1 /*
2 * vhua.c
3 *
4 * Copyright (C) 2011-21 - ntop.org
5 *
6 * nDPI is free software: you can vhuatribute it and/or modify
7 * it under the terms of the GNU Lesser General Public License as published by
8 * the Free Software Foundation, either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * nDPI is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public License
17 * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
18 *
19 */
20 #include "ndpi_protocol_ids.h"
21
22 #define NDPI_CURRENT_PROTO NDPI_PROTOCOL_VHUA
23
24 #include "ndpi_api.h"
25
26 /*
27 http://www.vhua.com
28
29 Skype-like Chinese phone protocol
30
31 */
32
33
ndpi_int_vhua_add_connection(struct ndpi_detection_module_struct * ndpi_struct,struct ndpi_flow_struct * flow)34 static void ndpi_int_vhua_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
35 ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VHUA, NDPI_PROTOCOL_UNKNOWN);
36 NDPI_LOG_INFO(ndpi_struct, "found VHUA\n");
37 }
38
39
ndpi_check_vhua(struct ndpi_detection_module_struct * ndpi_struct,struct ndpi_flow_struct * flow)40 static void ndpi_check_vhua(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
41 struct ndpi_packet_struct *packet = &flow->packet;
42 u_int32_t payload_len = packet->payload_packet_len;
43 u_char p0[] = { 0x05, 0x14, 0x3a, 0x05, 0x08, 0xf8, 0xa1, 0xb1, 0x03 };
44
45 if(payload_len == 0) return; /* Shouldn't happen */
46
47 /* Break after 3 packets. */
48 if((flow->packet_counter > 3)
49 || (packet->udp == NULL)
50 || (packet->payload_packet_len < sizeof(p0))) {
51 NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
52 } else if(memcmp(packet->payload, p0, sizeof(p0)) == 0) {
53 ndpi_int_vhua_add_connection(ndpi_struct, flow);
54 }
55 }
56
ndpi_search_vhua(struct ndpi_detection_module_struct * ndpi_struct,struct ndpi_flow_struct * flow)57 void ndpi_search_vhua(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
58 struct ndpi_packet_struct *packet = &flow->packet;
59
60 NDPI_LOG_DBG(ndpi_struct, "search VHUA\n");
61
62 /* skip marked packets */
63 if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_VHUA) {
64 ndpi_check_vhua(ndpi_struct, flow);
65 }
66 }
67
68
init_vhua_dissector(struct ndpi_detection_module_struct * ndpi_struct,u_int32_t * id,NDPI_PROTOCOL_BITMASK * detection_bitmask)69 void init_vhua_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
70 {
71 ndpi_set_bitmask_protocol_detection("VHUA", ndpi_struct, detection_bitmask, *id,
72 NDPI_PROTOCOL_VHUA,
73 ndpi_search_vhua,
74 NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
75 SAVE_DETECTION_BITMASK_AS_UNKNOWN,
76 ADD_TO_DETECTION_BITMASK);
77 *id += 1;
78 }
79
80