1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
|
/*
* z3950.c
*
* Copyright (C) 2012-22 - ntop.org
*
* This module is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This module is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License.
* If not, see <http://www.gnu.org/licenses/>.
*
*/
#include "ndpi_protocol_ids.h"
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_Z3950
#include "ndpi_api.h"
#include "ndpi_private.h"
/* https://github.com/wireshark/wireshark/blob/master/epan/dissectors/asn1/z3950/z3950.asn */
static void ndpi_int_z3950_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_Z3950, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
}
/* ***************************************************************** */
static int z3950_parse_sequences(struct ndpi_packet_struct const * const packet,
int max_sequences) {
size_t payload_offset = 2;
int cur_sequences = 0;
u_int8_t pdu_type;
pdu_type = packet->payload[0] & 0x1F;
if((pdu_type < 20) || ((pdu_type > 36) && ((pdu_type < 43) || (pdu_type > 48))))
return(-1);
while(cur_sequences++ < max_sequences) {
u_int8_t const * payload;
u_int8_t seq_type;
u_int8_t seq_length;
if((payload_offset + 2) >= packet->payload_packet_len)
return(-1);
payload = &packet->payload[payload_offset];
if((payload[0] & 0x1F) == 0x1F)
/* We ignore decoding of complex sequences for now. */
return(cur_sequences);
else
seq_type = payload[0] & 0x1F;
seq_length = payload[1];
if(seq_type > 51 && (seq_type < 100 || seq_type > 105) &&
(seq_type < 110 || seq_type > 112) && (seq_type < 120 || seq_type > 121) &&
(seq_type < 201 || seq_type > 221))
return(-1);
if(seq_length >= packet->payload_packet_len - payload_offset + 1)
return(-1);
payload_offset += seq_length + 2;
if(payload_offset == packet->payload_packet_len)
return(cur_sequences);
}
return(cur_sequences - 1);
}
/* ***************************************************************** */
static void ndpi_search_z3950(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct * packet = &ndpi_struct->packet;
int const minimum_expected_sequences = 6;
NDPI_LOG_DBG(ndpi_struct, "search z39.50\n");
if(packet->tcp != NULL && packet->payload_packet_len >= 6 &&
flow->packet_counter >= 1 && flow->packet_counter <= 8) {
int ret = z3950_parse_sequences(packet, minimum_expected_sequences);
if(ret < 0) {
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
return;
}
if(ret < minimum_expected_sequences) {
/* We've seen not enough sequences, wait for the next packet. */
return;
}
if(flow->l4.tcp.z3950_stage == 3) {
if(flow->packet_direction_counter[0] && flow->packet_direction_counter[1])
ndpi_int_z3950_add_connection(ndpi_struct, flow);
else
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow); /* Skip if unidirectional traffic */
} else
flow->l4.tcp.z3950_stage++;
return;
}
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
}
/* ***************************************************************** */
void init_z3950_dissector(struct ndpi_detection_module_struct *ndpi_struct) {
register_dissector("Z3950", ndpi_struct,
ndpi_search_z3950,
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
1, NDPI_PROTOCOL_Z3950);
}
|