; u_int32_t irc_0x1000_full:1; #endif -#ifdef NDPI_PROTOCOL_WINMX - u_int32_t winmx_stage:1; // 0 - 1 -#endif #ifdef NDPI_PROTOCOL_SOULSEEK u_int32_t soulseek_stage:2; #endif diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index dc4ff74a5..591472e58 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -819,11 +819,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp no_master, "Socrates", ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_WINMX, - no_master, - no_master, "WinMX", - ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, - ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_VMWARE, no_master, no_master, "VMware", @@ -2132,9 +2127,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n /* GNUTELLA */ init_gnutella_dissector(ndpi_struct, &a, detection_bitmask); - /* WINMX */ - init_winmx_dissector(ndpi_struct, &a, detection_bitmask); - /* DIRECTCONNECT */ init_directconnect_dissector(ndpi_struct, &a, detection_bitmask); diff --git a/src/lib/protocols/winmx.c b/src/lib/protocols/winmx.c deleted file mode 100644 index 31d4b1ed6..000000000 --- a/src/lib/protocols/winmx.c +++ /dev/null @@ -1,117 +0,0 @@ -/* - * winmx.c - * - * Copyright (C) 2009-2011 by ipoque GmbH - * Copyright (C) 2011-15 - ntop.org - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see . - * - */ - - -#include "ndpi_protocols.h" - -#ifdef NDPI_PROTOCOL_WINMX - - -static void ndpi_int_winmx_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow); - -static void ndpi_int_winmx_add_connection(struct ndpi_detection_module_struct - *ndpi_struct, struct ndpi_flow_struct *flow) -{ - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WINMX, NDPI_PROTOCOL_UNKNOWN); -} - - -void ndpi_search_winmx_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct *packet = &flow->packet; - - // struct ndpi_id_struct *src=ndpi_struct->src; - // struct ndpi_id_struct *dst=ndpi_struct->dst; - - - if (flow->l4.tcp.winmx_stage == 0) { - if (packet->payload_packet_len == 1 || (packet->payload_packet_len > 1 && packet->payload[0] == 0x31)) { - return; - } - /* did not see this pattern in any trace that we have */ - if (((packet->payload_packet_len) == 4) - && (memcmp(packet->payload, "SEND", 4) == 0)) { - - NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "maybe WinMX Send\n"); - flow->l4.tcp.winmx_stage = 1; - return; - } - - if (((packet->payload_packet_len) == 3) - && (memcmp(packet->payload, "GET", 3) == 0)) { - NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "found winmx by GET\n"); - ndpi_int_winmx_add_connection(ndpi_struct, flow); - return; - } - - - if (packet->payload_packet_len == 149 && packet->payload[0] == '8') { - NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "maybe WinMX\n"); - if (get_u_int32_t(packet->payload, 17) == 0 - && get_u_int32_t(packet->payload, 21) == 0 - && get_u_int32_t(packet->payload, 25) == 0 - && get_u_int16_t(packet->payload, 39) == 0 && get_u_int16_t(packet->payload, 135) == htons(0x7edf) - && get_u_int16_t(packet->payload, 147) == htons(0xf792)) { - - NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, - "found winmx by pattern in first packet\n"); - ndpi_int_winmx_add_connection(ndpi_struct, flow); - return; - } - } - /* did not see this pattern in any trace that we have */ - } else if (flow->l4.tcp.winmx_stage == 1) { - if (packet->payload_packet_len > 10 && packet->payload_packet_len < 1000) { - u_int16_t left = packet->payload_packet_len - 1; - while (left > 0) { - if (packet->payload[left] == ' ') { - NDPI_LOG(NDPI_PROTOCOL_WINMX, ndpi_struct, NDPI_LOG_DEBUG, "found winmx in second packet\n"); - ndpi_int_winmx_add_connection(ndpi_struct, flow); - return; - } else if (packet->payload[left] < '0' || packet->payload[left] > '9') { - break; - } - left--; - } - } - } - - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_WINMX); -} - - -void init_winmx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) -{ - ndpi_set_bitmask_protocol_detection("WinMX", ndpi_struct, detection_bitmask, *id, - NDPI_PROTOCOL_WINMX, - ndpi_search_winmx_tcp, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - -#endif diff --git a/tests/result/coap.pcap.out b/tests/result/coap.pcap.out index 4af36845c..7a53f9697 100644 --- a/tests/result/coap.pcap.out +++ b/tests/result/coap.pcap.out @@ -1,6 +1,6 @@ COAP 800 80676 4 - 1 UDP 192.168.56.1:50318 <-> 192.168.56.101:17500 [proto: 222/COAP][200 pkts/20220 bytes] - 2 UDP 192.168.56.1:50312 <-> 192.168.56.101:17500 [proto: 222/COAP][200 pkts/20194 bytes] - 3 UDP 192.168.56.1:50311 <-> 192.168.56.101:17500 [proto: 222/COAP][200 pkts/20120 bytes] - 4 UDP 192.168.56.1:50319 <-> 192.168.56.101:17500 [proto: 222/COAP][200 pkts/20142 bytes] + 1 UDP 192.168.56.1:50318 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20220 bytes] + 2 UDP 192.168.56.1:50312 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20194 bytes] + 3 UDP 192.168.56.1:50311 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20120 bytes] + 4 UDP 192.168.56.1:50319 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20142 bytes] -- cgit v1.2.3 From b3df389bd67d8b6333e6001d6ffc116bd9f56cf4 Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Wed, 23 Mar 2016 08:46:24 +0100 Subject: Removed WinMX reference from Makefile --- src/lib/Makefile.am | 1 - 1 file changed, 1 deletion(-) (limited to 'src/lib') diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am index 37ee80dea..3b0a2943f 100644 --- a/src/lib/Makefile.am +++ b/src/lib/Makefile.am @@ -145,7 +145,6 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \ protocols/vnc.c \ protocols/warcraft3.c \ protocols/whoisdas.c \ - protocols/winmx.c \ protocols/world_of_kung_fu.c \ protocols/world_of_warcraft.c \ protocols/xbox.c \ -- cgit v1.2.3 From d9264e415c1325946c9b638e6455b0126ee9c8ad Mon Sep 17 00:00:00 2001 From: Campus Date: Sun, 27 Mar 2016 01:39:38 +0100 Subject: fixed and improved bittorrent detection for issue https://github.com/ntop/nDPI/issues/164 --- src/lib/ndpi_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/lib') diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 591472e58..07ae9dbab 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -863,7 +863,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp no_master, no_master, "BitTorrent", ndpi_build_default_ports(ports_a, 51413, 0, 0, 0, 0) /* TCP */, - ndpi_build_default_ports(ports_b, 6771, 0, 0, 0, 0) /* UDP */); + ndpi_build_default_ports(ports_b, 6771, 51413, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TEREDO, no_master, no_master, "Teredo", -- cgit v1.2.3 From a59427398921b234bf152cc8f938f83fca07ee2b Mon Sep 17 00:00:00 2001 From: Campus Date: Tue, 29 Mar 2016 00:05:56 +0200 Subject: fixed coap.c and dropbox.c after detecting wrong detection - added test for dropbox --- src/lib/ndpi_content_match.c.inc | 1 + src/lib/ndpi_main.c | 10 +-- src/lib/protocols/coap.c | 143 +++++++++++++++++++++++++-------------- src/lib/protocols/dropbox.c | 21 +++++- tests/pcap/coap.pcap | Bin 93500 -> 1942 bytes tests/pcap/dropbox.pcap | Bin 0 -> 329062 bytes tests/result/coap.pcap.out | 14 ++-- tests/result/dropbox.pcap.out | 43 ++++++++++++ 8 files changed, 168 insertions(+), 64 deletions(-) create mode 100644 tests/pcap/dropbox.pcap create mode 100644 tests/result/dropbox.pcap.out (limited to 'src/lib') diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 411a3961d..87bc4c96b 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -7260,6 +7260,7 @@ ndpi_protocol_match host_match[] = { { ".cnn.c", "CNN", NDPI_SERVICE_CNN, NDPI_PROTOCOL_FUN }, { ".cnn.net", "CNN", NDPI_SERVICE_CNN, NDPI_PROTOCOL_FUN }, { ".dropbox.com", "DropBox", NDPI_SERVICE_DROPBOX, NDPI_PROTOCOL_SAFE }, + { "log.getdropbox.com", "DropBox", NDPI_SERVICE_DROPBOX, NDPI_PROTOCOL_SAFE }, { ".ebay.", "eBay", NDPI_SERVICE_EBAY, NDPI_PROTOCOL_ACCEPTABLE }, { ".ebay.com", "eBay", NDPI_SERVICE_EBAY, NDPI_PROTOCOL_ACCEPTABLE }, { ".ebaystatic.com", "eBay", NDPI_SERVICE_EBAY, NDPI_PROTOCOL_ACCEPTABLE }, diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 07ae9dbab..287162a7c 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1516,12 +1516,12 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_VIBER, no_master, no_master, "Viber", - ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ - ndpi_build_default_ports(ports_b, 7985, 7987, 0, 0, 0)); /* UDP */ - ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_COAP, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ + ndpi_build_default_ports(ports_b, 7985, 7987, 0, 0, 0)); /* UDP */ + ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_COAP, no_master, no_master, "COAP", - ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 5683, 5684, 0, 0, 0)); /* UDP */ /* calling function for host and content matched protocols */ @@ -3287,7 +3287,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct ndpi_connection_tracking(ndpi_struct, flow); - /* build ndpi_selction packet bitmask */ + /* build ndpi_selection packet bitmask */ ndpi_selection_packet = NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC; if(flow->packet.iph != NULL) ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6; diff --git a/src/lib/protocols/coap.c b/src/lib/protocols/coap.c index 8089c8159..cddf31b7e 100644 --- a/src/lib/protocols/coap.c +++ b/src/lib/protocols/coap.c @@ -25,78 +25,117 @@ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_COAP +#define CON 0 +#define NO_CON 1 +#define ACK 2 +#define RST 3 + +struct ndpi_coap_hdr +{ +#if defined(__BIG_ENDIAN__) + u_int8_t version:2, type:2, tkl:4; +#elif defined(__LITTLE_ENDIAN__) + u_int8_t tkl:4, type:2, version:2; +#endif + u_int8_t code; + u_int16_t message_id; //if needed, remember to convert in host number +}; + + +/** + VALUE OF -CODE- FIELD + + [0] = "Empty", + [1] = "GET", + [2] = "POST", + [3] = "PUT", + [4] = "DELETE", + [65] = "2.01 Created", + [66] = "2.02 Deleted", + [67] = "2.03 Valid", + [68] = "2.04 Changed", + [69] = "2.05 Content", + [128] = "4.00 Bad Request", + [129] = "4.01 Unauthorized", + [130] = "4.02 Bad Option", + [131] = "4.03 Forbidden", + [132] = "4.04 Not Found", + [133] = "4.05 Method Not Allowed", + [134] = "4.06 Not Acceptable", + [140] = "4.12 Precondition Failed", + [141] = "4.13 Request Entity Too Large", + [143] = "4.15 Unsupported Content-Format", + [160] = "5.00 Internal Server Error", + [161] = "5.01 Not Implemented", + [162] = "5.02 Bad Gateway", + [163] = "5.03 Service Unavailable", + [164] = "5.04 Gateway Timeout", + [165] = "5.05 Proxying Not Supported" +**/ + + /** * Entry point when protocol is identified. */ static void ndpi_int_coap_add_connection (struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) + struct ndpi_flow_struct *flow) { - // not sure if this is accurate but coap runs on top of udp and should be connectionless ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_COAP,NDPI_PROTOCOL_UNKNOWN); - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "CoAP found.\n"); } + /** * Dissector function that searches CoAP headers */ void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { - struct ndpi_packet_struct *packet = &flow->packet; - if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { - return; - } - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "CoAP detection...\n"); - // searching for request - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> COAP header: %04x%04x%04x%04x [len: %u]\n", - packet->payload[0], packet->payload[1], packet->payload[2], packet->payload[3], packet->payload_packet_len); - // check if we have version bits - if (packet->payload_packet_len < 4) { - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap .. mandatory header not found!\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP); - return; - } - // since this is always unsigned we could have spared the 0xF0 logical AND - // vt = version and type (version is mandatory 1; type is either 0,1,2,3 ) - u_int8_t vt = (u_int8_t) ((packet->payload[0] & 0xF0) >> 4); - if ((vt == 4) || (vt == 5) || (vt == 6) || (vt == 7)) { - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Continuing Coap detection \n"); - // search for values 9 to 15 in the token length - u_int8_t tkl = (u_int8_t) ((packet->payload[0] & 0x0F)); - if ((tkl >= 9) && (tkl <= 15)) { - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap .. invalid token length found!\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP); - return; - } - u_int8_t class = (u_int8_t) ((packet->payload[1] & 0xE0) >> 5); - u_int8_t detail = (u_int8_t) ((packet->payload[1] & 0x1F)); - if ((class == 0) && (detail == 0) && (tkl == 0) && (packet->payload_packet_len == 4)) { - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found ... empty message\n"); - ndpi_int_coap_add_connection(ndpi_struct,flow); - return; - } - if ((class == 0) && ((detail == 1) || (detail == 2 ) || (detail == 3 ) || (detail == 4 ))) { - // we should probably search for options as well and payload for deeper inspection - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found ... req message\n"); - ndpi_int_coap_add_connection(ndpi_struct,flow); - return; - } - if ((class == 2) || (class == 4) || (class == 5)) { - // we should probably search for options as well and payload for deeper inspection - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found ... resp message\n"); - ndpi_int_coap_add_connection(ndpi_struct,flow); - return; - } + struct ndpi_packet_struct *packet = &flow->packet; + struct ndpi_coap_hdr * h = (struct ndpi_coap_hdr*) packet->payload; + + if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { + return; + } + + // search for udp packet + if(packet->udp != NULL) { + + // header too short + if(packet->payload_packet_len < 4) { + + NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "excluding Coap\n"); + NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP); + return; + } + + NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "calculating coap over udp.\n"); + + // check values in header + if(h->version == 1) { + if(h->type == CON || h->type == NO_CON || h->type == ACK || h->type == RST ) { + if(h->tkl == 0 || h->tkl < 8) { + if((h->code >= 0 && h->code <= 5) || (h->code >= 65 && h->code <= 69) || + (h->code >= 128 && h->code <= 134) || (h->code >= 140 && h->code <= 143) || + (h->code >= 160 && h->code <= 165)) { + + NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found...\n"); + ndpi_int_coap_add_connection(ndpi_struct,flow); + return; + } } - NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap ...\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP); - return; + } + } + } + + NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap ...\n"); + NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP); + return; } /** * Entry point for the ndpi library */ void init_coap_dissector (struct ndpi_detection_module_struct *ndpi_struct, - u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) + u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection ("COAP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_COAP, diff --git a/src/lib/protocols/dropbox.c b/src/lib/protocols/dropbox.c index ec546d356..63a1f5531 100644 --- a/src/lib/protocols/dropbox.c +++ b/src/lib/protocols/dropbox.c @@ -25,6 +25,10 @@ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_DROPBOX + +#define DB_LSP_PORT 17500 + + static void ndpi_int_dropbox_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t due_to_correlation) @@ -40,12 +44,25 @@ static void ndpi_check_dropbox(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { - u_int16_t dropbox_port = htons(17500); + + u_int16_t dropbox_port = htons(DB_LSP_PORT); if((packet->udp->source == dropbox_port) && (packet->udp->dest == dropbox_port)) { if(payload_len > 2) { - if(strncmp((const char *)packet->payload, "{\"", 2) == 0) { + if(strncmp((const char *)packet->payload, "{\"host_int\"", 11) == 0) { + + NDPI_LOG(NDPI_PROTOCOL_DROPBOX, ndpi_struct, NDPI_LOG_DEBUG, "Found dropbox.\n"); + ndpi_int_dropbox_add_connection(ndpi_struct, flow, 0); + return; + } + } + } + if((packet->udp->dest == dropbox_port)) { + if(payload_len > 2) { + char * p = (char *) packet->payload; + while(*p++ != '{'); + if(strncmp(p,"\"messageType\"", 13) == 0) { NDPI_LOG(NDPI_PROTOCOL_DROPBOX, ndpi_struct, NDPI_LOG_DEBUG, "Found dropbox.\n"); ndpi_int_dropbox_add_connection(ndpi_struct, flow, 0); return; diff --git a/tests/pcap/coap.pcap b/tests/pcap/coap.pcap index 1554fa5e7..e30a0c2ab 100644 Binary files a/tests/pcap/coap.pcap and b/tests/pcap/coap.pcap differ diff --git a/tests/pcap/dropbox.pcap b/tests/pcap/dropbox.pcap new file mode 100644 index 000000000..6e950826e Binary files /dev/null and b/tests/pcap/dropbox.pcap differ diff --git a/tests/result/coap.pcap.out b/tests/result/coap.pcap.out index 7a53f9697..e17da0c77 100644 --- a/tests/result/coap.pcap.out +++ b/tests/result/coap.pcap.out @@ -1,6 +1,10 @@ -COAP 800 80676 4 +COAP 19 1614 8 - 1 UDP 192.168.56.1:50318 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20220 bytes] - 2 UDP 192.168.56.1:50312 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20194 bytes] - 3 UDP 192.168.56.1:50311 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20120 bytes] - 4 UDP 192.168.56.1:50319 <-> 192.168.56.101:17500 [proto: 27/COAP][200 pkts/20142 bytes] + 1 UDP [2001:da8:215:1171:a10b:cb48:8f83:57f6]:5683 <-> [2001:620:8:35d9::10]:61043 [proto: 27/COAP][1 pkts/86 bytes] + 2 UDP [2001:da8:215:1171:a10b:cb48:8f83:57f6]:5683 <-> [2001:620:8:35d9::10]:61045 [proto: 27/COAP][1 pkts/86 bytes] + 3 UDP [2001:da8:215:1171:a10b:cb48:8f83:57f6]:5683 <-> [2001:620:8:35d9::10]:61047 [proto: 27/COAP][1 pkts/90 bytes] + 4 UDP [bbbb::1]:33499 <-> [bbbb::3]:5683 [proto: 27/COAP][4 pkts/404 bytes] + 5 UDP [bbbb::1]:46819 <-> [bbbb::3]:5683 [proto: 27/COAP][6 pkts/467 bytes] + 6 UDP [2001:da8:215:1171:a10b:cb48:8f83:57f6]:5683 <-> [2001:620:8:35d9::10]:61044 [proto: 27/COAP][1 pkts/86 bytes] + 7 UDP [2001:da8:215:1171:a10b:cb48:8f83:57f6]:5683 <-> [2001:620:8:35d9::10]:61046 [proto: 27/COAP][1 pkts/86 bytes] + 8 UDP [bbbb::1]:50250 <-> [bbbb::3]:5683 [proto: 27/COAP][4 pkts/309 bytes] diff --git a/tests/result/dropbox.pcap.out b/tests/result/dropbox.pcap.out new file mode 100644 index 000000000..db5640be9 --- /dev/null +++ b/tests/result/dropbox.pcap.out @@ -0,0 +1,43 @@ +MDNS 16 1648 1 +SSDP 140 61108 22 +DropBox 1104 246122 16 + + 1 UDP 192.168.1.105:33189 <-> 192.168.1.254:53 [proto: 5.121/DNS.DropBox][4 pkts/744 bytes][Host: notify.dropbox.com] + 2 UDP 192.168.1.105:17500 <-> 192.168.1.255:17500 [proto: 121/DropBox][6 pkts/1422 bytes] + 3 TCP 192.168.1.105:59975 <-> 108.160.172.204:443 [proto: 91.121/SSL.DropBox][34 pkts/18026 bytes][SSL client: client.dropbox.com] + 4 UDP 192.168.1.105:36173 <-> 192.168.1.254:53 [proto: 5.121/DNS.DropBox][8 pkts/1390 bytes][Host: log.getdropbox.com] + 5 TCP 192.168.1.105:46394 <-> 162.125.17.131:443 [proto: 91.121/SSL.DropBox][22 pkts/11392 bytes][SSL client: notify.dropbox.com] + 6 UDP 192.168.1.105:50789 <-> 192.168.1.254:53 [proto: 5.121/DNS.DropBox][4 pkts/792 bytes][Host: d.dropbox.com] + 7 UDP 192.168.1.105:55407 <-> 192.168.1.254:53 [proto: 5.121/DNS.DropBox][4 pkts/822 bytes][Host: client.dropbox.com] + 8 UDP 192.168.56.1:50318 <-> 192.168.56.101:17500 [proto: 121/DropBox][200 pkts/20220 bytes] + 9 UDP 192.168.56.1:50312 <-> 192.168.56.101:17500 [proto: 121/DropBox][200 pkts/20194 bytes] + 10 UDP 192.168.1.101:1280 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 11 UDP 192.168.1.101:1346 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 12 UDP 192.168.1.101:1650 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 13 UDP 192.168.1.101:1908 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 14 UDP 192.168.1.101:2544 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 15 UDP 192.168.1.101:2604 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 16 UDP 192.168.1.101:3412 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 17 UDP 192.168.1.101:4974 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 18 UDP 192.168.1.105:49112 <-> 192.168.1.254:53 [proto: 5.121/DNS.DropBox][4 pkts/774 bytes][Host: client-cf.dropbox.com] + 19 UDP 192.168.1.105:17500 <-> 255.255.255.255:17500 [proto: 121/DropBox][6 pkts/1422 bytes] + 20 UDP 239.255.255.250:1900 <-> 192.168.1.254:50828 [proto: 12/SSDP][44 pkts/19936 bytes] + 21 UDP 192.168.56.1:50311 <-> 192.168.56.101:17500 [proto: 121/DropBox][200 pkts/20120 bytes] + 22 UDP 192.168.56.1:50319 <-> 192.168.56.101:17500 [proto: 121/DropBox][200 pkts/20142 bytes] + 23 UDP 192.168.1.106:57268 <-> 239.255.255.250:1900 [proto: 12/SSDP][16 pkts/2632 bytes] + 24 TCP 54.240.174.31:443 <-> 192.168.1.105:44949 [proto: 91.121/SSL.DropBox][138 pkts/97302 bytes][SSL client: client-cf.dropbox.com] + 25 TCP 192.168.1.105:36226 <-> 108.160.172.195:80 [proto: 7.121/HTTP.DropBox][20 pkts/3928 bytes][Host: log.getdropbox.com] + 26 UDP 192.168.1.101:2169 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 27 UDP 192.168.1.101:2141 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 28 UDP 192.168.1.101:2159 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 29 UDP 192.168.1.101:2873 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 30 UDP 192.168.1.101:2991 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 31 UDP 192.168.1.101:3547 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 32 UDP 192.168.1.101:3731 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 33 UDP 192.168.1.101:3777 <-> 239.255.255.250:1900 [proto: 12/SSDP][2 pkts/1018 bytes] + 34 UDP 192.168.1.101:3959 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 35 UDP 192.168.1.101:4171 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 36 UDP 192.168.1.101:4169 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 37 UDP 192.168.1.106:5353 <-> 224.0.0.251:5353 [proto: 8/MDNS][16 pkts/1648 bytes] + 38 UDP 192.168.1.101:4625 <-> 239.255.255.250:1900 [proto: 12/SSDP][6 pkts/2836 bytes] + 39 TCP 192.168.1.105:47747 <-> 108.160.172.225:443 [proto: 91.121/SSL.DropBox][54 pkts/27432 bytes][SSL client: d.dropbox.com] -- cgit v1.2.3 From 8dacc91d5167e34f5ce741cccf6d42e7e95d8277 Mon Sep 17 00:00:00 2001 From: Campus Date: Tue, 29 Mar 2016 15:04:15 +0200 Subject: fixed dns check host name server --- src/lib/ndpi_main.c | 1 + src/lib/protocols/dns.c | 16 +++++++++++----- 2 files changed, 12 insertions(+), 5 deletions(-) (limited to 'src/lib') diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 287162a7c..af5bbdbe4 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -3083,6 +3083,7 @@ void check_ndpi_tcp_flow_func(struct ndpi_detection_module_struct *ndpi_struct, detection_bitmask) != 0) { ndpi_struct->callback_buffer_tcp_payload[a].func(ndpi_struct, flow); + if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) break; /* Stop after detecting the first protocol */ } diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c index c975465ea..3be9c888b 100644 --- a/src/lib/protocols/dns.c +++ b/src/lib/protocols/dns.c @@ -114,11 +114,17 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd int off = sizeof(struct ndpi_dns_packet_header) + 1; while((flow->packet.payload[off] != '\0')) { - flow->host_server_name[j] = flow->packet.payload[off]; - if(flow->host_server_name[j] < ' ') - flow->host_server_name[j] = '.'; - off++; - j++; + if(off < flow->packet.payload_packet_len) + { + flow->host_server_name[j] = flow->packet.payload[off]; + if(j < strlen(flow->host_server_name)) + { + if(flow->host_server_name[j] < ' ') + flow->host_server_name[j] = '.'; + off++; + j++; + } + } } flow->host_server_name[j] = '\0'; -- cgit v1.2.3 From 4704f48daa92a87caec1fba9e76dbf474e529368 Mon Sep 17 00:00:00 2001 From: Campus Date: Tue, 29 Mar 2016 15:07:16 +0200 Subject: minox fix dns --- src/lib/protocols/dns.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/lib') diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c index 3be9c888b..503761137 100644 --- a/src/lib/protocols/dns.c +++ b/src/lib/protocols/dns.c @@ -121,9 +121,9 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd { if(flow->host_server_name[j] < ' ') flow->host_server_name[j] = '.'; - off++; j++; } + off++; } } flow->host_server_name[j] = '\0'; -- cgit v1.2.3 From 2a1f44610f0c9fc5342f716e0739c64141927e17 Mon Sep 17 00:00:00 2001 From: Campus Date: Fri, 1 Apr 2016 02:11:51 +0200 Subject: improved Microsoft detection --- src/lib/ndpi_content_match.c.inc | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'src/lib') diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 87bc4c96b..eea336821 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -7362,6 +7362,10 @@ ndpi_protocol_match host_match[] = { { ".deezer.com", "Deezer", NDPI_SERVICE_DEEZER, NDPI_PROTOCOL_ACCEPTABLE }, { ".microsoft.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, + { "-msdn.sec.s-msft.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, + { ".webtrends.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, + { ".msecnd.net", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, + { ".visualstudio.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, { "bn1301.storage.live.com", "MS_OneDrive", NDPI_SERVICE_MS_ONE_DRIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "skyapi.live.net", "MS_OneDrive", NDPI_SERVICE_MS_ONE_DRIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "d.docs.live.net", "MS_OneDrive", NDPI_SERVICE_MS_ONE_DRIVE, NDPI_PROTOCOL_ACCEPTABLE }, @@ -7381,9 +7385,7 @@ ndpi_protocol_match host_match[] = { { "evsecure-ocsp.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, { "evsecure-aia.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, { "evsecure-crl.verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, - { "sa.symcb.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, - { "sd.symcb.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, - { ".omniroot.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, + { ".omniroot.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, { ".verisign.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, { ".symcb.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, { ".symcd.com", "Office365", NDPI_SERVICE_OFFICE_365, NDPI_PROTOCOL_ACCEPTABLE }, -- cgit v1.2.3 From aa86387ba949ba70c4791e9df68bcf47fdc4a286 Mon Sep 17 00:00:00 2001 From: Campus Date: Fri, 1 Apr 2016 02:17:58 +0200 Subject: improved Microsoft detection (minor fix) --- src/lib/ndpi_content_match.c.inc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/lib') diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index eea336821..915df390f 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -7362,7 +7362,8 @@ ndpi_protocol_match host_match[] = { { ".deezer.com", "Deezer", NDPI_SERVICE_DEEZER, NDPI_PROTOCOL_ACCEPTABLE }, { ".microsoft.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, - { "-msdn.sec.s-msft.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, + { "i-msdn.sec.s-msft.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, + { "i2-msdn.sec.s-msft.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, { ".webtrends.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, { ".msecnd.net", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, { ".visualstudio.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, -- cgit v1.2.3