From c411df523e7e418a9bd9074768308e86370f5aa4 Mon Sep 17 00:00:00 2001 From: Toni Date: Wed, 14 Jul 2021 11:11:59 +0200 Subject: Added AVAST SecureDNS protocol. (#1244) Signed-off-by: Toni Uhlig --- src/lib/ndpi_main.c | 7 ++++ src/lib/protocols/avast_securedns.c | 68 +++++++++++++++++++++++++++++++++++++ 2 files changed, 75 insertions(+) create mode 100644 src/lib/protocols/avast_securedns.c (limited to 'src/lib') diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index a1c48d781..4b65df0be 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1729,6 +1729,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "GitLab", NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_AVAST_SECUREDNS, + "AVAST SecureDNS", NDPI_PROTOCOL_CATEGORY_NETWORK, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" @@ -3861,6 +3865,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n /* Z39.50 international standard client–server, application layer communications protocol */ init_z3950_dissector(ndpi_str, &a, detection_bitmask); + /* AVAST SecureDNS */ + init_avast_securedns_dissector(ndpi_str, &a, detection_bitmask); + #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" #endif diff --git a/src/lib/protocols/avast_securedns.c b/src/lib/protocols/avast_securedns.c new file mode 100644 index 000000000..06fbaa17c --- /dev/null +++ b/src/lib/protocols/avast_securedns.c @@ -0,0 +1,68 @@ +/* + * avast.c + * + * Copyright (C) 2012-21 - ntop.org + * + * This module is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This module is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License. + * If not, see . + * + */ + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_AVAST_SECUREDNS + +#include +#include "ndpi_api.h" + +static void ndpi_int_avast_securedns_add_connection(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AVAST_SECUREDNS, NDPI_PROTOCOL_UNKNOWN); +} + +static void ndpi_search_avast_securedns(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct * packet = &flow->packet; + + if (packet->payload_packet_len < 34 || + ntohl(get_u_int32_t(packet->payload, 11)) != 0x00013209 || + flow->packet_counter > 1) + { + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; + } + + if (strncasecmp((char *)&packet->payload[15], "securedns", strlen("securedns")) == 0) + { + ndpi_int_avast_securedns_add_connection(ndpi_struct, flow); + return; + } + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); +} + +void init_avast_securedns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, + NDPI_PROTOCOL_BITMASK *detection_bitmask) +{ + ndpi_set_bitmask_protocol_detection("AVAST SecureDNS", + ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_AVAST_SECUREDNS, + ndpi_search_avast_securedns, + NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} -- cgit v1.2.3