From f8ecdc004f337dd478484f5cc2c087022803762b Mon Sep 17 00:00:00 2001 From: Campus Date: Tue, 24 May 2016 23:28:43 +0200 Subject: added new fb detection - remove old bittorrent functions - fix rx warning --- src/include/ndpi_protocols.h | 4 -- src/lib/ndpi_content_match.c.inc | 3 +- src/lib/ndpi_main.c | 16 +++--- src/lib/protocols/gtp.c | 1 - src/lib/protocols/ntp.c | 62 ++++++++++------------ src/lib/protocols/rx.c | 109 +++++++++++++++++++++------------------ 6 files changed, 95 insertions(+), 100 deletions(-) (limited to 'src') diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 3581a3691..9298bf22a 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -52,10 +52,6 @@ void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, st /* Applications and other protocols. */ void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); -void ndpi_bittorrent_init(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t size,u_int32_t timeout); -void ndpi_bittorrent_done(struct ndpi_detection_module_struct *ndpi_struct); -int ndpi_bittorrent_gc(struct hash_ip4p_table *ht,int key,time_t now); - void ndpi_search_edonkey(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_fasttrack_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_gnutella(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 8c05bd87d..ce56b79a6 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -7277,7 +7277,8 @@ ndpi_protocol_match host_match[] = { { ".facebook.com", "Facebook", NDPI_SERVICE_FACEBOOK, NDPI_PROTOCOL_FUN }, { "fbstatic-a.akamaihd.net", "Facebook", NDPI_SERVICE_FACEBOOK, NDPI_PROTOCOL_FUN }, { ".fbcdn.net", "Facebook", NDPI_SERVICE_FACEBOOK, NDPI_PROTOCOL_FUN }, - { "fbcdn-", "Facebook", NDPI_SERVICE_FACEBOOK, NDPI_PROTOCOL_FUN }, /* fbcdn-video-a-akamaihd.net */ + { "fbcdn-", "Facebook", NDPI_SERVICE_FACEBOOK, NDPI_PROTOCOL_FUN }, /* fbcdn-video-a-akamaihd.net */ + { ".facebook.net", "Facebook", NDPI_SERVICE_FACEBOOK, NDPI_PROTOCOL_FUN }, { ".google.", "Google", NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE }, { ".gstatic.com", "Google", NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE }, { ".googlesyndication.com", "Google", NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE }, diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 221c073fd..682cdca03 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1523,18 +1523,18 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 5683, 5684, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_MQTT, - no_master, - no_master, "MQTT", - ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */ - ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ + no_master, + no_master, "MQTT", + ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */ + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0); ports_b[0].port_low = 7000; ports_b[0].port_high = 7032; /* See https://www-01.ibm.com/support/docview.wss?uid=swg21044407 */ ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_RX, - no_master, - no_master, "RX", - ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ - ports_b); /* UDP */ + no_master, + no_master, "RX", + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ + ports_b); /* UDP */ /* calling function for host and content matched protocols */ init_string_based_protocols(ndpi_mod); diff --git a/src/lib/protocols/gtp.c b/src/lib/protocols/gtp.c index 97044f94e..88235f2a8 100644 --- a/src/lib/protocols/gtp.c +++ b/src/lib/protocols/gtp.c @@ -18,7 +18,6 @@ * */ - #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_GTP diff --git a/src/lib/protocols/ntp.c b/src/lib/protocols/ntp.c index a0fa92a20..6e355c9f8 100644 --- a/src/lib/protocols/ntp.c +++ b/src/lib/protocols/ntp.c @@ -22,54 +22,44 @@ * */ - #include "ndpi_protocols.h" + #ifdef NDPI_PROTOCOL_NTP + static void ndpi_int_ntp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NTP, NDPI_PROTOCOL_UNKNOWN); } -/* detection also works asymmetrically */ - void ndpi_search_ntp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { - struct ndpi_packet_struct *packet = &flow->packet; - -// struct ndpi_id_struct *src=ndpi_struct->src; -// struct ndpi_id_struct *dst=ndpi_struct->dst; - - if (!(packet->udp->dest == htons(123) || packet->udp->source == htons(123))) - goto exclude_ntp; - - NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP port detected\n"); - - // It's not correct because packets could be bigger - //if (packet->payload_packet_len != 48) - // goto exclude_ntp; - - NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP length detected\n"); - - - if ((((packet->payload[0] & 0x38) >> 3) <= 4)) { - NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "detected NTP."); + struct ndpi_packet_struct *packet = &flow->packet; + + if (!(packet->udp->dest == htons(123) || packet->udp->source == htons(123))) + goto exclude_ntp; + + NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP port detected\n"); + + NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP length detected\n"); + + + if ((((packet->payload[0] & 0x38) >> 3) <= 4)) { + NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "detected NTP."); - // 38 in binary representation is 00111000 - flow->protos.ntp.version = (packet->payload[0] & 0x38) >> 3; - - if (flow->protos.ntp.version == 2) { - flow->protos.ntp.request_code = packet->payload[3]; - } - - ndpi_int_ntp_add_connection(ndpi_struct, flow); - return; - } - - - - exclude_ntp: + // 38 in binary representation is 00111000 + flow->protos.ntp.version = (packet->payload[0] & 0x38) >> 3; + + if (flow->protos.ntp.version == 2) { + flow->protos.ntp.request_code = packet->payload[3]; + } + + ndpi_int_ntp_add_connection(ndpi_struct, flow); + return; + } + + exclude_ntp: NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_NTP); } diff --git a/src/lib/protocols/rx.c b/src/lib/protocols/rx.c index 8ae98aafd..319dd6d4d 100644 --- a/src/lib/protocols/rx.c +++ b/src/lib/protocols/rx.c @@ -106,6 +106,7 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct, * Check the TYPE and FLAGS fields of an RX packet header. * This check is necessary because we could detect an RX session already begun **/ + /* TYPE field */ if((header->type < DATA) && (header->type > VERSION)) { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); @@ -119,50 +120,59 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct, header->flags == PLUS_2 || header->flags == REQ_ACK || header->flags == MORE_1 || header->flags == CLIENT_INIT_1 || header->flags == CLIENT_INIT_2) { - + /* TYPE and FLAGS combo */ - if(header->type == DATA) { - if(header->flags == LAST_PKT || header->flags == EMPTY || - header->flags == PLUS_0 || header->flags == PLUS_1 || - header->flags == PLUS_2 || header->flags == REQ_ACK || - header->flags == MORE_1) - found = 1; - } - else if(header->type == ACK) { - if(header->flags == CLIENT_INIT_1 || header->flags == CLIENT_INIT_2 || - header->flags == EMPTY) - found = 1; - - } - else if(header->type == CHALLENGE || header->type == RESPONSE) { - if(header->flags == EMPTY || header->call_number == 0) - found = 1; - - } - else if(header->type == ACKALL) { - if(header->flags == EMPTY) - found = 1; - } - else if(header->type == BUSY || header->type == ABORT || - header->type == DEBUG || header->type == PARAM_1 || - header->type == PARAM_2 || header->type == PARAM_3 || - header->type == VERSION) - found = 1; - else { - NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); - return; - } - } - else { + switch(header->type) + { + case DATA: + if(header->flags == LAST_PKT || header->flags == EMPTY || + header->flags == PLUS_0 || header->flags == PLUS_1 || + header->flags == PLUS_2 || header->flags == REQ_ACK || + header->flags == MORE_1) + goto security; + case ACK: + if(header->flags == CLIENT_INIT_1 || header->flags == CLIENT_INIT_2 || + header->flags == EMPTY) + goto security; + case CHALLENGE: + if(header->flags == EMPTY || header->call_number == 0) + goto security; + case RESPONSE: + if(header->flags == EMPTY || header->call_number == 0) + goto security; + case ACKALL: + if(header->flags == EMPTY) + goto security; + case BUSY: + goto security; + case ABORT: + goto security; + case DEBUG: + goto security; + case PARAM_1: + goto security; + case PARAM_2: + goto security; + case PARAM_3: + goto security; + case VERSION: + goto security; + default: + NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); + NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); + return; + } // switch + } else { // FLAG NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; } + security: /* SECURITY field */ if(header->security != 0 && header->security != 1 && - header->security != 2 && header->security != 3) { + header->security != 2 && header->security != 3) + { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; @@ -171,12 +181,17 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct, /* If we have already seen one packet in the other direction, then the two must have matching connection numbers. Otherwise store them. */ - if (flow->packet_direction_counter[!packet->packet_direction] != 0) { + if(flow->packet_direction_counter[!packet->packet_direction] != 0) + { if (flow->l4.udp.rx_conn_epoch == header->conn_epoch && - flow->l4.udp.rx_conn_id == header->conn_id) - found = 1; + flow->l4.udp.rx_conn_id == header->conn_id) + { + NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "found RX\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RX, NDPI_PROTOCOL_UNKNOWN); + } /* https://www.central.org/frameless/numbers/rxservice.html. */ - else { + else + { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; @@ -184,16 +199,10 @@ void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct, } else { flow->l4.udp.rx_conn_epoch = header->conn_epoch; flow->l4.udp.rx_conn_id = header->conn_id; - found = 1; - } - - if(found) { - NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "found RX\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RX, NDPI_PROTOCOL_UNKNOWN); - } - else { - NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); + { + NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "found RX\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RX, NDPI_PROTOCOL_UNKNOWN); + } } } -- cgit v1.2.3