ndpi-1.4.0+svn6932/ 0000755 0001750 0001750 00000000000 12240352364 013415 5 ustar cavedon cavedon ndpi-1.4.0+svn6932/src/ 0000755 0001750 0001750 00000000000 12240352354 014203 5 ustar cavedon cavedon ndpi-1.4.0+svn6932/src/include/ 0000755 0001750 0001750 00000000000 12240352354 015626 5 ustar cavedon cavedon ndpi-1.4.0+svn6932/src/include/ndpi_debug_functions.h 0000644 0001750 0001750 00000002442 12031620663 022170 0 ustar cavedon cavedon /*
* ndpi_debug_functions.h
* Copyright (C) 2009-2011 by ipoque GmbH
*
* This file is part of OpenDPI, an open source deep packet inspection
* library based on the PACE technology by ipoque GmbH
*
* OpenDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* OpenDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with OpenDPI. If not, see .
*
*/
#ifndef __NDPI_API_INCLUDE_FILE__
#error CANNOT INCLUDE THIS .H FILE, INCLUDE NDPI_API.H
#endif
#ifndef __NDPI_DEBUG_FUNCTIONS_H__
#define __NDPI_DEBUG_FUNCTIONS_H__
#ifdef __cplusplus
extern "C" {
#endif
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
void ndpi_debug_get_last_log_function_line(struct ndpi_detection_module_struct *ndpi_struct,
const char **file, const char **func, u_int32_t * line);
#endif
#ifdef __cplusplus
}
#endif
#endif
ndpi-1.4.0+svn6932/src/include/ndpi_utils.h 0000644 0001750 0001750 00000002070 12110367113 020143 0 ustar cavedon cavedon /*
* ndpi_utils.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef _NDPI_UTILS_H_
#define _NDPI_UTILS_H_
#include "ndpi_protocols.h"
extern char* ndpi_strnstr(const char *s, const char *find, size_t slen);
#endif /* _NDPI_UTILS_H_ */
ndpi-1.4.0+svn6932/src/include/Makefile.in 0000644 0001750 0001750 00000034674 12227205542 017712 0 ustar cavedon cavedon # Makefile.in generated by automake 1.11.6 from Makefile.am.
# @configure_input@
# Copyright (C) 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002,
# 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Free Software
# Foundation, Inc.
# This Makefile.in is free software; the Free Software Foundation
# gives unlimited permission to copy and/or distribute it,
# with or without modifications, as long as this notice is preserved.
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY, to the extent permitted by law; without
# even the implied warranty of MERCHANTABILITY or FITNESS FOR A
# PARTICULAR PURPOSE.
@SET_MAKE@
VPATH = @srcdir@
am__make_dryrun = \
{ \
am__dry=no; \
case $$MAKEFLAGS in \
*\\[\ \ ]*) \
echo 'am--echo: ; @echo "AM" OK' | $(MAKE) -f - 2>/dev/null \
| grep '^AM OK$$' >/dev/null || am__dry=yes;; \
*) \
for am__flg in $$MAKEFLAGS; do \
case $$am__flg in \
*=*|--*) ;; \
*n*) am__dry=yes; break;; \
esac; \
done;; \
esac; \
test $$am__dry = yes; \
}
pkgdatadir = $(datadir)/@PACKAGE@
pkgincludedir = $(includedir)/@PACKAGE@
pkglibdir = $(libdir)/@PACKAGE@
pkglibexecdir = $(libexecdir)/@PACKAGE@
am__cd = CDPATH="$${ZSH_VERSION+.}$(PATH_SEPARATOR)" && cd
install_sh_DATA = $(install_sh) -c -m 644
install_sh_PROGRAM = $(install_sh) -c
install_sh_SCRIPT = $(install_sh) -c
INSTALL_HEADER = $(INSTALL_DATA)
transform = $(program_transform_name)
NORMAL_INSTALL = :
PRE_INSTALL = :
POST_INSTALL = :
NORMAL_UNINSTALL = :
PRE_UNINSTALL = :
POST_UNINSTALL = :
build_triplet = @build@
host_triplet = @host@
subdir = src/include
DIST_COMMON = $(library_include_HEADERS) $(srcdir)/Makefile.am \
$(srcdir)/Makefile.in
ACLOCAL_M4 = $(top_srcdir)/aclocal.m4
am__aclocal_m4_deps = $(top_srcdir)/m4/libtool.m4 \
$(top_srcdir)/m4/ltoptions.m4 $(top_srcdir)/m4/ltsugar.m4 \
$(top_srcdir)/m4/ltversion.m4 $(top_srcdir)/m4/lt~obsolete.m4 \
$(top_srcdir)/configure.ac
am__configure_deps = $(am__aclocal_m4_deps) $(CONFIGURE_DEPENDENCIES) \
$(ACLOCAL_M4)
mkinstalldirs = $(install_sh) -d
CONFIG_HEADER = $(top_builddir)/config.h
CONFIG_CLEAN_FILES =
CONFIG_CLEAN_VPATH_FILES =
SOURCES =
DIST_SOURCES =
am__can_run_installinfo = \
case $$AM_UPDATE_INFO_DIR in \
n|no|NO) false;; \
*) (install-info --version) >/dev/null 2>&1;; \
esac
am__vpath_adj_setup = srcdirstrip=`echo "$(srcdir)" | sed 's|.|.|g'`;
am__vpath_adj = case $$p in \
$(srcdir)/*) f=`echo "$$p" | sed "s|^$$srcdirstrip/||"`;; \
*) f=$$p;; \
esac;
am__strip_dir = f=`echo $$p | sed -e 's|^.*/||'`;
am__install_max = 40
am__nobase_strip_setup = \
srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*|]/\\\\&/g'`
am__nobase_strip = \
for p in $$list; do echo "$$p"; done | sed -e "s|$$srcdirstrip/||"
am__nobase_list = $(am__nobase_strip_setup); \
for p in $$list; do echo "$$p $$p"; done | \
sed "s| $$srcdirstrip/| |;"' / .*\//!s/ .*/ ./; s,\( .*\)/[^/]*$$,\1,' | \
$(AWK) 'BEGIN { files["."] = "" } { files[$$2] = files[$$2] " " $$1; \
if (++n[$$2] == $(am__install_max)) \
{ print $$2, files[$$2]; n[$$2] = 0; files[$$2] = "" } } \
END { for (dir in files) print dir, files[dir] }'
am__base_list = \
sed '$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;$$!N;s/\n/ /g' | \
sed '$$!N;$$!N;$$!N;$$!N;s/\n/ /g'
am__uninstall_files_from_dir = { \
test -z "$$files" \
|| { test ! -d "$$dir" && test ! -f "$$dir" && test ! -r "$$dir"; } \
|| { echo " ( cd '$$dir' && rm -f" $$files ")"; \
$(am__cd) "$$dir" && rm -f $$files; }; \
}
am__installdirs = "$(DESTDIR)$(library_includedir)"
HEADERS = $(library_include_HEADERS)
ETAGS = etags
CTAGS = ctags
DISTFILES = $(DIST_COMMON) $(DIST_SOURCES) $(TEXINFOS) $(EXTRA_DIST)
ACLOCAL = @ACLOCAL@
AMTAR = @AMTAR@
AR = @AR@
AUTOCONF = @AUTOCONF@
AUTOHEADER = @AUTOHEADER@
AUTOMAKE = @AUTOMAKE@
AWK = @AWK@
CC = @CC@
CCDEPMODE = @CCDEPMODE@
CFLAGS = @CFLAGS@
CPP = @CPP@
CPPFLAGS = @CPPFLAGS@
CYGPATH_W = @CYGPATH_W@
DEFS = @DEFS@
DEPDIR = @DEPDIR@
DLLTOOL = @DLLTOOL@
DSYMUTIL = @DSYMUTIL@
DUMPBIN = @DUMPBIN@
ECHO_C = @ECHO_C@
ECHO_N = @ECHO_N@
ECHO_T = @ECHO_T@
EGREP = @EGREP@
EXEEXT = @EXEEXT@
FGREP = @FGREP@
GREP = @GREP@
INSTALL = @INSTALL@
INSTALL_DATA = @INSTALL_DATA@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
INSTALL_SCRIPT = @INSTALL_SCRIPT@
INSTALL_STRIP_PROGRAM = @INSTALL_STRIP_PROGRAM@
LD = @LD@
LDFLAGS = @LDFLAGS@
LIBOBJS = @LIBOBJS@
LIBS = @LIBS@
LIBTOOL = @LIBTOOL@
LIPO = @LIPO@
LN_S = @LN_S@
LTLIBOBJS = @LTLIBOBJS@
MAKEINFO = @MAKEINFO@
MANIFEST_TOOL = @MANIFEST_TOOL@
MKDIR_P = @MKDIR_P@
NM = @NM@
NMEDIT = @NMEDIT@
OBJDUMP = @OBJDUMP@
OBJEXT = @OBJEXT@
OTOOL = @OTOOL@
OTOOL64 = @OTOOL64@
PACKAGE = @PACKAGE@
PACKAGE_BUGREPORT = @PACKAGE_BUGREPORT@
PACKAGE_NAME = @PACKAGE_NAME@
PACKAGE_STRING = @PACKAGE_STRING@
PACKAGE_TARNAME = @PACKAGE_TARNAME@
PACKAGE_URL = @PACKAGE_URL@
PACKAGE_VERSION = @PACKAGE_VERSION@
PATH_SEPARATOR = @PATH_SEPARATOR@
PLATFORM_DEPENDENT = @PLATFORM_DEPENDENT@
RANLIB = @RANLIB@
SED = @SED@
SET_MAKE = @SET_MAKE@
SHELL = @SHELL@
STRIP = @STRIP@
VERSION = @VERSION@
abs_builddir = @abs_builddir@
abs_srcdir = @abs_srcdir@
abs_top_builddir = @abs_top_builddir@
abs_top_srcdir = @abs_top_srcdir@
ac_ct_AR = @ac_ct_AR@
ac_ct_CC = @ac_ct_CC@
ac_ct_DUMPBIN = @ac_ct_DUMPBIN@
am__include = @am__include@
am__leading_dot = @am__leading_dot@
am__quote = @am__quote@
am__tar = @am__tar@
am__untar = @am__untar@
bindir = @bindir@
build = @build@
build_alias = @build_alias@
build_cpu = @build_cpu@
build_os = @build_os@
build_vendor = @build_vendor@
builddir = @builddir@
datadir = @datadir@
datarootdir = @datarootdir@
docdir = @docdir@
dvidir = @dvidir@
exec_prefix = @exec_prefix@
host = @host@
host_alias = @host_alias@
host_cpu = @host_cpu@
host_os = @host_os@
host_vendor = @host_vendor@
htmldir = @htmldir@
includedir = @includedir@
infodir = @infodir@
install_sh = @install_sh@
libdir = @libdir@
libexecdir = @libexecdir@
localedir = @localedir@
localstatedir = @localstatedir@
mandir = @mandir@
mkdir_p = @mkdir_p@
oldincludedir = @oldincludedir@
pdfdir = @pdfdir@
prefix = @prefix@
program_transform_name = @program_transform_name@
psdir = @psdir@
sbindir = @sbindir@
sharedstatedir = @sharedstatedir@
srcdir = @srcdir@
sysconfdir = @sysconfdir@
target_alias = @target_alias@
top_build_prefix = @top_build_prefix@
top_builddir = @top_builddir@
top_srcdir = @top_srcdir@
library_includedir = $(includedir)/libndpi-1.4/libndpi
library_include_HEADERS = ndpi_api.h \
ndpi_debug_functions.h \
ndpi_define.h \
ndpi_macros.h \
ndpi_protocols_osdpi.h \
ndpi_public_functions.h
all: all-am
.SUFFIXES:
$(srcdir)/Makefile.in: $(srcdir)/Makefile.am $(am__configure_deps)
@for dep in $?; do \
case '$(am__configure_deps)' in \
*$$dep*) \
( cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh ) \
&& { if test -f $@; then exit 0; else break; fi; }; \
exit 1;; \
esac; \
done; \
echo ' cd $(top_srcdir) && $(AUTOMAKE) --gnu src/include/Makefile'; \
$(am__cd) $(top_srcdir) && \
$(AUTOMAKE) --gnu src/include/Makefile
.PRECIOUS: Makefile
Makefile: $(srcdir)/Makefile.in $(top_builddir)/config.status
@case '$?' in \
*config.status*) \
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh;; \
*) \
echo ' cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe)'; \
cd $(top_builddir) && $(SHELL) ./config.status $(subdir)/$@ $(am__depfiles_maybe);; \
esac;
$(top_builddir)/config.status: $(top_srcdir)/configure $(CONFIG_STATUS_DEPENDENCIES)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(top_srcdir)/configure: $(am__configure_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(ACLOCAL_M4): $(am__aclocal_m4_deps)
cd $(top_builddir) && $(MAKE) $(AM_MAKEFLAGS) am--refresh
$(am__aclocal_m4_deps):
mostlyclean-libtool:
-rm -f *.lo
clean-libtool:
-rm -rf .libs _libs
install-library_includeHEADERS: $(library_include_HEADERS)
@$(NORMAL_INSTALL)
@list='$(library_include_HEADERS)'; test -n "$(library_includedir)" || list=; \
if test -n "$$list"; then \
echo " $(MKDIR_P) '$(DESTDIR)$(library_includedir)'"; \
$(MKDIR_P) "$(DESTDIR)$(library_includedir)" || exit 1; \
fi; \
for p in $$list; do \
if test -f "$$p"; then d=; else d="$(srcdir)/"; fi; \
echo "$$d$$p"; \
done | $(am__base_list) | \
while read files; do \
echo " $(INSTALL_HEADER) $$files '$(DESTDIR)$(library_includedir)'"; \
$(INSTALL_HEADER) $$files "$(DESTDIR)$(library_includedir)" || exit $$?; \
done
uninstall-library_includeHEADERS:
@$(NORMAL_UNINSTALL)
@list='$(library_include_HEADERS)'; test -n "$(library_includedir)" || list=; \
files=`for p in $$list; do echo $$p; done | sed -e 's|^.*/||'`; \
dir='$(DESTDIR)$(library_includedir)'; $(am__uninstall_files_from_dir)
ID: $(HEADERS) $(SOURCES) $(LISP) $(TAGS_FILES)
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
mkid -fID $$unique
tags: TAGS
TAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
set x; \
here=`pwd`; \
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
shift; \
if test -z "$(ETAGS_ARGS)$$*$$unique"; then :; else \
test -n "$$unique" || unique=$$empty_fix; \
if test $$# -gt 0; then \
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
"$$@" $$unique; \
else \
$(ETAGS) $(ETAGSFLAGS) $(AM_ETAGSFLAGS) $(ETAGS_ARGS) \
$$unique; \
fi; \
fi
ctags: CTAGS
CTAGS: $(HEADERS) $(SOURCES) $(TAGS_DEPENDENCIES) \
$(TAGS_FILES) $(LISP)
list='$(SOURCES) $(HEADERS) $(LISP) $(TAGS_FILES)'; \
unique=`for i in $$list; do \
if test -f "$$i"; then echo $$i; else echo $(srcdir)/$$i; fi; \
done | \
$(AWK) '{ files[$$0] = 1; nonempty = 1; } \
END { if (nonempty) { for (i in files) print i; }; }'`; \
test -z "$(CTAGS_ARGS)$$unique" \
|| $(CTAGS) $(CTAGSFLAGS) $(AM_CTAGSFLAGS) $(CTAGS_ARGS) \
$$unique
GTAGS:
here=`$(am__cd) $(top_builddir) && pwd` \
&& $(am__cd) $(top_srcdir) \
&& gtags -i $(GTAGS_ARGS) "$$here"
distclean-tags:
-rm -f TAGS ID GTAGS GRTAGS GSYMS GPATH tags
distdir: $(DISTFILES)
@srcdirstrip=`echo "$(srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
topsrcdirstrip=`echo "$(top_srcdir)" | sed 's/[].[^$$\\*]/\\\\&/g'`; \
list='$(DISTFILES)'; \
dist_files=`for file in $$list; do echo $$file; done | \
sed -e "s|^$$srcdirstrip/||;t" \
-e "s|^$$topsrcdirstrip/|$(top_builddir)/|;t"`; \
case $$dist_files in \
*/*) $(MKDIR_P) `echo "$$dist_files" | \
sed '/\//!d;s|^|$(distdir)/|;s,/[^/]*$$,,' | \
sort -u` ;; \
esac; \
for file in $$dist_files; do \
if test -f $$file || test -d $$file; then d=.; else d=$(srcdir); fi; \
if test -d $$d/$$file; then \
dir=`echo "/$$file" | sed -e 's,/[^/]*$$,,'`; \
if test -d "$(distdir)/$$file"; then \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
if test -d $(srcdir)/$$file && test $$d != $(srcdir); then \
cp -fpR $(srcdir)/$$file "$(distdir)$$dir" || exit 1; \
find "$(distdir)/$$file" -type d ! -perm -700 -exec chmod u+rwx {} \;; \
fi; \
cp -fpR $$d/$$file "$(distdir)$$dir" || exit 1; \
else \
test -f "$(distdir)/$$file" \
|| cp -p $$d/$$file "$(distdir)/$$file" \
|| exit 1; \
fi; \
done
check-am: all-am
check: check-am
all-am: Makefile $(HEADERS)
installdirs:
for dir in "$(DESTDIR)$(library_includedir)"; do \
test -z "$$dir" || $(MKDIR_P) "$$dir"; \
done
install: install-am
install-exec: install-exec-am
install-data: install-data-am
uninstall: uninstall-am
install-am: all-am
@$(MAKE) $(AM_MAKEFLAGS) install-exec-am install-data-am
installcheck: installcheck-am
install-strip:
if test -z '$(STRIP)'; then \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
install; \
else \
$(MAKE) $(AM_MAKEFLAGS) INSTALL_PROGRAM="$(INSTALL_STRIP_PROGRAM)" \
install_sh_PROGRAM="$(INSTALL_STRIP_PROGRAM)" INSTALL_STRIP_FLAG=-s \
"INSTALL_PROGRAM_ENV=STRIPPROG='$(STRIP)'" install; \
fi
mostlyclean-generic:
clean-generic:
distclean-generic:
-test -z "$(CONFIG_CLEAN_FILES)" || rm -f $(CONFIG_CLEAN_FILES)
-test . = "$(srcdir)" || test -z "$(CONFIG_CLEAN_VPATH_FILES)" || rm -f $(CONFIG_CLEAN_VPATH_FILES)
maintainer-clean-generic:
@echo "This command is intended for maintainers to use"
@echo "it deletes files that may require special tools to rebuild."
clean: clean-am
clean-am: clean-generic clean-libtool mostlyclean-am
distclean: distclean-am
-rm -f Makefile
distclean-am: clean-am distclean-generic distclean-tags
dvi: dvi-am
dvi-am:
html: html-am
html-am:
info: info-am
info-am:
install-data-am: install-library_includeHEADERS
install-dvi: install-dvi-am
install-dvi-am:
install-exec-am:
install-html: install-html-am
install-html-am:
install-info: install-info-am
install-info-am:
install-man:
install-pdf: install-pdf-am
install-pdf-am:
install-ps: install-ps-am
install-ps-am:
installcheck-am:
maintainer-clean: maintainer-clean-am
-rm -f Makefile
maintainer-clean-am: distclean-am maintainer-clean-generic
mostlyclean: mostlyclean-am
mostlyclean-am: mostlyclean-generic mostlyclean-libtool
pdf: pdf-am
pdf-am:
ps: ps-am
ps-am:
uninstall-am: uninstall-library_includeHEADERS
.MAKE: install-am install-strip
.PHONY: CTAGS GTAGS all all-am check check-am clean clean-generic \
clean-libtool ctags distclean distclean-generic \
distclean-libtool distclean-tags distdir dvi dvi-am html \
html-am info info-am install install-am install-data \
install-data-am install-dvi install-dvi-am install-exec \
install-exec-am install-html install-html-am install-info \
install-info-am install-library_includeHEADERS install-man \
install-pdf install-pdf-am install-ps install-ps-am \
install-strip installcheck installcheck-am installdirs \
maintainer-clean maintainer-clean-generic mostlyclean \
mostlyclean-generic mostlyclean-libtool pdf pdf-am ps ps-am \
tags uninstall uninstall-am uninstall-library_includeHEADERS
# Tell versions [3.59,3.63) of GNU make to not export all variables.
# Otherwise a system limit (for SysV at least) may be exceeded.
.NOEXPORT:
ndpi-1.4.0+svn6932/src/include/ndpi_protocol_history.h 0000644 0001750 0001750 00000002472 12071253673 022446 0 ustar cavedon cavedon /*
* ndpi_protocol_history.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef NDPI_PROTOCOL_HISTORY_H
#define NDPI_PROTOCOL_HISTORY_H
typedef enum {
NDPI_REAL_PROTOCOL = 0,
NDPI_CORRELATED_PROTOCOL = 1
} ndpi_protocol_type_t;
void ndpi_int_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type);
#endif
ndpi-1.4.0+svn6932/src/include/ndpi_protocols_osdpi.h 0000644 0001750 0001750 00000023615 12221001113 022221 0 ustar cavedon cavedon /*
* ndpi_protocols_osdpi.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_API_INCLUDE_FILE__
#endif
#ifndef __NDPI_PROTOCOLS_DEFAULT_H__
#define __NDPI_PROTOCOLS_DEFAULT_H__
#ifdef __cplusplus
extern "C" {
#endif
// #define NDPI_ENABLE_DEBUG_MESSAGES
#define NDPI_DETECTION_SUPPORT_IPV6
#define NDPI_PROTOCOL_HISTORY_SIZE 3
#define NDPI_PROTOCOL_UNKNOWN 0
#define NDPI_PROTOCOL_FTP 1
#define NDPI_PROTOCOL_MAIL_POP 2
#define NDPI_PROTOCOL_MAIL_SMTP 3
#define NDPI_PROTOCOL_MAIL_IMAP 4
#define NDPI_PROTOCOL_DNS 5
#define NDPI_PROTOCOL_IPP 6
#define NDPI_PROTOCOL_HTTP 7
#define NDPI_PROTOCOL_MDNS 8
#define NDPI_PROTOCOL_NTP 9
#define NDPI_PROTOCOL_NETBIOS 10
#define NDPI_PROTOCOL_NFS 11
#define NDPI_PROTOCOL_SSDP 12
#define NDPI_PROTOCOL_BGP 13
#define NDPI_PROTOCOL_SNMP 14
#define NDPI_PROTOCOL_XDMCP 15
#define NDPI_PROTOCOL_SMB 16
#define NDPI_PROTOCOL_SYSLOG 17
#define NDPI_PROTOCOL_DHCP 18
#define NDPI_PROTOCOL_POSTGRES 19
#define NDPI_PROTOCOL_MYSQL 20
#define NDPI_PROTOCOL_TDS 21
#define NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK 22
#define NDPI_PROTOCOL_MAIL_POPS 23
//#define NDPI_PROTOCOL_I23V5 23
#define NDPI_PROTOCOL_APPLEJUICE 24
#define NDPI_PROTOCOL_DIRECTCONNECT 25
#define NDPI_PROTOCOL_SOCRATES 26
#define NDPI_PROTOCOL_WINMX 27
#define NDPI_PROTOCOL_VMWARE 28
//#define NDPI_PROTOCOL_PANDO 29
#define NDPI_PROTOCOL_MAIL_SMTPS 29
#define NDPI_PROTOCOL_FILETOPIA 30
#define NDPI_PROTOCOL_IMESH 31
#define NDPI_PROTOCOL_KONTIKI 32
#define NDPI_PROTOCOL_OPENFT 33
#define NDPI_PROTOCOL_FASTTRACK 34
#define NDPI_PROTOCOL_GNUTELLA 35
#define NDPI_PROTOCOL_EDONKEY 36
#define NDPI_PROTOCOL_BITTORRENT 37
#define NDPI_PROTOCOL_OFF 38
#define NDPI_PROTOCOL_AVI 39
#define NDPI_PROTOCOL_FLASH 40
#define NDPI_PROTOCOL_OGG 41
#define NDPI_PROTOCOL_MPEG 42
#define NDPI_PROTOCOL_QUICKTIME 43
#define NDPI_PROTOCOL_REALMEDIA 44
#define NDPI_PROTOCOL_WINDOWSMEDIA 45
#define NDPI_PROTOCOL_MMS 46
#define NDPI_PROTOCOL_XBOX 47
#define NDPI_PROTOCOL_QQ 48
#define NDPI_PROTOCOL_MOVE 49
#define NDPI_PROTOCOL_RTSP 50
//#define NDPI_PROTOCOL_FEIDIAN 51
#define NDPI_PROTOCOL_MAIL_IMAPS 51
#define NDPI_PROTOCOL_ICECAST 52
#define NDPI_PROTOCOL_PPLIVE 53
#define NDPI_PROTOCOL_PPSTREAM 54
#define NDPI_PROTOCOL_ZATTOO 55
#define NDPI_PROTOCOL_SHOUTCAST 56
#define NDPI_PROTOCOL_SOPCAST 57
#define NDPI_PROTOCOL_TVANTS 58
#define NDPI_PROTOCOL_TVUPLAYER 59
#define NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV 60
#define NDPI_PROTOCOL_QQLIVE 61
#define NDPI_PROTOCOL_THUNDER 62
#define NDPI_PROTOCOL_SOULSEEK 63
#define NDPI_PROTOCOL_SSL_NO_CERT 64 /* SSL without certificate (Skype, Ultrasurf?) - ntop.org */
#define NDPI_PROTOCOL_IRC 65
#define NDPI_PROTOCOL_POPO 66
#define NDPI_PROTOCOL_UNENCRYPED_JABBER 67
#define NDPI_PROTOCOL_MSN 68
#define NDPI_PROTOCOL_OSCAR 69
#define NDPI_PROTOCOL_YAHOO 70
#define NDPI_PROTOCOL_BATTLEFIELD 71
#define NDPI_PROTOCOL_QUAKE 72
#define NDPI_PROTOCOL_VRRP 73
#define NDPI_PROTOCOL_STEAM 74
#define NDPI_PROTOCOL_HALFLIFE2 75
#define NDPI_PROTOCOL_WORLDOFWARCRAFT 76
#define NDPI_PROTOCOL_TELNET 77
#define NDPI_PROTOCOL_STUN 78
#define NDPI_PROTOCOL_IPSEC 79
#define NDPI_PROTOCOL_GRE 80
#define NDPI_PROTOCOL_ICMP 81
#define NDPI_PROTOCOL_IGMP 82
#define NDPI_PROTOCOL_EGP 83
#define NDPI_PROTOCOL_SCTP 84
#define NDPI_PROTOCOL_OSPF 85
#define NDPI_PROTOCOL_IP_IN_IP 86
#define NDPI_PROTOCOL_RTP 87
#define NDPI_PROTOCOL_RDP 88
#define NDPI_PROTOCOL_VNC 89
#define NDPI_PROTOCOL_PCANYWHERE 90
#define NDPI_PROTOCOL_SSL 91
#define NDPI_PROTOCOL_SSH 92
#define NDPI_PROTOCOL_USENET 93
#define NDPI_PROTOCOL_MGCP 94
#define NDPI_PROTOCOL_IAX 95
#define NDPI_PROTOCOL_TFTP 96
#define NDPI_PROTOCOL_AFP 97
#define NDPI_PROTOCOL_STEALTHNET 98
#define NDPI_PROTOCOL_AIMINI 99
#define NDPI_PROTOCOL_SIP 100
#define NDPI_PROTOCOL_TRUPHONE 101
#define NDPI_PROTOCOL_ICMPV6 102
#define NDPI_PROTOCOL_DHCPV6 103
#define NDPI_PROTOCOL_ARMAGETRON 104
#define NDPI_PROTOCOL_CROSSFIRE 105
#define NDPI_PROTOCOL_DOFUS 106
#define NDPI_PROTOCOL_FIESTA 107
#define NDPI_PROTOCOL_FLORENSIA 108
#define NDPI_PROTOCOL_GUILDWARS 109
#define NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC 110
#define NDPI_PROTOCOL_KERBEROS 111
#define NDPI_PROTOCOL_LDAP 112
#define NDPI_PROTOCOL_MAPLESTORY 113
#define NDPI_PROTOCOL_MSSQL 114
#define NDPI_PROTOCOL_PPTP 115
#define NDPI_PROTOCOL_WARCRAFT3 116
#define NDPI_PROTOCOL_WORLD_OF_KUNG_FU 117
#define NDPI_PROTOCOL_MEEBO 118
#define NDPI_PROTOCOL_FACEBOOK 119
#define NDPI_PROTOCOL_TWITTER 120
#define NDPI_PROTOCOL_DROPBOX 121
#define NDPI_PROTOCOL_GMAIL 122
#define NDPI_PROTOCOL_GOOGLE_MAPS 123
#define NDPI_PROTOCOL_YOUTUBE 124
#define NDPI_PROTOCOL_SKYPE 125
#define NDPI_PROTOCOL_GOOGLE 126
#define NDPI_PROTOCOL_DCERPC 127
#define NDPI_PROTOCOL_NETFLOW 128
#define NDPI_PROTOCOL_SFLOW 129
#define NDPI_PROTOCOL_HTTP_CONNECT 130
#define NDPI_PROTOCOL_HTTP_PROXY 131
#define NDPI_PROTOCOL_CITRIX 132
#define NDPI_PROTOCOL_NETFLIX 133
#define NDPI_PROTOCOL_LASTFM 134
#define NDPI_PROTOCOL_GROOVESHARK 135
#define NDPI_PROTOCOL_SKYFILE_PREPAID 136
#define NDPI_PROTOCOL_SKYFILE_RUDICS 137
#define NDPI_PROTOCOL_SKYFILE_POSTPAID 138
#define NDPI_PROTOCOL_CITRIX_ONLINE 139
#define NDPI_PROTOCOL_APPLE 140
#define NDPI_PROTOCOL_WEBEX 141
#define NDPI_PROTOCOL_WHATSAPP 142
#define NDPI_PROTOCOL_APPLE_ICLOUD 143
#define NDPI_PROTOCOL_VIBER 144
#define NDPI_PROTOCOL_APPLE_ITUNES 145
#define NDPI_PROTOCOL_RADIUS 146
#define NDPI_PROTOCOL_WINDOWS_UPDATE 147 /* Thierry Laurion */
#define NDPI_PROTOCOL_TEAMVIEWER 148 /* xplico.org */
#define NDPI_PROTOCOL_TUENTI 149
#define NDPI_PROTOCOL_LOTUS_NOTES 150
#define NDPI_PROTOCOL_SAP 151
#define NDPI_PROTOCOL_GTP 152
#define NDPI_PROTOCOL_UPNP 153
#define NDPI_PROTOCOL_LLMNR 154
#define NDPI_PROTOCOL_REMOTE_SCAN 155
#define NDPI_PROTOCOL_SPOTIFY 156
#define NDPI_PROTOCOL_WEBM 157
#define NDPI_PROTOCOL_H323 158 /* Remy Mudingay */
#define NDPI_PROTOCOL_OPENVPN 159 /* Remy Mudingay */
#define NDPI_PROTOCOL_NOE 160 /* Remy Mudingay */
#define NDPI_PROTOCOL_CISCOVPN 161 /* Remy Mudingay */
#define NDPI_PROTOCOL_TEAMSPEAK 162 /* Remy Mudingay */
#define NDPI_PROTOCOL_TOR 163 /* Remy Mudingay */
#define NDPI_PROTOCOL_SKINNY 164 /* Remy Mudingay */
#define NDPI_PROTOCOL_RTCP 165 /* Remy Mudingay */
#define NDPI_PROTOCOL_RSYNC 166 /* Remy Mudingay */
#define NDPI_PROTOCOL_ORACLE 167 /* Remy Mudingay */
#define NDPI_PROTOCOL_CORBA 168 /* Remy Mudingay */
#define NDPI_PROTOCOL_UBUNTUONE 169 /* Remy Mudingay */
#define NDPI_PROTOCOL_WHOIS_DAS 170
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
#define NDPI_LAST_IMPLEMENTED_PROTOCOL 170
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
#ifdef __cplusplus
}
#endif
#endif
ndpi-1.4.0+svn6932/src/include/ndpi_macros.h 0000644 0001750 0001750 00000006237 12221001113 020264 0 ustar cavedon cavedon /*
* ndpi_macros.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_MACROS_H__
#define __NDPI_MACROS_H__
#define NDPI_NUM_BITS 256
typedef u_int32_t ndpi_ndpi_mask;
#define NDPI_BITS /* 32 */ (sizeof(ndpi_ndpi_mask) * 8 /* number of bits in a byte */) /* bits per mask */
#define howmanybits(x, y) (((x)+((y)-1))/(y))
#define NDPI_SET(p, n) ((p)->fds_bits[(n)/NDPI_BITS] |= (1 << (((u_int32_t)n) % NDPI_BITS)))
#define NDPI_CLR(p, n) ((p)->fds_bits[(n)/NDPI_BITS] &= ~(1 << (((u_int32_t)n) % NDPI_BITS)))
#define NDPI_ISSET(p, n) ((p)->fds_bits[(n)/NDPI_BITS] & (1 << (((u_int32_t)n) % NDPI_BITS)))
#define NDPI_ZERO(p) memset((char *)(p), 0, sizeof(*(p)))
#define NDPI_ONE(p) memset((char *)(p), 0xFF, sizeof(*(p)))
#define NDPI_NUM_FDS_BITS howmanybits(NDPI_NUM_BITS, NDPI_BITS)
#ifdef __cplusplus
extern "C" {
#endif
typedef struct ndpi_protocol_bitmask_struct {
ndpi_ndpi_mask fds_bits[NDPI_NUM_FDS_BITS];
} ndpi_protocol_bitmask_struct_t;
#define NDPI_PROTOCOL_BITMASK ndpi_protocol_bitmask_struct_t
int NDPI_BITMASK_COMPARE(NDPI_PROTOCOL_BITMASK a, NDPI_PROTOCOL_BITMASK b);
int NDPI_BITMASK_IS_EMPTY(NDPI_PROTOCOL_BITMASK a);
void NDPI_DUMP_BITMASK(NDPI_PROTOCOL_BITMASK a);
#define NDPI_BITMASK_ADD(a,b) NDPI_SET(&a,b)
#define NDPI_BITMASK_DEL(a,b) NDPI_CLR(&a,b)
#define NDPI_BITMASK_RESET(a) NDPI_ZERO(&a)
#define NDPI_BITMASK_SET_ALL(a) NDPI_ONE(&a)
#define NDPI_BITMASK_SET(a, b) { memcpy(&a, &b, sizeof(NDPI_PROTOCOL_BITMASK)); }
/* this is a very very tricky macro *g*,
* the compiler will remove all shifts here if the protocol is static...
*/
#define NDPI_ADD_PROTOCOL_TO_BITMASK(bmask,value) NDPI_SET(&bmask,value)
#define NDPI_DEL_PROTOCOL_FROM_BITMASK(bmask,value) NDPI_CLR(&bmask,value)
#define NDPI_COMPARE_PROTOCOL_TO_BITMASK(bmask,value) NDPI_ISSET(&bmask,value)
#define NDPI_SAVE_AS_BITMASK(bmask,value) { NDPI_ZERO(&bmask) ; NDPI_ADD_PROTOCOL_TO_BITMASK(bmask, value); }
#define ndpi_min(a,b) ((a < b) ? a : b)
#define ndpi_max(a,b) ((a > b) ? a : b)
#define NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct,flow,packet) \
if (packet->packet_lines_parsed_complete != 1) { \
ndpi_parse_packet_line_info(ndpi_struct,flow); \
} \
#ifdef __cplusplus
}
#endif
#endif
ndpi-1.4.0+svn6932/src/include/ndpi_main.h 0000644 0001750 0001750 00000016147 12235473255 017756 0 ustar cavedon cavedon /*
* ndpi_main.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_MAIN_INCLUDE_FILE__
#define __NDPI_MAIN_INCLUDE_FILE__
#ifndef __KERNEL__
#include
#include
#include
#include
#include
#include
#endif
#ifndef WIN32
#ifndef __KERNEL__
#include
#endif
#if !defined __APPLE__ && !defined __FreeBSD__ && !defined __NetBSD__
#ifndef __KERNEL__
#include
#include
#else
#include
#include
#endif
#endif
/* default includes */
#ifndef __KERNEL__
#include
#include
#endif
#endif
#ifdef WIN32
#include /* winsock.h is included automatically */
#include
#include
#include /* getopt from: http://www.pwilson.net/sample.html. */
#include /* for getpid() and the exec..() family */
#ifndef _CRT_SECURE_NO_WARNINGS
#define _CRT_SECURE_NO_WARNINGS
#endif
#define snprintf _snprintf
extern char* strsep(char **stringp, const char *delim);
#define __attribute__(x)
#include
#ifndef __GNUC__
typedef unsigned char u_char;
typedef unsigned short u_short;
typedef unsigned int uint;
typedef unsigned long u_long;
#endif
typedef u_char u_int8_t;
typedef u_short u_int16_t;
typedef uint u_int32_t;
typedef unsigned __int64 u_int64_t;
#endif /* Win32 */
#include "linux_compat.h"
#if defined(__FreeBSD__) || defined(__NetBSD__)
#include
#if defined(__NetBSD__)
#include
#endif
#endif
#ifndef WIN32
#ifndef __KERNEL__
#include
#include
#include
#else
#include
#include
#include
#endif
#endif
#include "ndpi_define.h"
#include "ndpi_macros.h"
#include "ndpi_protocols_osdpi.h"
typedef enum {
ndpi_preorder,
ndpi_postorder,
ndpi_endorder,
ndpi_leaf
} ndpi_VISIT;
void *ndpi_tdelete(const void * __restrict, void ** __restrict,
int (*)(const void *, const void *));
void *ndpi_tfind(const void *, void *, int (*)(const void *, const void *));
void *ndpi_tsearch(const void *, void**, int (*)(const void *, const void *));
void ndpi_twalk(const void *, void (*)(const void *, ndpi_VISIT, int, void*), void *user_data);
void ndpi_tdestroy(void *vrootp, void (*freefct)(void *));
typedef struct node_t {
char *key;
struct node_t *left, *right;
} ndpi_node;
/* Least recently used cache */
struct ndpi_LruCacheNumEntry {
u_int32_t key;
u_int32_t value;
};
struct ndpi_LruCacheStrEntry {
char *key, *value;
time_t expire_time;
};
struct ndpi_LruCacheEntry {
u_int8_t numeric_node;
union {
struct ndpi_LruCacheNumEntry num; /* numeric_node == 1 */
struct ndpi_LruCacheStrEntry str; /* numeric_node == 0 */
} u;
struct ndpi_LruCacheEntry *next; /* Hash collision list */
};
struct ndpi_LruCache {
u_int32_t max_cache_node_len, hash_size, mem_size;
u_int32_t num_cache_add, num_cache_find, num_cache_misses;
u_int32_t last_num_cache_add, last_num_cache_find, last_num_cache_misses;
u_int32_t *current_hash_size; /* Allocated dynamically */
struct ndpi_LruCacheEntry **hash; /* Allocated dynamically */
};
u_int32_t ndpi_find_lru_cache_num(struct ndpi_LruCache *cache, u_int32_t key);
int ndpi_add_to_lru_cache_num(struct ndpi_LruCache *cache, u_int32_t key, u_int32_t value);
u_int16_t ntohs_ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read);
u_int32_t ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read);
u_int64_t ndpi_bytestream_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read);
u_int32_t ndpi_bytestream_dec_or_hex_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read);
u_int64_t ndpi_bytestream_dec_or_hex_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read);
u_int32_t ndpi_bytestream_to_ipv4(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read);
#include "ndpi_api.h"
#include "ndpi_protocol_history.h"
#include "ndpi_structs.h"
/* function to parse a packet which has line based information into a line based structure
* this function will also set some well known line pointers like:
* - host, user agent, empty line,....
*/
extern void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
extern void ndpi_parse_packet_line_info_unix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
extern u_int16_t ndpi_check_for_email_address(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t counter);
extern void ndpi_int_change_packet_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type);
extern void ndpi_int_change_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol,
ndpi_protocol_type_t protocol_type);
extern void ndpi_set_proto_defaults(struct ndpi_detection_module_struct *ndpi_mod,
u_int16_t protoId, char *protoName,
ndpi_port_range *tcpDefPorts, ndpi_port_range *udpDefPorts);
extern void ndpi_int_reset_packet_protocol(struct ndpi_packet_struct *packet);
extern void ndpi_int_reset_protocol(struct ndpi_flow_struct *flow);
extern void ndpi_ip_clear(ndpi_ip_addr_t * ip);
extern int ndpi_ip_is_set(const ndpi_ip_addr_t * ip);
extern int ndpi_packet_src_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip);
extern int ndpi_packet_dst_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip);
extern void ndpi_packet_src_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip);
extern void ndpi_packet_dst_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip);
extern char *ndpi_get_ip_string(struct ndpi_detection_module_struct *ndpi_struct, const ndpi_ip_addr_t * ip);
extern char *ndpi_get_packet_src_ip_string(struct ndpi_detection_module_struct *ndpi_struct,
const struct ndpi_packet_struct *packet);
extern char* ndpi_get_proto_by_id(struct ndpi_detection_module_struct *ndpi_mod, u_int id);
#endif /* __NDPI_MAIN_INCLUDE_FILE__ */
ndpi-1.4.0+svn6932/src/include/ndpi_protocols.h 0000644 0001750 0001750 00000042035 12235225031 021034 0 ustar cavedon cavedon /*
* ndpi_protocols.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_PROTOCOLS_INCLUDE_FILE__
#define __NDPI_PROTOCOLS_INCLUDE_FILE__
#include "ndpi_main.h"
/* the get_uXX will return raw network packet bytes !! */
#define get_u_int8_t(X,O) (*(u_int8_t *)(((u_int8_t *)X) + O))
#define get_u_int16_t(X,O) (*(u_int16_t *)(((u_int8_t *)X) + O))
#define get_u_int32_t(X,O) (*(u_int32_t *)(((u_int8_t *)X) + O))
#define get_u_int64_t(X,O) (*(u_int64_t *)(((u_int8_t *)X) + O))
/* new definitions to get little endian from network bytes */
#define get_ul8(X,O) get_u_int8_t(X,O)
#if defined(__LITTLE_ENDIAN__)
#define get_l16(X,O) get_u_int16_t(X,O)
#define get_l32(X,O) get_u_int32_t(X,O)
#elif defined(__BIG_ENDIAN__)
/* convert the bytes from big to little endian */
#ifndef __KERNEL__
# define get_l16(X,O) bswap_16(get_u_int16_t(X,O))
# define get_l32(X,O) bswap_32(get_u_int32_t(X,O))
#else
# define get_l16(X,O) __cpu_to_le16(get_u_int16_t(X,O))
# define get_l32(X,O) __cpu_to_le32(get_u_int32_t(X,O))
#endif
#else
#error "__BYTE_ORDER MUST BE DEFINED !"
#endif /* __BYTE_ORDER */
/* define memory callback function */
#define ndpi_mem_cmp memcmp
void ndpi_search_bittorrent(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* edonkey entry function*/
void ndpi_search_edonkey(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* fasttrack entry function*/
void ndpi_search_fasttrack_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* gnutella entry function*/
void ndpi_search_gnutella(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* winmx entry function*/
void ndpi_search_winmx_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* directconnect entry function*/
void ndpi_search_directconnect(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* applejuice entry function*/
void ndpi_search_applejuice_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* i23v5 entry function */
void ndpi_search_i23v5(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_socrates(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* soulseek entry function*/
void ndpi_search_soulseek_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* msn entry function*/
void ndpi_search_msn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
/* yahoo entry function*/
void ndpi_search_yahoo(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* oscar entry function*/
void ndpi_search_oscar(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* jabber entry function*/
void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* irc entry function*/
void ndpi_search_irc_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* sip entry, used for tcp and udp !!! */
void ndpi_search_sip(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
/* DirectDownloadLink entry */
void ndpi_search_direct_download_link_tcp(struct
ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* Mail POP entry */
void ndpi_search_mail_pop_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* IMAP entry */
void ndpi_search_mail_imap_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* Mail SMTP entry */
void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* HTTP entry */
void ndpi_http_subprotocol_conf(struct ndpi_detection_module_struct *ndpi_struct,
char *attr, char *value, int protocol_id);
void ndpi_search_http_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* FTP entry */
void ndpi_search_ftp_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* USENET entry */
void ndpi_search_usenet_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* DNS entry */
void ndpi_search_dns(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* RTSP entry */
void ndpi_search_rtsp_tcp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* filetopia entry */
void ndpi_search_filetopia_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* vmware entry */
void ndpi_search_vmware(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* TCP/UDP protocols */
u_int ndpi_search_tcp_or_udp_raw(struct ndpi_detection_module_struct *ndpi_struct,
u_int8_t protocol,
u_int32_t saddr, u_int32_t daddr,
u_int16_t sport, u_int16_t dport);
void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* imesh entry */
void ndpi_search_imesh_tcp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* SSL entry */
void ndpi_search_ssl_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* flash entry */
void ndpi_search_flash(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* mms entry */
void ndpi_search_mms_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* icecast entry */
void ndpi_search_icecast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
/* shoutcast entry */
void ndpi_search_shoutcast_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* veohtv entry */
void ndpi_search_veohtv_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* openft entry */
void ndpi_search_openft_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* stun entry */
void ndpi_search_stun(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
/* Pando entry */
void ndpi_search_pando_tcp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_tvants_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_sopcast(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_tvuplayer(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ppstream(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_pplive_tcp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_iax(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_mgcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_zattoo(struct ndpi_detection_module_struct*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_qq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_feidian(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_popo_tcp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_thunder(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_activesync(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_in_non_tcp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_vnc_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_dhcp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_steam(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_halflife2(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_xbox(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_smb_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_telnet_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ntp_udp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_nfs(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_rtp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ssdp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_worldofwarcraft(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_postgres_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_mysql_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_bgp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_quake(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_battlefield(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_secondlife(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_pcanywhere(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_snmp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_kontiki(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_syslog(struct ndpi_detection_module_struct*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_tds_tcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_netbios(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ipp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ldap(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_warcraft3(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_xdmcp(struct ndpi_detection_module_struct
*ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_tftp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_mssql(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_pptp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_stealthnet(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_dhcpv6_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_meebo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_afp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_aimini(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_florensia(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_maplestory(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_dofus(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_world_of_kung_fu(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_fiesta(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_crossfire_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_guildwars_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_armagetron_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_dropbox(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_skype(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_citrix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_dcerpc(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_netflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_sflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_radius(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_wsus(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_teamview(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_lotus_notes(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_gtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_spotify(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_h323(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_openvpn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_noe(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_viber(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_teamspeak(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_corba(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_rsync(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_rtcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_skinny(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_tor(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_whois_das(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
u_int8_t is_skype_connection(struct ndpi_detection_module_struct *ndpi_struct,
u_int32_t src_host, u_int32_t dst_host);
void add_skype_connection(struct ndpi_detection_module_struct *ndpi_struct,
u_int32_t src_host, u_int32_t dst_host);
#endif /* __NDPI_PROTOCOLS_INCLUDE_FILE__ */
ndpi-1.4.0+svn6932/src/include/ndpi_public_functions.h 0000644 0001750 0001750 00000024746 12174564037 022405 0 ustar cavedon cavedon /*
* ndpi_public_functions.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_API_INCLUDE_FILE__
#error CANNOT INCLUDE THIS .H FILE, INCLUDE NDPI_API.H
#endif
#ifndef __NDPI_PUBLIC_FUNCTIONS_H__
#define __NDPI_PUBLIC_FUNCTIONS_H__
//#include "ndpi_structs.h"
#ifdef __cplusplus
extern "C" {
#endif
/* Forward */
struct ndpi_flow_struct;
struct ndpi_id_struct;
/**
* struct for a unique ipv4 flow address
*/
typedef struct ndpi_unique_flow_ipv4_address_struct {
/**
* lower ip
*/
u_int32_t lower_ip;
/**
* upper ip
*/
u_int32_t upper_ip;
/* we need 3 dummies to fill up to ipv6 address size */
/**
* this is only needed to become the same size like a unique ipv6 struct
*/
u_int64_t dummy[3];
} ndpi_unique_flow_ipv4_address_struct_t;
/**
* struct for a unique ipv6 flow address
*/
typedef struct ndpi_unique_flow_ipv6_address_struct {
/**
* lower ip
*/
u_int64_t lower_ip[2];
/**
* upper ip
*/
u_int64_t upper_ip[2];
} ndpi_unique_flow_ipv6_address_struct_t;
/**
* struct for a unique ipv4 and ipv6 5-tuple (ip,ip,port,port,protocol)
*/
typedef struct ndpi_unique_flow_ipv4_and_6_struct {
/* only ip addresses are different, to minimize compare operations for hash tables, store ipv4 or ipv6 always in the first bit */
/**
* saves if it is a ipv6, if it false so it is a ipv4
*/
u_int16_t is_ip_v6;
/**
* the protocol, 16 bit wide for alignemt reasons
*/
u_int16_t protocol; /* for alignment reason, protocol is 16 bit, not 8 bit */
/**
* the port of the lower ip address
*/
u_int16_t lower_port;
/**
* the port of the upper ip address
*/
u_int16_t upper_port;
union {
/**
* the ipv4 flow address struct. use the same memory area like ipv6 (union)
*/
struct ndpi_unique_flow_ipv4_address_struct ipv4;
/**
* the ipv6 flow address struct. use the same memory area like ipv4 (union)
*/
struct ndpi_unique_flow_ipv6_address_struct ipv6;
} ip;
} ndpi_unique_flow_ipv4_and_6_struct_t;
typedef enum {
NDPI_LOG_ERROR,
NDPI_LOG_TRACE,
NDPI_LOG_DEBUG
} ndpi_log_level_t;
typedef void (*ndpi_debug_function_ptr) (u_int32_t protocol,
void *module_struct, ndpi_log_level_t log_level, const char *format, ...);
/**
* This function returns the size of the flow struct
* @return the size of the flow struct
*/
u_int32_t ndpi_detection_get_sizeof_ndpi_flow_struct(void);
/**
* This function returns the size of the id struct
* @return the size of the id struct
*/
u_int32_t ndpi_detection_get_sizeof_ndpi_id_struct(void);
/* Public malloc/free */
void* ndpi_malloc(unsigned long size);
void* ndpi_calloc(unsigned long count, unsigned long size);
void ndpi_free(void *ptr);
void *ndpi_realloc(void *ptr, size_t old_size, size_t new_size);
char *ndpi_strdup(const char *s);
char* ndpi_strnstr(const char *s, const char *find, size_t slen);
/**
* This function returns a new initialized detection module.
* @param ticks_per_second the timestamp resolution per second (like 1000 for millisecond resolution)
* @param ndpi_malloc function pointer to a memory allocator
* @param ndpi_debug_printf a function pointer to a debug output function, use NULL in productive envionments
* @return the initialized detection module
*/
struct ndpi_detection_module_struct *ndpi_init_detection_module(u_int32_t ticks_per_second,
void* (*__ndpi_malloc)(unsigned long size),
void (*__ndpi_free)(void *ptr),
ndpi_debug_function_ptr ndpi_debug_printf);
/**
* This function enables cache support in nDPI used for some protocol such as Skype
* @param cache host name
* @param cache port
*/
void ndpi_enable_cache(struct ndpi_detection_module_struct *ndpi_mod, char* host, u_int port);
/**
* This function destroys the detection module
* @param ndpi_struct the to clearing detection module
* @param ndpi_free function pointer to a memory free function
*/
void
ndpi_exit_detection_module(struct ndpi_detection_module_struct
*ndpi_struct, void (*ndpi_free) (void *ptr));
/**
* This function sets the protocol bitmask2
* @param ndpi_struct the detection module
* @param detection_bitmask the protocol bitmask
*/
void
ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *ndpi_struct,
const NDPI_PROTOCOL_BITMASK * detection_bitmask);
/**
* This function will processes one packet and returns the ID of the detected protocol.
* This is the main packet processing function.
*
* @param ndpi_struct the detection module
* @param flow void pointer to the connection state machine
* @param packet the packet as unsigned char pointer with the length of packetlen. the pointer must point to the Layer 3 (IP header)
* @param packetlen the length of the packet
* @param current_tick the current timestamp for the packet
* @param src void pointer to the source subscriber state machine
* @param dst void pointer to the destination subscriber state machine
* @return returns the detected ID of the protocol
*/
unsigned int
ndpi_detection_process_packet(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
const unsigned char *packet,
const unsigned short packetlen,
const u_int32_t current_tick,
struct ndpi_id_struct *src,
struct ndpi_id_struct *dst);
#define NDPI_DETECTION_ONLY_IPV4 ( 1 << 0 )
#define NDPI_DETECTION_ONLY_IPV6 ( 1 << 1 )
/**
* query the pointer to the layer 4 packet
*
* @param l3 pointer to the layer 3 data
* @param l3_len length of the layer 3 data
* @param l4_return filled with the pointer the layer 4 data if return value == 0, undefined otherwise
* @param l4_len_return filled with the length of the layer 4 data if return value == 0, undefined otherwise
* @param l4_protocol_return filled with the protocol of the layer 4 data if return value == 0, undefined otherwise
* @param flags limit operation on ipv4 or ipv6 packets, possible values are NDPI_DETECTION_ONLY_IPV4 or NDPI_DETECTION_ONLY_IPV6; 0 means any
* @return 0 if correct layer 4 data could be found, != 0 otherwise
*/
u_int8_t ndpi_detection_get_l4(const u_int8_t * l3, u_int16_t l3_len, const u_int8_t ** l4_return, u_int16_t * l4_len_return,
u_int8_t * l4_protocol_return, u_int32_t flags);
/**
* build the unique key of a flow
*
* @param l3 pointer to the layer 3 data
* @param l3_len length of the layer 3 data
* @param l4 pointer to the layer 4 data
* @param l4_len length of the layer 4 data
* @param l4_protocol layer 4 protocol
* @param key_return filled with the unique key if return value == 0, undefined otherwise
* @param dir_return filled with a direction flag (0 or 1), can be NULL
* @param flags limit operation on ipv4 or ipv6 packets, possible values are NDPI_DETECTION_ONLY_IPV4 or NDPI_DETECTION_ONLY_IPV6; 0 means any
* @return 0 if key could be built, != 0 otherwise
*/
u_int8_t ndpi_detection_build_key(const u_int8_t * l3, u_int16_t l3_len, const u_int8_t * l4, u_int16_t l4_len, u_int8_t l4_protocol,
struct ndpi_unique_flow_ipv4_and_6_struct *key_return, u_int8_t * dir_return, u_int32_t flags);
/**
* returns the real protocol for the flow of the last packet given to the detection.
* if no real protocol could be found, the unknown protocol will be returned.
*
* @param ndpi_struct the detection module
* @return the protocol id of the last real protocol found in the protocol history of the flow
*/
u_int16_t ndpi_detection_get_real_protocol_of_flow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
/**
* returns true if the protocol history of the flow of the last packet given to the detection
* contains the given protocol.
*
* @param ndpi_struct the detection module
* @return 1 if protocol has been found, 0 otherwise
*/
u_int8_t ndpi_detection_flow_protocol_history_contains_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t protocol_id);
unsigned int ndpi_find_port_based_protocol(struct ndpi_detection_module_struct *ndpi_struct,
u_int8_t proto, u_int32_t shost, u_int16_t sport, u_int32_t dhost, u_int16_t dport);
unsigned int ndpi_guess_undetected_protocol(struct ndpi_detection_module_struct *ndpi_struct,
u_int8_t proto, u_int32_t shost, u_int16_t sport, u_int32_t dhost, u_int16_t dport);
int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow, char *string_to_match, u_int string_to_match_len);
char* ndpi_get_proto_name(struct ndpi_detection_module_struct *mod, u_int16_t proto_id);
int ndpi_get_protocol_id(struct ndpi_detection_module_struct *ndpi_mod, char *proto);
void ndpi_dump_protocols(struct ndpi_detection_module_struct *mod);
int matchStringProtocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow,
char *string_to_match, u_int string_to_match_len);
int ndpi_load_protocols_file(struct ndpi_detection_module_struct *ndpi_mod, char* path);
u_int ndpi_get_num_supported_protocols(struct ndpi_detection_module_struct *ndpi_mod);
char* ndpi_revision(void);
void* ndpi_create_empty_automa(struct ndpi_detection_module_struct *ndpi_struct);
int ndpi_add_host_url_subprotocol_to_automa(struct ndpi_detection_module_struct *ndpi_struct, char *value, int protocol_id, void* automa);
void ndpi_set_automa(struct ndpi_detection_module_struct *ndpi_struct, void* automa);
#ifdef __cplusplus
}
#endif
#endif
ndpi-1.4.0+svn6932/src/include/ndpi_structs.h 0000644 0001750 0001750 00000047357 12235473255 020550 0 ustar cavedon cavedon /*
* ndpi_structs.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_STRUCTS_INCLUDE_FILE__
#define __NDPI_STRUCTS_INCLUDE_FILE__
#include "ndpi_credis.h"
#include "linux_compat.h"
#include "ndpi_define.h"
#ifdef NDPI_DETECTION_SUPPORT_IPV6
struct ndpi_ip6_addr {
union {
u_int8_t u6_addr8[16];
u_int16_t u6_addr16[8];
u_int32_t u6_addr32[4];
u_int64_t u6_addr64[2];
} ndpi_v6_u;
#define ndpi_v6_addr ndpi_v6_u.u6_addr8
#define ndpi_v6_addr16 ndpi_v6_u.u6_addr16
#define ndpi_v6_addr32 ndpi_v6_u.u6_addr32
#define ndpi_v6_addr64 ndpi_v6_u.u6_addr64
};
struct ndpi_ipv6hdr {
/* use userspace and kernelspace compatible compile parameters */
#if defined(__LITTLE_ENDIAN__)
u_int8_t priority:4, version:4;
#elif defined(__BIG_ENDIAN__)
u_int8_t version:4, priority:4;
#else
# error "Byte order must be defined"
#endif
u_int8_t flow_lbl[3];
u_int16_t payload_len;
u_int8_t nexthdr;
u_int8_t hop_limit;
struct ndpi_ip6_addr saddr;
struct ndpi_ip6_addr daddr;
};
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
typedef union {
u_int32_t ipv4;
u_int8_t ipv4_u_int8_t[4];
#ifdef NDPI_DETECTION_SUPPORT_IPV6
struct ndpi_ip6_addr ipv6;
#endif
} ndpi_ip_addr_t;
# define MAX_PACKET_COUNTER 65000
typedef struct ndpi_id_struct {
/* detected_protocol_bitmask:
* access this bitmask to find out whether an id has used skype or not
* if a flag is set here, it will not be resetted
* to compare this, use:
* if (NDPI_BITMASK_COMPARE(id->detected_protocol_bitmask,
* NDPI_PROTOCOL_BITMASK_XXX) != 0)
* {
* // protocol XXX detected on this id
* }
*/
NDPI_PROTOCOL_BITMASK detected_protocol_bitmask;
#ifdef NDPI_PROTOCOL_FTP
ndpi_ip_addr_t ftp_ip;
#endif
#ifdef NDPI_PROTOCOL_RTSP
ndpi_ip_addr_t rtsp_ip_address;
#endif
#ifdef NDPI_PROTOCOL_PPLIVE
u_int32_t pplive_last_packet_time;
#endif
#ifdef NDPI_PROTOCOL_SIP
#ifdef NDPI_PROTOCOL_YAHOO
u_int32_t yahoo_video_lan_timer;
#endif
#endif
#ifdef NDPI_PROTOCOL_IRC
u_int32_t last_time_port_used[16];
#endif
#ifdef NDPI_PROTOCOL_FTP
u_int32_t ftp_timer;
#endif
#ifdef NDPI_PROTOCOL_IRC
u_int32_t irc_ts;
#endif
#ifdef NDPI_PROTOCOL_GNUTELLA
u_int32_t gnutella_ts;
#endif
#ifdef NDPI_PROTOCOL_BATTLEFIELD
u_int32_t battlefield_ts;
#endif
#ifdef NDPI_PROTOCOL_THUNDER
u_int32_t thunder_ts;
#endif
#ifdef NDPI_PROTOCOL_RTSP
u_int32_t rtsp_timer;
#endif
#ifdef NDPI_PROTOCOL_OSCAR
u_int32_t oscar_last_safe_access_time;
#endif
#ifdef NDPI_PROTOCOL_GADUGADU
u_int32_t gg_ft_ip_address;
u_int32_t gg_timeout;
#endif
#ifdef NDPI_PROTOCOL_ZATTOO
u_int32_t zattoo_ts;
#endif
#ifdef NDPI_PROTOCOL_UNENCRYPED_JABBER
u_int32_t jabber_stun_or_ft_ts;
#endif
#ifdef NDPI_PROTOCOL_DIRECTCONNECT
u_int32_t directconnect_last_safe_access_time;
#endif
#ifdef NDPI_PROTOCOL_SOULSEEK
u_int32_t soulseek_last_safe_access_time;
#endif
#ifdef NDPI_PROTOCOL_DIRECTCONNECT
u_int16_t detected_directconnect_port;
u_int16_t detected_directconnect_udp_port;
u_int16_t detected_directconnect_ssl_port;
#endif
#ifdef NDPI_PROTOCOL_PPLIVE
u_int16_t pplive_vod_cli_port;
#endif
#ifdef NDPI_PROTOCOL_IRC
u_int16_t irc_port[16];
#endif
#ifdef NDPI_PROTOCOL_GADUGADU
u_int16_t gg_ft_port;
#endif
#ifdef NDPI_PROTOCOL_UNENCRYPED_JABBER
#define JABBER_MAX_STUN_PORTS 6
u_int16_t jabber_voice_stun_port[JABBER_MAX_STUN_PORTS];
u_int16_t jabber_file_transfer_port[2];
#endif
#ifdef NDPI_PROTOCOL_GNUTELLA
u_int16_t detected_gnutella_port;
#endif
#ifdef NDPI_PROTOCOL_GNUTELLA
u_int16_t detected_gnutella_udp_port1;
u_int16_t detected_gnutella_udp_port2;
#endif
#ifdef NDPI_PROTOCOL_SOULSEEK
u_int16_t soulseek_listen_port;
#endif
#ifdef NDPI_PROTOCOL_IRC
u_int8_t irc_number_of_port;
#endif
#ifdef NDPI_PROTOCOL_OSCAR
u_int8_t oscar_ssl_session_id[33];
#endif
#ifdef NDPI_PROTOCOL_GADUGADU
u_int8_t gg_call_id[2][7];
u_int8_t gg_fmnumber[8];
#endif
#ifdef NDPI_PROTOCOL_UNENCRYPED_JABBER
u_int8_t jabber_voice_stun_used_ports;
#endif
#ifdef NDPI_PROTOCOL_SIP
#ifdef NDPI_PROTOCOL_YAHOO
u_int32_t yahoo_video_lan_dir:1;
#endif
#endif
#ifdef NDPI_PROTOCOL_YAHOO
u_int32_t yahoo_conf_logged_in:1;
u_int32_t yahoo_voice_conf_logged_in:1;
#endif
#ifdef NDPI_PROTOCOL_FTP
u_int32_t ftp_timer_set:1;
#endif
#ifdef NDPI_PROTOCOL_RTSP
u_int32_t rtsp_ts_set:1;
#endif
#ifdef NDPI_PROTOCOL_PPLIVE
u_int32_t pplive_last_packet_time_set:1;
#endif
} ndpi_id_struct;
/* ************************************************** */
struct ndpi_flow_tcp_struct {
#ifdef NDPI_PROTOCOL_FLASH
u_int16_t flash_bytes;
#endif
#ifdef NDPI_PROTOCOL_MAIL_SMTP
u_int16_t smtp_command_bitmask;
#endif
#ifdef NDPI_PROTOCOL_MAIL_POP
u_int16_t pop_command_bitmask;
#endif
#ifdef NDPI_PROTOCOL_QQ
u_int16_t qq_nxt_len;
#endif
#ifdef NDPI_PROTOCOL_TDS
u_int8_t tds_login_version;
#endif
#ifdef NDPI_PROTOCOL_PPLIVE
u_int8_t pplive_next_packet_size[2];
#endif
#ifdef NDPI_PROTOCOL_IRC
u_int8_t irc_stage;
u_int8_t irc_port;
#endif
#ifdef NDPI_PROTOCOL_GNUTELLA
u_int8_t gnutella_msg_id[3];
#endif
#ifdef NDPI_PROTOCOL_EDONKEY
u_int32_t edk_ext:1;
#endif
#ifdef NDPI_PROTOCOL_IRC
u_int32_t irc_3a_counter:3;
u_int32_t irc_stage2:5;
u_int32_t irc_direction:2;
u_int32_t irc_0x1000_full:1;
#endif
#ifdef NDPI_PROTOCOL_WINMX
u_int32_t winmx_stage:1; // 0-1
#endif
#ifdef NDPI_PROTOCOL_SOULSEEK
u_int32_t soulseek_stage:2;
#endif
#ifdef NDPI_PROTOCOL_FILETOPIA
u_int32_t filetopia_stage:2;
#endif
#ifdef NDPI_PROTOCOL_TDS
u_int32_t tds_stage:3;
#endif
#ifdef NDPI_PROTOCOL_USENET
u_int32_t usenet_stage:2;
#endif
#ifdef NDPI_PROTOCOL_IMESH
u_int32_t imesh_stage:4;
#endif
#ifdef NDPI_PROTOCOL_FTP
u_int32_t ftp_codes_seen:5;
u_int32_t ftp_client_direction:1;
#endif
#ifdef NDPI_PROTOCOL_HTTP
u_int32_t http_setup_dir:2;
u_int32_t http_stage:2;
u_int32_t http_empty_line_seen:1;
u_int32_t http_wait_for_retransmission:1;
#endif // NDPI_PROTOCOL_HTTP
#ifdef NDPI_PROTOCOL_FLASH
u_int32_t flash_stage:3;
#endif
#ifdef NDPI_PROTOCOL_GNUTELLA
u_int32_t gnutella_stage:2; //0-2
#endif
#ifdef NDPI_PROTOCOL_MMS
u_int32_t mms_stage:2;
#endif
#ifdef NDPI_PROTOCOL_YAHOO
u_int32_t yahoo_sip_comm:1;
u_int32_t yahoo_http_proxy_stage:2;
#endif
#ifdef NDPI_PROTOCOL_MSN
u_int32_t msn_stage:3;
u_int32_t msn_ssl_ft:2;
#endif
#ifdef NDPI_PROTOCOL_SSH
u_int32_t ssh_stage:3;
#endif
#ifdef NDPI_PROTOCOL_VNC
u_int32_t vnc_stage:2; // 0 - 3
#endif
#ifdef NDPI_PROTOCOL_STEAM
u_int32_t steam_stage:2; // 0 - 3
#endif
#ifdef NDPI_PROTOCOL_TELNET
u_int32_t telnet_stage:2; // 0 - 2
#endif
#ifdef NDPI_PROTOCOL_SSL
u_int8_t ssl_stage:2, ssl_seen_client_cert:1, ssl_seen_server_cert:1; // 0 - 5
#endif
#ifdef NDPI_PROTOCOL_POSTGRES
u_int32_t postgres_stage:3;
#endif
#ifdef NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK
u_int32_t ddlink_server_direction:1;
#endif
u_int32_t seen_syn:1;
u_int32_t seen_syn_ack:1;
u_int32_t seen_ack:1;
#ifdef NDPI_PROTOCOL_ICECAST
u_int32_t icecast_stage:1;
#endif
#ifdef NDPI_PROTOCOL_DOFUS
u_int32_t dofus_stage:1;
#endif
#ifdef NDPI_PROTOCOL_FIESTA
u_int32_t fiesta_stage:2;
#endif
#ifdef NDPI_PROTOCOL_WORLDOFWARCRAFT
u_int32_t wow_stage:2;
#endif
#ifdef NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV
u_int32_t veoh_tv_stage:2;
#endif
#ifdef NDPI_PROTOCOL_SHOUTCAST
u_int32_t shoutcast_stage:2;
#endif
#ifdef NDPI_PROTOCOL_RTP
u_int32_t rtp_special_packets_seen:1;
#endif
#ifdef NDPI_PROTOCOL_MAIL_POP
u_int32_t mail_pop_stage:2;
#endif
#ifdef NDPI_PROTOCOL_MAIL_IMAP
u_int32_t mail_imap_stage:3;
#endif
#ifdef NDPI_PROTOCOL_SKYPE
u_int8_t skype_packet_id;
#endif
#ifdef NDPI_PROTOCOL_CITRIX
u_int8_t citrix_packet_id;
#endif
#ifdef NDPI_PROTOCOL_LOTUS_NOTES
u_int8_t lotus_notes_packet_id;
#endif
#ifdef NDPI_PROTOCOL_TEAMVIEWER
u_int8_t teamviewer_stage;
#endif
}
/* ************************************************** */
#if !defined(WIN32)
__attribute__ ((__packed__))
#endif
;
#if defined(WIN32)
#define pthread_t HANDLE
#define pthread_mutex_t HANDLE
#define pthread_rwlock_t pthread_mutex_t
#endif
struct ndpi_flow_udp_struct {
#ifdef NDPI_PROTOCOL_BATTLEFIELD
u_int32_t battlefield_msg_id;
#endif
#ifdef NDPI_PROTOCOL_SNMP
u_int32_t snmp_msg_id;
#endif
#ifdef NDPI_PROTOCOL_BATTLEFIELD
u_int32_t battlefield_stage:3;
#endif
#ifdef NDPI_PROTOCOL_SNMP
u_int32_t snmp_stage:2;
#endif
#ifdef NDPI_PROTOCOL_PPSTREAM
u_int32_t ppstream_stage:3; // 0-7
#endif
#ifdef NDPI_PROTOCOL_HALFLIFE2
u_int32_t halflife2_stage:2; // 0 - 2
#endif
#ifdef NDPI_PROTOCOL_TFTP
u_int32_t tftp_stage:1;
#endif
#ifdef NDPI_PROTOCOL_AIMINI
u_int32_t aimini_stage:5;
#endif
#ifdef NDPI_PROTOCOL_XBOX
u_int32_t xbox_stage:1;
#endif
#ifdef NDPI_PROTOCOL_WINDOWS_UPDATE
u_int32_t wsus_stage:1;
#endif
#ifdef NDPI_PROTOCOL_SKYPE
u_int8_t skype_packet_id;
#endif
#ifdef NDPI_PROTOCOL_TEAMVIEWER
u_int8_t teamviewer_stage;
#endif
}
/* ************************************************** */
#if !defined(WIN32)
__attribute__ ((__packed__))
#endif
;
#if defined(WIN32)
#define pthread_t HANDLE
#define pthread_mutex_t HANDLE
#define pthread_rwlock_t pthread_mutex_t
extern unsigned long waitForNextEvent(unsigned long ulDelay /* ms */);
#define sleep(a /* sec */) waitForNextEvent(1000*a /* ms */)
#define pthread_rwlock_init pthread_mutex_init
#define pthread_rwlock_wrlock pthread_mutex_lock
#define pthread_rwlock_rdlock pthread_mutex_lock
#define pthread_rwlock_unlock pthread_mutex_unlock
#define pthread_rwlock_destroy pthread_mutex_destroy
#endif
typedef struct ndpi_int_one_line_struct {
const u_int8_t *ptr;
u_int16_t len;
} ndpi_int_one_line_struct_t;
typedef struct ndpi_packet_struct {
const struct ndpi_iphdr *iph;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
const struct ndpi_ipv6hdr *iphv6;
#endif
const struct ndpi_tcphdr *tcp;
const struct ndpi_udphdr *udp;
const u_int8_t *generic_l4_ptr; /* is set only for non tcp-udp traffic */
const u_int8_t *payload;
u_int32_t tick_timestamp;
u_int16_t detected_protocol_stack[NDPI_PROTOCOL_HISTORY_SIZE];
u_int8_t detected_subprotocol_stack[NDPI_PROTOCOL_HISTORY_SIZE];
/* this is for simple read-only access to the real protocol
* used for the main loop */
u_int16_t real_protocol_read_only;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
# if NDPI_PROTOCOL_HISTORY_SIZE > 5
# error protocol stack size not supported
# endif
struct {
u_int8_t entry_is_real_protocol:5;
u_int8_t current_stack_size_minus_one:3;
}
#if !defined(WIN32)
__attribute__ ((__packed__))
#endif
protocol_stack_info;
#endif
struct ndpi_int_one_line_struct line[NDPI_MAX_PARSE_LINES_PER_PACKET];
struct ndpi_int_one_line_struct unix_line[NDPI_MAX_PARSE_LINES_PER_PACKET];
struct ndpi_int_one_line_struct host_line;
struct ndpi_int_one_line_struct referer_line;
struct ndpi_int_one_line_struct content_line;
struct ndpi_int_one_line_struct accept_line;
struct ndpi_int_one_line_struct user_agent_line;
struct ndpi_int_one_line_struct http_url_name;
struct ndpi_int_one_line_struct http_encoding;
struct ndpi_int_one_line_struct http_transfer_encoding;
struct ndpi_int_one_line_struct http_contentlen;
struct ndpi_int_one_line_struct http_cookie;
struct ndpi_int_one_line_struct http_x_session_type;
struct ndpi_int_one_line_struct server_line;
struct ndpi_int_one_line_struct http_method;
struct ndpi_int_one_line_struct http_response;
u_int16_t l3_packet_len;
u_int16_t l4_packet_len;
u_int16_t payload_packet_len;
u_int16_t actual_payload_len;
u_int16_t num_retried_bytes;
u_int16_t parsed_lines;
u_int16_t parsed_unix_lines;
u_int16_t empty_line_position;
u_int8_t tcp_retransmission;
u_int8_t l4_protocol;
u_int8_t packet_lines_parsed_complete;
u_int8_t packet_unix_lines_parsed_complete;
u_int8_t empty_line_position_set;
u_int8_t packet_direction:1;
u_int8_t ssl_certificate_detected:4, ssl_certificate_num_checks:4;
} ndpi_packet_struct_t;
struct ndpi_detection_module_struct;
struct ndpi_flow_struct;
typedef struct ndpi_call_function_struct {
NDPI_PROTOCOL_BITMASK detection_bitmask;
NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask;
NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_bitmask;
void (*func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow);
u_int8_t detection_feature;
} ndpi_call_function_struct_t;
typedef struct ndpi_subprotocol_conf_struct {
void (*func) (struct ndpi_detection_module_struct *, char *attr, char *value, int protocol_id);
} ndpi_subprotocol_conf_struct_t;
#define MAX_DEFAULT_PORTS 5
typedef struct {
u_int16_t port_low, port_high;
} ndpi_port_range;
/* ntop extensions */
typedef struct ndpi_proto_defaults {
char *protoName;
u_int16_t protoId;
} ndpi_proto_defaults_t;
typedef struct ndpi_default_ports_tree_node {
ndpi_proto_defaults_t *proto;
u_int16_t default_port;
} ndpi_default_ports_tree_node_t;
typedef struct ndpi_detection_module_struct {
NDPI_PROTOCOL_BITMASK detection_bitmask;
NDPI_PROTOCOL_BITMASK generic_http_packet_bitmask;
u_int32_t current_ts;
u_int32_t ticks_per_second;
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
void *user_data;
#endif
/* callback function buffer */
struct ndpi_call_function_struct callback_buffer[NDPI_MAX_SUPPORTED_PROTOCOLS + 1];
u_int32_t callback_buffer_size;
struct ndpi_call_function_struct callback_buffer_tcp_no_payload[NDPI_MAX_SUPPORTED_PROTOCOLS + 1];
u_int32_t callback_buffer_size_tcp_no_payload;
struct ndpi_call_function_struct callback_buffer_tcp_payload[NDPI_MAX_SUPPORTED_PROTOCOLS + 1];
u_int32_t callback_buffer_size_tcp_payload;
struct ndpi_call_function_struct callback_buffer_udp[NDPI_MAX_SUPPORTED_PROTOCOLS + 1];
u_int32_t callback_buffer_size_udp;
struct ndpi_call_function_struct callback_buffer_non_tcp_udp[NDPI_MAX_SUPPORTED_PROTOCOLS + 1];
u_int32_t callback_buffer_size_non_tcp_udp;
ndpi_default_ports_tree_node_t *tcpRoot, *udpRoot;
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
/* debug callback, only set when debug is used */
ndpi_debug_function_ptr ndpi_debug_printf;
const char *ndpi_debug_print_file;
const char *ndpi_debug_print_function;
u_int32_t ndpi_debug_print_line;
#endif
/* misc parameters */
u_int32_t tcp_max_retransmission_window_size;
u_int32_t edonkey_upper_ports_only:1;
u_int32_t edonkey_safe_mode:1;
u_int32_t directconnect_connection_ip_tick_timeout;
/* subprotocol registration handler */
struct ndpi_subprotocol_conf_struct subprotocol_conf[NDPI_MAX_SUPPORTED_PROTOCOLS + 1];
u_int ndpi_num_supported_protocols;
u_int ndpi_num_custom_protocols;
/* HTTP (and soon DNS) host matching */
void *ac_automa; /* Real type is AC_AUTOMATA_t */
u_int8_t ac_automa_finalized;
/* pplive params */
u_int32_t pplive_connection_timeout;
/* ftp parameters */
u_int32_t ftp_connection_timeout;
/* irc parameters */
u_int32_t irc_timeout;
/* gnutella parameters */
u_int32_t gnutella_timeout;
/* battlefield parameters */
u_int32_t battlefield_timeout;
/* thunder parameters */
u_int32_t thunder_timeout;
/* SoulSeek parameters */
u_int32_t soulseek_connection_ip_tick_timeout;
/* rtsp parameters */
u_int32_t rtsp_connection_timeout;
/* tvants parameters */
u_int32_t tvants_connection_timeout;
u_int32_t orb_rstp_ts_timeout;
/* yahoo */
// u_int32_t yahoo_http_filetransfer_timeout;
u_int8_t yahoo_detect_http_connections;
u_int32_t yahoo_lan_video_timeout;
u_int32_t zattoo_connection_timeout;
u_int32_t jabber_stun_timeout;
u_int32_t jabber_file_transfer_timeout;
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
#define NDPI_IP_STRING_SIZE 40
char ip_string[NDPI_IP_STRING_SIZE];
#endif
u_int8_t ip_version_limit;
/* Cache */
NDPI_REDIS redis;
/* Skype (we need a lock as this cache can be accessed concurrently) */
struct ndpi_LruCache skypeCache;
#ifndef __KERNEL__
pthread_mutex_t skypeCacheLock;
#else
spinlock_t skypeCacheLock;
#endif
/* ********************* */
ndpi_proto_defaults_t proto_defaults[NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS];
u_int8_t match_dns_host_names:1;
} ndpi_detection_module_struct_t;
typedef struct ndpi_flow_struct {
u_int16_t detected_protocol_stack[NDPI_PROTOCOL_HISTORY_SIZE];
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
# if NDPI_PROTOCOL_HISTORY_SIZE > 5
# error protocol stack size not supported
# endif
struct {
u_int8_t entry_is_real_protocol:5;
u_int8_t current_stack_size_minus_one:3;
}
#if !defined(WIN32)
__attribute__ ((__packed__))
#endif
protocol_stack_info;
#endif
/* init parameter, internal used to set up timestamp,... */
u_int8_t init_finished:1;
u_int8_t setup_packet_direction:1;
/* tcp sequence number connection tracking */
u_int32_t next_tcp_seq_nr[2];
/* the tcp / udp / other l4 value union
* this is used to reduce the number of bytes for tcp or udp protocol states
* */
union {
struct ndpi_flow_tcp_struct tcp;
struct ndpi_flow_udp_struct udp;
} l4;
u_char host_server_name[256]; /* HTTP host or DNS query */
u_char detected_os[32]; /* Via HTTP User-Agent */
union {
struct {
u_int8_t num_queries, num_answer_rrs;
u_int16_t query_type, query_class;
} dns;
} protos;
/* ALL protocol specific 64 bit variables here */
/* protocols which have marked a connection as this connection cannot be protocol XXX, multiple u_int64_t */
NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask;
#if 0
#ifdef NDPI_PROTOCOL_RTP
u_int32_t rtp_ssid[2];
u_int16_t rtp_seqnum[2]; /* current highest sequence number (only goes forwards, is not decreased by retransmissions) */
/* tcp and udp */
u_int8_t rtp_payload_type[2];
u_int32_t rtp_stage1:2; //0-3
u_int32_t rtp_stage2:2;
#endif
#endif
u_int16_t packet_counter; // can be 0-65000
u_int16_t packet_direction_counter[2];
u_int16_t byte_counter[2];
#ifdef NDPI_PROTOCOL_BITTORRENT
u_int8_t bittorrent_stage; // can be 0-255
#endif
#ifdef NDPI_PROTOCOL_EDONKEY
u_int32_t edk_stage:5; // 0-17
#endif
#ifdef NDPI_PROTOCOL_DIRECTCONNECT
u_int32_t directconnect_stage:2; // 0-1
#endif
#ifdef NDPI_PROTOCOL_SIP
#ifdef NDPI_PROTOCOL_YAHOO
u_int32_t sip_yahoo_voice:1;
#endif
#endif
#ifdef NDPI_PROTOCOL_HTTP
u_int32_t http_detected:1;
#endif // NDPI_PROTOCOL_HTTP
#ifdef NDPI_PROTOCOL_RTSP
u_int32_t rtsprdt_stage:2;
u_int32_t rtsp_control_flow:1;
#endif
#ifdef NDPI_PROTOCOL_YAHOO
u_int32_t yahoo_detection_finished:2;
#endif
#ifdef NDPI_PROTOCOL_PPLIVE
u_int32_t pplive_stage:3; // 0-7
#endif
#ifdef NDPI_PROTOCOL_ZATTOO
u_int32_t zattoo_stage:3;
#endif
#ifdef NDPI_PROTOCOL_QQ
u_int32_t qq_stage:3;
#endif
#ifdef NDPI_PROTOCOL_THUNDER
u_int32_t thunder_stage:2; // 0-3
#endif
#ifdef NDPI_PROTOCOL_OSCAR
u_int32_t oscar_ssl_voice_stage:3;
u_int32_t oscar_video_voice:1;
#endif
#ifdef NDPI_PROTOCOL_FLORENSIA
u_int32_t florensia_stage:1;
#endif
/* internal structures to save functions calls */
struct ndpi_packet_struct packet;
struct ndpi_flow_struct *flow;
struct ndpi_id_struct *src;
struct ndpi_id_struct *dst;
} ndpi_flow_struct_t;
#endif /* __NDPI_STRUCTS_INCLUDE_FILE__ */
ndpi-1.4.0+svn6932/src/include/linux_compat.h 0000644 0001750 0001750 00000010023 12167754717 020516 0 ustar cavedon cavedon /*
* linux_compat.h
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_LINUX_COMPAT_H__
#define __NDPI_LINUX_COMPAT_H__
#include "ndpi_define.h"
#if defined(__FreeBSD__) || defined(__NetBSD__)
#include
#if _BYTE_ORDER == _LITTLE_ENDIAN
#define __LITTLE_ENDIAN__ 1
#else
#define __BIG_ENDIAN__ 1
#endif
#endif
#pragma pack(push, 1) /* push current alignment to stack */
#pragma pack(1) /* set alignment to 1 byte boundary */
#pragma pack(pop) /* restore original alignment from stack */
struct ndpi_ethhdr {
u_char h_dest[6]; /* destination eth addr */
u_char h_source[6]; /* source ether addr */
u_int16_t h_proto; /* packet type ID field */
};
struct ndpi_80211q {
u_int16_t vlanId;
u_int16_t protoType;
};
struct ndpi_iphdr {
#if defined(__LITTLE_ENDIAN__)
u_int8_t ihl:4, version:4;
#elif defined(__BIG_ENDIAN__)
u_int8_t version:4, ihl:4;
#else
# error "Byte order must be defined"
#endif
u_int8_t tos;
u_int16_t tot_len;
u_int16_t id;
u_int16_t frag_off;
u_int8_t ttl;
u_int8_t protocol;
u_int16_t check;
u_int32_t saddr;
u_int32_t daddr;
};
#ifdef WIN32
typedef unsigned char u_char;
typedef unsigned short u_short;
typedef unsigned int uint;
typedef unsigned long u_long;
typedef u_char u_int8_t;
typedef u_short u_int16_t;
typedef uint u_int32_t;
#define _WS2TCPIP_H_ /* Avoid compilation problems */
#define HAVE_SIN6_LEN
/* IPv6 address */
/* Already defined in WS2tcpip.h */
struct ndpi_win_in6_addr
{
union
{
u_int8_t u6_addr8[16];
u_int16_t u6_addr16[8];
u_int32_t u6_addr32[4];
} in6_u;
#ifdef s6_addr
#undef s6_addr
#endif
#ifdef s6_addr16
#undef s6_addr16
#endif
#ifdef s6_addr32
#undef s6_addr32
#endif
#define s6_addr in6_u.u6_addr8
// #define s6_addr16 in6_u.u6_addr16
// #define s6_addr32 in6_u.u6_addr32
};
#define in6_addr win_in6_addr
/* Generic extension header. */
struct ndpi_ip6_ext
{
u_int8_t ip6e_nxt; /* next header. */
u_int8_t ip6e_len; /* length in units of 8 octets. */
};
#define s6_addr16 __u6_addr.__u6_addr16
#define s6_addr32 __u6_addr.__u6_addr32
#else
#ifndef __KERNEL__
#include
#endif
#endif
struct ndpi_in6_addr {
union {
u_int8_t __u6_addr8[16];
u_int16_t __u6_addr16[8];
u_int32_t __u6_addr32[4];
} __u6_addr; /* 128-bit IP6 address */
};
struct ndpi_ip6_hdr {
union {
struct ndpi_ip6_hdrctl {
u_int32_t ip6_un1_flow;
u_int16_t ip6_un1_plen;
u_int8_t ip6_un1_nxt;
u_int8_t ip6_un1_hlim;
} ip6_un1;
u_int8_t ip6_un2_vfc;
} ip6_ctlun;
struct ndpi_in6_addr ip6_src;
struct ndpi_in6_addr ip6_dst;
};
struct ndpi_tcphdr {
u_int16_t source;
u_int16_t dest;
u_int32_t seq;
u_int32_t ack_seq;
#if defined(__LITTLE_ENDIAN__)
u_int16_t res1:4, doff:4, fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1;
#elif defined(__BIG_ENDIAN__)
u_int16_t doff:4, res1:4, cwr:1, ece:1, urg:1, ack:1, psh:1, rst:1, syn:1, fin:1;
#else
# error "Byte order must be defined"
#endif
u_int16_t window;
u_int16_t check;
u_int16_t urg_ptr;
};
struct ndpi_udphdr {
u_int16_t source;
u_int16_t dest;
u_int16_t len;
u_int16_t check;
};
#endif
ndpi-1.4.0+svn6932/src/include/Makefile.am 0000644 0001750 0001750 00000000334 12031776146 017671 0 ustar cavedon cavedon
library_includedir=$(includedir)/libndpi-1.4/libndpi
library_include_HEADERS = ndpi_api.h \
ndpi_debug_functions.h \
ndpi_define.h \
ndpi_macros.h \
ndpi_protocols_osdpi.h \
ndpi_public_functions.h
ndpi-1.4.0+svn6932/src/include/ndpi_api.h 0000644 0001750 0001750 00000002775 12032001736 017567 0 ustar cavedon cavedon /*
* ndpi_api.h
* Copyright (C) 2009-2011 by ipoque GmbH
*
* This file is part of OpenDPI, an open source deep packet inspection
* library based on the PACE technology by ipoque GmbH
*
* OpenDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* OpenDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with OpenDPI. If not, see .
*
*/
#ifndef __NDPI_API_INCLUDE_FILE__
#define __NDPI_API_INCLUDE_FILE__
#if defined(WIN32)
#include
/* Windows is little endian */
#define __LITTLE_ENDIAN 1234
#define __BIG_ENDIAN 4321
#define __BYTE_ORDER __LITTLE_ENDIAN
#define __FLOAT_WORD_ORDER __BYTE_ORDER
#endif /* defined(WIN32) */
#ifdef __cplusplus
extern "C" {
#endif
/* basic definitions (u_int64_t, u_int32_t, timestamp size,...) */
#include "ndpi_protocols_osdpi.h"
/* macros for protocol / bitmask conversation if needed */
#include "ndpi_macros.h"
#include "ndpi_public_functions.h"
#include "ndpi_debug_functions.h"
#ifdef __cplusplus
}
#endif
#endif /* __NDPI_API_INCLUDE_FILE__ */
ndpi-1.4.0+svn6932/src/include/ndpi_credis.h 0000644 0001750 0001750 00000043754 12156710576 020311 0 ustar cavedon cavedon /* ndpi_credis.h -- a C client library for Redis, public API.
*
* Copyright (c) 2009-2010, Jonas Romfelt
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* * Redistributions of source code must retain the above copyright notice,
* this list of conditions and the following disclaimer.
* * Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* * Neither the name of Ndpi_Credis nor the names of its contributors may be used
* to endorse or promote products derived from this software without
* specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
* LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
#ifndef __NDPI_NDPI_CREDIS_H
#define __NDPI_NDPI_CREDIS_H
#ifdef __cplusplus
extern "C" {
#endif
/*
* Functions list below is modelled after the Redis Command Reference (except
* for the ndpi_credis_connect() and ndpi_credis_close() functions), use this reference
* for further descriptions of each command:
*
* http://code.google.com/p/redis/wiki/CommandReference
*
* Comments are only available when it is not obvious how Ndpi_Credis implements
* the Redis command. In general, functions return 0 on success or a negative
* value on error. Refer to NDPI_NDPI_CREDIS_ERR_* codes. The return code -1 is
* typically used when for instance a key is not found.
*
* IMPORTANT! Memory buffers are allocated, used and managed by ndpi_credis
* internally. Subsequent calls to ndpi_credis functions _will_ destroy the data
* to which returned values reference to. If for instance the returned value
* by a call to ndpi_credis_get() is to be used later in the program, a strdup()
* is highly recommended. However, each `REDIS' handle has its own state and
* manages its own memory buffers independently. That means that one of two
* handles can be destroyed while the other keeps its connection and data.
*
* EXAMPLE
*
* Connect to a Redis server and set value of key `fruit' to `banana':
*
* NDPI_REDIS rh = ndpi_credis_connect("localhost", 6789, 2000);
* ndpi_credis_set(rh, "fruit", "banana");
* ndpi_credis_close(rh);
*
* TODO
*
* - Add support for missing Redis commands marked as TODO below
* - Currently only support for zero-terminated strings, not for storing
* abritary binary data as bulk data. Basically an API issue since it is
* partially supported internally.
* - Test
*/
/* handle to a Redis server connection */
typedef struct _cr_redis* NDPI_REDIS;
#define NDPI_CREDIS_OK 0
#define NDPI_CREDIS_ERR -90
#define NDPI_CREDIS_ERR_NOMEM -91
#define NDPI_CREDIS_ERR_RESOLVE -92
#define NDPI_CREDIS_ERR_CONNECT -93
#define NDPI_CREDIS_ERR_SEND -94
#define NDPI_CREDIS_ERR_RECV -95
#define NDPI_CREDIS_ERR_TIMEOUT -96
#define NDPI_CREDIS_ERR_PROTOCOL -97
#define NDPI_CREDIS_TYPE_NONE 1
#define NDPI_CREDIS_TYPE_STRING 2
#define NDPI_CREDIS_TYPE_LIST 3
#define NDPI_CREDIS_TYPE_SET 4
#define NDPI_CREDIS_SERVER_MASTER 1
#define NDPI_CREDIS_SERVER_SLAVE 2
typedef enum _ndpi_cr_aggregate {
NDPI_NONE,
NDPI_SUM,
NDPI_MIN,
NDPI_MAX
} NDPI_REDIS_AGGREGATE;
#define NDPI_CREDIS_VERSION_STRING_SIZE 32
#define NDPI_CREDIS_MULTIPLEXING_API_SIZE 16
#define NDPI_CREDIS_USED_MEMORY_HUMAN_SIZE 32
typedef struct _ndpi_cr_info {
char redis_version[NDPI_CREDIS_VERSION_STRING_SIZE];
int arch_bits;
char multiplexing_api[NDPI_CREDIS_MULTIPLEXING_API_SIZE];
long process_id;
long uptime_in_seconds;
long uptime_in_days;
int connected_clients;
int connected_slaves;
int blocked_clients;
unsigned long used_memory;
char used_memory_human[NDPI_CREDIS_USED_MEMORY_HUMAN_SIZE];
long long changes_since_last_save;
int bgsave_in_progress;
long last_save_time;
int bgrewriteaof_in_progress;
long long total_connections_received;
long long total_commands_processed;
long long expired_keys;
unsigned long hash_max_zipmap_entries;
unsigned long hash_max_zipmap_value;
long pubsub_channels;
unsigned int pubsub_patterns;
int vm_enabled;
int role;
} NDPI_REDIS_INFO;
/*
* Connection handling
*/
/* `host' is the host to connect to, either as an host name or a IP address,
* if set to NULL connection is made to "localhost". `port' is the TCP port
* that Redis is listening to, set to 0 will use default port (6379).
* `timeout' is the time in milliseconds to use as timeout, when connecting
* to a Redis server and waiting for reply, it can be changed after a
* connection has been made using ndpi_credis_settimeout() */
NDPI_REDIS ndpi_credis_connect(const char *host, int port, int timeout);
/* set Redis server reply `timeout' in millisecs */
void ndpi_credis_settimeout(NDPI_REDIS rhnd, int timeout);
void ndpi_credis_close(NDPI_REDIS rhnd);
void ndpi_credis_quit(NDPI_REDIS rhnd);
int ndpi_credis_auth(NDPI_REDIS rhnd, const char *password);
int ndpi_credis_ping(NDPI_REDIS rhnd);
/* if a function call returns error it is _possible_ that the Redis server
* replied with an error message. It is returned by this function. */
char* ndpi_credis_errorreply(NDPI_REDIS rhnd);
/*
* Commands operating on all the kind of values
*/
/* returns -1 if the key doesn't exists and 0 if it does */
int ndpi_credis_exists(NDPI_REDIS rhnd, const char *key);
/* returns -1 if the key doesn't exists and 0 if it was removed
* TODO add support to (Redis >= 1.1) remove multiple keys
*/
int ndpi_credis_del(NDPI_REDIS rhnd, const char *key);
/* returns type, refer to NDPI_CREDIS_TYPE_* defines */
int ndpi_credis_type(NDPI_REDIS rhnd, const char *key);
/* returns number of keys returned in vector `keyv' */
int ndpi_credis_keys(NDPI_REDIS rhnd, const char *pattern, char ***keyv);
int ndpi_credis_randomkey(NDPI_REDIS rhnd, char **key);
int ndpi_credis_rename(NDPI_REDIS rhnd, const char *key, const char *new_key_name);
/* returns -1 if the key already exists */
int ndpi_credis_renamenx(NDPI_REDIS rhnd, const char *key, const char *new_key_name);
/* returns size of db */
int ndpi_credis_dbsize(NDPI_REDIS rhnd);
/* returns -1 if the timeout was not set; either due to key already has
an associated timeout or key does not exist */
int ndpi_credis_expire(NDPI_REDIS rhnd, const char *key, int secs);
/* returns time to live seconds or -1 if key does not exists or does not
* have expire set */
int ndpi_credis_ttl(NDPI_REDIS rhnd, const char *key);
int ndpi_credis_select(NDPI_REDIS rhnd, int index);
/* returns -1 if the key was not moved; already present at target
* or not found on current db */
int ndpi_credis_move(NDPI_REDIS rhnd, const char *key, int index);
int ndpi_credis_flushdb(NDPI_REDIS rhnd);
int ndpi_credis_flushall(NDPI_REDIS rhnd);
/*
* Commands operating on string values
*/
int ndpi_credis_set(NDPI_REDIS rhnd, const char *key, const char *val);
/* returns -1 if the key doesn't exists */
int ndpi_credis_get(NDPI_REDIS rhnd, const char *key, char **val);
/* returns -1 if the key doesn't exists */
int ndpi_credis_getset(NDPI_REDIS rhnd, const char *key, const char *set_val, char **get_val);
/* returns number of values returned in vector `valv'. `keyc' is the number of
* keys stored in `keyv'. */
int ndpi_credis_mget(NDPI_REDIS rhnd, int keyc, const char **keyv, char ***valv);
/* returns -1 if the key already exists and hence not set */
int ndpi_credis_setnx(NDPI_REDIS rhnd, const char *key, const char *val);
/* TODO
* SETEX key time value Set+Expire combo command
* MSET key1 value1 key2 value2 ... keyN valueN set a multiple keys to multiple values in a single atomic operation
* MSETNX key1 value1 key2 value2 ... keyN valueN set a multiple keys to multiple values in a single atomic operation if none of
*/
/* if `new_val' is not NULL it will return the value after the increment was performed */
int ndpi_credis_incr(NDPI_REDIS rhnd, const char *key, int *new_val);
/* if `new_val' is not NULL it will return the value after the increment was performed */
int ndpi_credis_incrby(NDPI_REDIS rhnd, const char *key, int incr_val, int *new_val);
/* if `new_val' is not NULL it will return the value after the decrement was performed */
int ndpi_credis_decr(NDPI_REDIS rhnd, const char *key, int *new_val);
/* if `new_val' is not NULL it will return the value after the decrement was performed */
int ndpi_credis_decrby(NDPI_REDIS rhnd, const char *key, int decr_val, int *new_val);
/* returns new length of string after `val' has been appended */
int ndpi_credis_append(NDPI_REDIS rhnd, const char *key, const char *val);
int ndpi_credis_substr(NDPI_REDIS rhnd, const char *key, int start, int end, char **substr);
/*
* Commands operating on lists
*/
int ndpi_credis_rpush(NDPI_REDIS rhnd, const char *key, const char *element);
int ndpi_credis_rpushx(NDPI_REDIS rhnd, const char *key, const char *element); /* ntop */
int ndpi_credis_lpush(NDPI_REDIS rhnd, const char *key, const char *element);
/* returns length of list */
int ndpi_credis_llen(NDPI_REDIS rhnd, const char *key);
/* returns number of elements returned in vector `elementv' */
int ndpi_credis_lrange(NDPI_REDIS rhnd, const char *key, int start, int range, char ***elementv);
int ndpi_credis_ltrim(NDPI_REDIS rhnd, const char *key, int start, int end);
/* returns -1 if the key doesn't exists */
int ndpi_credis_lindex(NDPI_REDIS rhnd, const char *key, int index, char **element);
int ndpi_credis_lset(NDPI_REDIS rhnd, const char *key, int index, const char *element);
/* returns number of elements removed */
int ndpi_credis_lrem(NDPI_REDIS rhnd, const char *key, int count, const char *element);
/* returns -1 if the key doesn't exists */
int ndpi_credis_lpop(NDPI_REDIS rhnd, const char *key, char **val);
/* returns -1 if the key doesn't exists */
int ndpi_credis_rpop(NDPI_REDIS rhnd, const char *key, char **val);
/* TODO
* BLPOP key1 key2 ... keyN timeout Blocking LPOP
* BRPOP key1 key2 ... keyN timeout Blocking RPOP
* RPOPLPUSH srckey dstkey Return and remove (atomically) the last element of the source List stored at _srckey_ and push the same element to the destination List stored at _dstkey_
*/
/*
* Commands operating on sets
*/
/* returns -1 if the given member was already a member of the set */
int ndpi_credis_sadd(NDPI_REDIS rhnd, const char *key, const char *member);
/* returns -1 if the given member is not a member of the set */
int ndpi_credis_srem(NDPI_REDIS rhnd, const char *key, const char *member);
/* returns -1 if the given key doesn't exists else value is returned in `member' */
int ndpi_credis_spop(NDPI_REDIS rhnd, const char *key, char **member);
/* returns -1 if the member doesn't exists in the source set */
int ndpi_credis_smove(NDPI_REDIS rhnd, const char *sourcekey, const char *destkey,
const char *member);
/* returns cardinality (number of members) or 0 if the given key doesn't exists */
int ndpi_credis_scard(NDPI_REDIS rhnd, const char *key);
/* returns -1 if the key doesn't exists and 0 if it does */
int ndpi_credis_sismember(NDPI_REDIS rhnd, const char *key, const char *member);
/* returns number of members returned in vector `members'. `keyc' is the number of
* keys stored in `keyv'. */
int ndpi_credis_sinter(NDPI_REDIS rhnd, int keyc, const char **keyv, char ***members);
/* `keyc' is the number of keys stored in `keyv' */
int ndpi_credis_sinterstore(NDPI_REDIS rhnd, const char *destkey, int keyc, const char **keyv);
/* returns number of members returned in vector `members'. `keyc' is the number of
* keys stored in `keyv'. */
int ndpi_credis_sunion(NDPI_REDIS rhnd, int keyc, const char **keyv, char ***members);
/* `keyc' is the number of keys stored in `keyv' */
int ndpi_credis_sunionstore(NDPI_REDIS rhnd, const char *destkey, int keyc, const char **keyv);
/* returns number of members returned in vector `members'. `keyc' is the number of
* keys stored in `keyv'. */
int ndpi_credis_sdiff(NDPI_REDIS rhnd, int keyc, const char **keyv, char ***members);
/* `keyc' is the number of keys stored in `keyv' */
int ndpi_credis_sdiffstore(NDPI_REDIS rhnd, const char *destkey, int keyc, const char **keyv);
/* returns number of members returned in vector `members' */
int ndpi_credis_smembers(NDPI_REDIS rhnd, const char *key, char ***members);
/* TODO Redis >= 1.1
* SRANDMEMBER key Return a random member of the Set value at key
*/
/*
* Commands operating on sorted sets
*/
/* returns -1 if member was already a member of the sorted set and only score was updated,
* 0 is returned if the new element was added */
int ndpi_credis_zadd(NDPI_REDIS rhnd, const char *key, double score, const char *member);
/* returns -1 if the member was not a member of the sorted set */
int ndpi_credis_zrem(NDPI_REDIS rhnd, const char *key, const char *member);
/* returns -1 if the member was not a member of the sorted set, the score of the member after
* the increment by `incr_score' is returned by `new_score' */
int ndpi_credis_zincrby(NDPI_REDIS rhnd, const char *key, double incr_score, const char *member, double *new_score);
/* returns the rank of the given member or -1 if the member was not a member of the sorted set */
int ndpi_credis_zrank(NDPI_REDIS rhnd, const char *key, const char *member);
/* returns the reverse rank of the given member or -1 if the member was not a member of the sorted set */
int ndpi_credis_zrevrank(NDPI_REDIS rhnd, const char *key, const char *member);
/* returns number of elements returned in vector `elementv'
* TODO add support for WITHSCORES */
int ndpi_credis_zrange(NDPI_REDIS rhnd, const char *key, int start, int end, char ***elementv);
/* returns number of elements returned in vector `elementv'
* TODO add support for WITHSCORES */
int ndpi_credis_zrevrange(NDPI_REDIS rhnd, const char *key, int start, int end, char ***elementv);
/* returns cardinality or -1 if `key' does not exist */
int ndpi_credis_zcard(NDPI_REDIS rhnd, const char *key);
/* returns -1 if the `key' does not exist or the `member' is not in the sorted set,
* score is returned in `score' */
int ndpi_credis_zscore(NDPI_REDIS rhnd, const char *key, const char *member, double *score);
/* returns number of elements removed or -1 if key does not exist */
int ndpi_credis_zremrangebyscore(NDPI_REDIS rhnd, const char *key, double min, double max);
/* returns number of elements removed or -1 if key does not exist */
int ndpi_credis_zremrangebyrank(NDPI_REDIS rhnd, const char *key, int start, int end);
/* TODO
* ZRANGEBYSCORE key min max Return all the elements with score >= min and score <= max (a range query) from the sorted set
*/
/* `keyc' is the number of keys stored in `keyv'. `weightv' is optional, if not
* NULL, `keyc' is also the number of weights stored in `weightv'. */
int ndpi_credis_zinterstore(NDPI_REDIS rhnd, const char *destkey, int keyc, const char **keyv,
const int *weightv, NDPI_REDIS_AGGREGATE aggregate);
/* `keyc' is the number of keys stored in `keyv'. `weightv' is optional, if not
* NULL, `keyc' is also the number of weights stored in `weightv'. */
int ndpi_credis_zunionstore(NDPI_REDIS rhnd, const char *destkey, int keyc, const char **keyv,
const int *weightv, NDPI_REDIS_AGGREGATE aggregate);
/*
* Commands operating on hashes
*/
/* TODO
* HSET key field value Set the hash field to the specified value. Creates the hash if needed.
* HGET key field Retrieve the value of the specified hash field.
* HMSET key field1 value1 ... fieldN valueN Set the hash fields to their respective values.
* HINCRBY key field integer Increment the integer value of the hash at _key_ on _field_ with _integer_.
* HEXISTS key field Test for existence of a specified field in a hash
* HDEL key field Remove the specified field from a hash
* HLEN key Return the number of items in a hash.
* HKEYS key Return all the fields in a hash.
* HVALS key Return all the values in a hash.
* HGETALL key Return all the fields and associated values in a hash.
*/
/*
* Sorting
*/
/* returns number of elements returned in vector `elementv' */
int ndpi_credis_sort(NDPI_REDIS rhnd, const char *query, char ***elementv);
/*
* Transactions
*/
/* TODO
* MULTI/EXEC/DISCARD Redis atomic transactions
*/
/*
* Publish/Subscribe
*/
/* TODO
* SUBSCRIBE/UNSUBSCRIBE/PUBLISH Redis Public/Subscribe messaging paradigm implementation
*/
/*
* Persistence control commands
*/
int ndpi_credis_save(NDPI_REDIS rhnd);
int ndpi_credis_bgsave(NDPI_REDIS rhnd);
/* returns UNIX time stamp of last successfull save to disk */
int ndpi_credis_lastsave(NDPI_REDIS rhnd);
int ndpi_credis_shutdown(NDPI_REDIS rhnd);
int ndpi_credis_bgrewriteaof(NDPI_REDIS rhnd);
/*
* Remote server control commands
*/
/* Because the information returned by the Redis changes with virtually every
* major release, ndpi_credis tries to parse for as many fields as it is aware of,
* staying backwards (and forwards) compatible with older (and newer) versions
* of Redis.
* Information fields not supported by the Redis server connected to, are set
* to zero. */
int ndpi_credis_info(NDPI_REDIS rhnd, NDPI_REDIS_INFO *info);
int ndpi_credis_monitor(NDPI_REDIS rhnd);
/* setting host to NULL and/or port to 0 will turn off replication */
int ndpi_credis_slaveof(NDPI_REDIS rhnd, const char *host, int port);
/* TODO
* CONFIG Configure a Redis server at runtime
*/
#ifdef __cplusplus
}
#endif
#endif /* __NDPI_CREDIS_H */
ndpi-1.4.0+svn6932/src/include/ndpi_define.h 0000644 0001750 0001750 00000026614 12071253673 020262 0 ustar cavedon cavedon /*
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __NDPI_DEFINE_INCLUDE_FILE__
#define __NDPI_DEFINE_INCLUDE_FILE__
/*
gcc -E -dM - < /dev/null |grep ENDIAN
*/
#ifdef WIN32
#define __LITTLE_ENDIAN__ 1
#endif
#if !(defined(__LITTLE_ENDIAN__) || defined(__BIG_ENDIAN__))
/* Kernel modules */
#if defined(__LITTLE_ENDIAN)
#define __LITTLE_ENDIAN__
#endif
#if defined(__BIG_ENDIAN)
#define __BIG_ENDIAN__
#endif
/* Everything else */
#if (defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__))
#if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
#define __LITTLE_ENDIAN__
#else
#define __BIG_ENDIAN__
#endif
#endif
#endif
#define NDPI_USE_ASYMMETRIC_DETECTION 0
#define NDPI_SELECTION_BITMASK_PROTOCOL_SIZE u_int32_t
#define NDPI_SELECTION_BITMASK_PROTOCOL_IP (1<<0)
#define NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP (1<<1)
#define NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP (1<<2)
#define NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP (1<<3)
#define NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD (1<<4)
#define NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION (1<<5)
#define NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 (1<<6)
#define NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 (1<<7)
#define NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC (1<<8)
/* now combined detections */
/* v4 */
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP (NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP)
#define NDPI_SELECTION_BITMASK_PROTOCOL_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP)
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP)
/* v6 */
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP)
/* v4 or v6 */
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP)
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
/* does it make sense to talk about udp with payload ??? have you ever seen empty udp packets ? */
#define NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION)
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION)
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
#define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD)
/* safe src/dst protocol check macros... */
#define NDPI_SRC_HAS_PROTOCOL(src,protocol) ((src) != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK((src)->detected_protocol_bitmask,(protocol)) != 0)
#define NDPI_DST_HAS_PROTOCOL(dst,protocol) ((dst) != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK((dst)->detected_protocol_bitmask,(protocol)) != 0)
#define NDPI_SRC_OR_DST_HAS_PROTOCOL(src,dst,protocol) (NDPI_SRC_HAS_PROTOCOL(src,protocol) || NDPI_SRC_HAS_PROTOCOL(dst,protocol))
/**
* convenience macro to check for excluded protocol
* a protocol is excluded if the flow is known and either the protocol is not detected at all
* or the excluded bitmask contains the protocol
*/
#define NDPI_FLOW_PROTOCOL_EXCLUDED(ndpi_struct,flow,protocol) ((flow) != NULL && \
( NDPI_COMPARE_PROTOCOL_TO_BITMASK((ndpi_struct)->detection_bitmask, (protocol)) == 0 || \
NDPI_COMPARE_PROTOCOL_TO_BITMASK((flow)->excluded_protocol_bitmask, (protocol)) != 0 ) )
/* misc definitions */
#define NDPI_DEFAULT_MAX_TCP_RETRANSMISSION_WINDOW_SIZE 0x10000
/* TODO: rebuild all memory areas to have a more aligned memory block here */
/* DEFINITION OF MAX LINE NUMBERS FOR line parse algorithm */
#define NDPI_MAX_PARSE_LINES_PER_PACKET 200
/**********************
* detection features *
**********************/
#define NDPI_SELECT_DETECTION_WITH_REAL_PROTOCOL ( 1 << 0 )
#define NDPI_DIRECTCONNECT_CONNECTION_IP_TICK_TIMEOUT 600
#define NDPI_GADGADU_PEER_CONNECTION_TIMEOUT 120
#define NDPI_EDONKEY_UPPER_PORTS_ONLY 0
#define NDPI_FTP_CONNECTION_TIMEOUT 10
#define NDPI_PPLIVE_CONNECTION_TIMEOUT 120
#define NDPI_IRC_CONNECTION_TIMEOUT 120
#define NDPI_GNUTELLA_CONNECTION_TIMEOUT 60
#define NDPI_BATTLEFIELD_CONNECTION_TIMEOUT 60
#define NDPI_THUNDER_CONNECTION_TIMEOUT 30
#define NDPI_RTSP_CONNECTION_TIMEOUT 5
#define NDPI_TVANTS_CONNECTION_TIMEOUT 5
#define NDPI_YAHOO_DETECT_HTTP_CONNECTIONS 1
#define NDPI_YAHOO_LAN_VIDEO_TIMEOUT 30
#define NDPI_ZATTOO_CONNECTION_TIMEOUT 120
#define NDPI_ZATTOO_FLASH_TIMEOUT 5
#define NDPI_JABBER_STUN_TIMEOUT 30
#define NDPI_JABBER_FT_TIMEOUT 5
#define NDPI_SOULSEEK_CONNECTION_IP_TICK_TIMEOUT 600
#define NDPI_MANOLITO_SUBSCRIBER_TIMEOUT 120
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
#define NDPI_LOG_BITTORRENT(proto, mod, log_level, args...) \
NDPI_LOG(proto,mod,log_level,args)
#define NDPI_LOG_GNUTELLA(proto, mod, log_level, args...) \
NDPI_LOG(proto,mod,log_level,args)
#define NDPI_LOG_EDONKEY(proto, mod, log_level, args...) \
NDPI_LOG(proto,mod,log_level,args)
#define NDPI_LOG(proto, mod, log_level, args...) \
{ \
if(mod != NULL) { \
mod->ndpi_debug_print_file=__FILE__; \
mod->ndpi_debug_print_function=__FUNCTION__; \
mod->ndpi_debug_print_line=__LINE__; \
mod->ndpi_debug_printf(proto, mod, log_level, args); \
} \
}
#else /* NDPI_ENABLE_DEBUG_MESSAGES */
#if defined(WIN32)
#define NDPI_LOG_BITTORRENT(...) {}
#define NDPI_LOG_GNUTELLA(...) {}
#define NDPI_LOG_EDONKEY(...) {}
#define NDPI_LOG(...) {}
#else
#define NDPI_LOG_BITTORRENT(proto, mod, log_level, args...) {}
#define NDPI_LOG_GNUTELLA(proto, mod, log_level, args...) {}
#define NDPI_LOG_EDONKEY(proto, mod, log_level, args...) {}
#define NDPI_LOG(proto, mod, log_level, args...) {}
#endif
#endif /* NDPI_ENABLE_DEBUG_MESSAGES */
/**
* macro for getting the string len of a static string
*
* use it instead of strlen to avoid runtime calculations
*/
#define NDPI_STATICSTRING_LEN( s ) ( sizeof( s ) - 1 )
/** macro to compare 2 IPv6 addresses with each other to identify the "smaller" IPv6 address */
#define NDPI_COMPARE_IPV6_ADDRESS_STRUCTS(x,y) \
((((u_int64_t *)(x))[0]) < (((u_int64_t *)(y))[0]) || ( (((u_int64_t *)(x))[0]) == (((u_int64_t *)(y))[0]) && (((u_int64_t *)(x))[1]) < (((u_int64_t *)(y))[1])) )
#endif /* __NDPI_DEFINE_INCLUDE_FILE__ */
ndpi-1.4.0+svn6932/src/lib/ 0000755 0001750 0001750 00000000000 12240352355 014752 5 ustar cavedon cavedon ndpi-1.4.0+svn6932/src/lib/Makefile.am 0000644 0001750 0001750 00000007013 12224215564 017011 0 ustar cavedon cavedon lib_LTLIBRARIES = libndpi.la
noinst_HEADERS = ../include/ndpi_main.h \
../include/ndpi_protocol_history.h \
../include/ndpi_protocols.h \
../include/ndpi_structs.h \
../include/ndpi_utils.h \
../include/linux_compat.h
# this will create a library 1.4.0
LIB_AC=1
LIB_REV=4
LIB_ANC=0
# ntop
AM_CFLAGS=-fPIC @PLATFORM_DEPENDENT@
libndpi_la_CPPFLAGS = -I$(top_srcdir)/src/include/ -I$(top_srcdir)/src/lib/third_party/include/
libndpi_la_LDFLAGS=-version-info ${LIB_AC}:${LIB_REV}:${LIB_ANC}
libndpi_la_SOURCES = \
third_party/src/ahocorasick.c \
third_party/src/node.c \
third_party/src/sort.c \
ndpi_main.c \
protocols/afp.c \
protocols/aimini.c \
protocols/applejuice.c \
protocols/armagetron.c \
protocols/battlefield.c \
protocols/bgp.c \
protocols/bittorrent.c \
protocols/crossfire.c \
protocols/dhcp.c \
protocols/dhcpv6.c \
protocols/directconnect.c \
protocols/directdownloadlink.c \
protocols/dns.c \
protocols/dofus.c \
protocols/edonkey.c \
protocols/fasttrack.c \
protocols/fiesta.c \
protocols/filetopia.c \
protocols/flash.c \
protocols/florensia.c \
protocols/ftp.c \
protocols/gnutella.c \
protocols/guildwars.c \
protocols/halflife2_and_mods.c \
protocols/http_activesync.c \
protocols/http.c \
protocols/iax.c \
protocols/icecast.c \
protocols/imesh.c \
protocols/ipp.c \
protocols/irc.c \
protocols/jabber.c \
protocols/kerberos.c \
protocols/kontiki.c \
protocols/ldap.c \
protocols/mail_imap.c \
protocols/mail_pop.c \
protocols/mail_smtp.c \
protocols/vmware.c \
protocols/maplestory.c \
protocols/mdns.c \
protocols/meebo.c \
protocols/mgcp.c \
protocols/mms.c \
protocols/msn.c \
protocols/mssql.c \
protocols/mysql.c \
protocols/netbios.c \
protocols/nfs.c \
protocols/non_tcp_udp.c \
protocols/tcp_udp.c \
protocols/ntp.c \
protocols/openft.c \
protocols/oscar.c \
protocols/pcanywhere.c \
protocols/popo.c \
protocols/postgres.c \
protocols/pplive.c \
protocols/ppstream.c \
protocols/pptp.c \
protocols/qq.c \
protocols/quake.c \
protocols/rdp.c \
protocols/rtp.c \
protocols/rtsp.c \
protocols/shoutcast.c \
protocols/sip.c \
protocols/smb.c \
protocols/snmp.c \
protocols/socrates.c \
protocols/sopcast.c \
protocols/soulseek.c \
protocols/spotify.c \
protocols/ssdp.c \
protocols/ssh.c \
protocols/ssl.c \
protocols/stealthnet.c \
protocols/steam.c \
protocols/stun.c \
protocols/syslog.c \
protocols/tds.c \
protocols/telnet.c \
protocols/tftp.c \
protocols/thunder.c \
protocols/tvants.c \
protocols/tvuplayer.c \
protocols/usenet.c \
protocols/veohtv.c \
protocols/vnc.c \
protocols/warcraft3.c \
protocols/winmx.c \
protocols/world_of_kung_fu.c \
protocols/world_of_warcraft.c \
protocols/xbox.c \
protocols/xdmcp.c \
protocols/yahoo.c \
protocols/zattoo.c \
protocols/dropbox.c \
protocols/skype.c \
protocols/citrix.c \
protocols/dcerpc.c \
protocols/netflow.c \
protocols/sflow.c \
protocols/radius.c \
protocols/teamviewer.c \
protocols/lotus_notes.c \
protocols/gtp.c \
protocols/h323.c \
protocols/noe.c \
protocols/ciscovpn.c \
protocols/teamspeak.c \
protocols/viber.c \
protocols/openvpn.c \
protocols/corba.c \
protocols/oracle.c \
protocols/rsync.c \
protocols/rtcp.c \
protocols/skinny.c \
protocols/tor.c \
protocols/whoisdas.c
# NTOP protocols are at the end
ndpi-1.4.0+svn6932/src/lib/third_party/ 0000755 0001750 0001750 00000000000 12240352354 017302 5 ustar cavedon cavedon ndpi-1.4.0+svn6932/src/lib/third_party/src/ 0000755 0001750 0001750 00000000000 12240352354 020071 5 ustar cavedon cavedon ndpi-1.4.0+svn6932/src/lib/third_party/src/node.c 0000644 0001750 0001750 00000021106 12161111616 021156 0 ustar cavedon cavedon /*
* node.c: implementation of automata node
* This file is part of multifast.
*
Copyright 2010-2012 Kamiar Kanani
multifast is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
multifast is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License
along with multifast. If not, see .
*/
#ifndef __KERNEL__
#include
#include
#include
#endif
#include "ndpi_main.h"
#include "ndpi_protocols.h"
#include "ndpi_utils.h"
#include "../include/node.h"
#include "sort.h"
/* reallocation step for AC_NODE_t.matched_patterns */
#define REALLOC_CHUNK_MATCHSTR 8
/* reallocation step for AC_NODE_t.outgoing array */
#define REALLOC_CHUNK_OUTGOING 8
/* TODO: For different depth of node, number of outgoing edges differs
considerably, It is efficient to use different chunk size for
different depths */
/* Private function prototype */
void node_init (AC_NODE_t * thiz);
int node_edge_compare (const void * l, const void * r);
int node_has_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * newstr);
/******************************************************************************
* FUNCTION: node_create
* Create the node
******************************************************************************/
AC_NODE_t * node_create(void)
{
AC_NODE_t * thiz = (AC_NODE_t *) ndpi_malloc (sizeof(AC_NODE_t));
node_init(thiz);
node_assign_id(thiz);
return thiz;
}
/******************************************************************************
* FUNCTION: node_init
* Initialize node
******************************************************************************/
void node_init(AC_NODE_t * thiz)
{
memset(thiz, 0, sizeof(AC_NODE_t));
thiz->outgoing_max = REALLOC_CHUNK_OUTGOING;
thiz->outgoing = (struct edge *) ndpi_malloc
(thiz->outgoing_max*sizeof(struct edge));
thiz->matched_patterns_max = REALLOC_CHUNK_MATCHSTR;
thiz->matched_patterns = (AC_PATTERN_t *) ndpi_malloc
(thiz->matched_patterns_max*sizeof(AC_PATTERN_t));
}
/******************************************************************************
* FUNCTION: node_release
* Release node
******************************************************************************/
void node_release(AC_NODE_t * thiz)
{
ndpi_free(thiz->matched_patterns);
ndpi_free(thiz->outgoing);
ndpi_free(thiz);
}
/******************************************************************************
* FUNCTION: node_find_next
* Find out the next node for a given Alpha to move. this function is used in
* the pre-processing stage in which edge array is not sorted. so it uses
* linear search.
******************************************************************************/
AC_NODE_t * node_find_next(AC_NODE_t * thiz, AC_ALPHABET_t alpha)
{
int i;
for (i=0; i < thiz->outgoing_degree; i++)
{
if(thiz->outgoing[i].alpha == alpha)
return (thiz->outgoing[i].next);
}
return NULL;
}
/******************************************************************************
* FUNCTION: node_findbs_next
* Find out the next node for a given Alpha. this function is used after the
* pre-processing stage in which we sort edges. so it uses Binary Search.
******************************************************************************/
AC_NODE_t * node_findbs_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha)
{
int min, max, mid;
AC_ALPHABET_t amid;
min = 0;
max = thiz->outgoing_degree - 1;
while (min <= max)
{
mid = (min+max) >> 1;
amid = thiz->outgoing[mid].alpha;
if (alpha > amid)
min = mid + 1;
else if (alpha < amid)
max = mid - 1;
else
return (thiz->outgoing[mid].next);
}
return NULL;
}
/******************************************************************************
* FUNCTION: node_has_matchstr
* Determine if a final node contains a pattern in its accepted pattern list
* or not. return values: 1 = it has, 0 = it hasn't
******************************************************************************/
int node_has_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * newstr)
{
int i, j;
AC_PATTERN_t * str;
for (i=0; i < thiz->matched_patterns_num; i++)
{
str = &thiz->matched_patterns[i];
if (str->length != newstr->length)
continue;
for (j=0; j<(int)str->length; j++)
if(str->astring[j] != newstr->astring[j])
continue;
if (j == str->length)
return 1;
}
return 0;
}
/******************************************************************************
* FUNCTION: node_create_next
* Create the next node for the given alpha.
******************************************************************************/
AC_NODE_t * node_create_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha)
{
AC_NODE_t * next;
next = node_find_next (thiz, alpha);
if (next)
/* The edge already exists */
return NULL;
/* Otherwise register new edge */
next = node_create ();
node_register_outgoing(thiz, next, alpha);
return next;
}
/******************************************************************************
* FUNCTION: node_register_matchstr
* Adds the pattern to the list of accepted pattern.
******************************************************************************/
void node_register_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * str)
{
/* Check if the new pattern already exists in the node list */
if (node_has_matchstr(thiz, str))
return;
/* Manage memory */
if (thiz->matched_patterns_num >= thiz->matched_patterns_max)
{
thiz->matched_patterns = (AC_PATTERN_t *) ndpi_realloc
(thiz->matched_patterns, thiz->matched_patterns_max*sizeof(AC_PATTERN_t),
(REALLOC_CHUNK_MATCHSTR+thiz->matched_patterns_max)*sizeof(AC_PATTERN_t));
thiz->matched_patterns_max += REALLOC_CHUNK_MATCHSTR;
}
thiz->matched_patterns[thiz->matched_patterns_num].astring = str->astring;
thiz->matched_patterns[thiz->matched_patterns_num].length = str->length;
thiz->matched_patterns[thiz->matched_patterns_num].rep = str->rep;
thiz->matched_patterns_num++;
}
/******************************************************************************
* FUNCTION: node_register_outgoing
* Establish an edge between two nodes
******************************************************************************/
void node_register_outgoing
(AC_NODE_t * thiz, AC_NODE_t * next, AC_ALPHABET_t alpha)
{
if(thiz->outgoing_degree >= thiz->outgoing_max)
{
thiz->outgoing = (struct edge *) ndpi_realloc
(thiz->outgoing, thiz->outgoing_max*sizeof(struct edge),
(REALLOC_CHUNK_OUTGOING+thiz->outgoing_max)*sizeof(struct edge));
thiz->outgoing_max += REALLOC_CHUNK_OUTGOING;
}
thiz->outgoing[thiz->outgoing_degree].alpha = alpha;
thiz->outgoing[thiz->outgoing_degree++].next = next;
}
/******************************************************************************
* FUNCTION: node_assign_id
* assign a unique ID to the node (used for debugging purpose).
******************************************************************************/
void node_assign_id (AC_NODE_t * thiz)
{
static int unique_id = 1;
thiz->id = unique_id ++;
}
/******************************************************************************
* FUNCTION: node_edge_compare
* Comparison function for qsort. see man qsort.
******************************************************************************/
int node_edge_compare (const void * l, const void * r)
{
/* According to man page:
* The comparison function must return an integer less than, equal to, or
* greater than zero if the first argument is considered to be
* respectively less than, equal to, or greater than the second. if two
* members compare as equal, their order in the sorted array is undefined.
*
* NOTE: Because edge alphabets are unique in every node we ignore
* equivalence case.
**/
if ( ((struct edge *)l)->alpha >= ((struct edge *)r)->alpha )
return 1;
else
return -1;
}
/******************************************************************************
* FUNCTION: node_sort_edges
* sorts edges alphabets.
******************************************************************************/
void node_sort_edges (AC_NODE_t * thiz)
{
sort ((void *)thiz->outgoing, thiz->outgoing_degree, sizeof(struct edge), node_edge_compare, NULL);
}
ndpi-1.4.0+svn6932/src/lib/third_party/src/ahocorasick.c 0000644 0001750 0001750 00000030531 12125274306 022527 0 ustar cavedon cavedon /*
* ahocorasick.c: implementation of ahocorasick library's functions
* This file is part of multifast.
*
Copyright 2010-2012 Kamiar Kanani
multifast is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
multifast is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License
along with multifast. If not, see .
*/
#ifndef __KERNEL__
#include
#include
#include
#include
#endif
#include "ndpi_main.h"
#include "ndpi_protocols.h"
#include "ndpi_utils.h"
#include "ahocorasick.h"
/* Allocation step for automata.all_nodes */
#define REALLOC_CHUNK_ALLNODES 200
/* Private function prototype */
static void ac_automata_register_nodeptr
(AC_AUTOMATA_t * thiz, AC_NODE_t * node);
static void ac_automata_union_matchstrs
(AC_NODE_t * node);
static void ac_automata_set_failure
(AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas);
static void ac_automata_traverse_setfailure
(AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas);
/******************************************************************************
* FUNCTION: ac_automata_init
* Initialize automata; allocate memories and set initial values
* PARAMS:
* MATCH_CALBACK mc: call-back function
* the call-back function will be used to reach the caller on match occurrence
******************************************************************************/
AC_AUTOMATA_t * ac_automata_init (MATCH_CALBACK_f mc)
{
AC_AUTOMATA_t * thiz = (AC_AUTOMATA_t *)ndpi_malloc(sizeof(AC_AUTOMATA_t));
memset (thiz, 0, sizeof(AC_AUTOMATA_t));
thiz->root = node_create ();
thiz->all_nodes_max = REALLOC_CHUNK_ALLNODES;
thiz->all_nodes = (AC_NODE_t **) ndpi_malloc (thiz->all_nodes_max*sizeof(AC_NODE_t *));
thiz->match_callback = mc;
ac_automata_register_nodeptr (thiz, thiz->root);
ac_automata_reset (thiz);
thiz->total_patterns = 0;
thiz->automata_open = 1;
return thiz;
}
/******************************************************************************
* FUNCTION: ac_automata_add
* Adds pattern to the automata.
* PARAMS:
* AC_AUTOMATA_t * thiz: the pointer to the automata
* AC_PATTERN_t * patt: the pointer to added pattern
* RETUERN VALUE: AC_ERROR_t
* the return value indicates the success or failure of adding action
******************************************************************************/
AC_ERROR_t ac_automata_add (AC_AUTOMATA_t * thiz, AC_PATTERN_t * patt)
{
unsigned int i;
AC_NODE_t * n = thiz->root;
AC_NODE_t * next;
AC_ALPHABET_t alpha;
if(!thiz->automata_open)
return ACERR_AUTOMATA_CLOSED;
if (!patt->length)
return ACERR_ZERO_PATTERN;
if (patt->length > AC_PATTRN_MAX_LENGTH)
return ACERR_LONG_PATTERN;
for (i=0; ilength; i++)
{
alpha = patt->astring[i];
if ((next = node_find_next(n, alpha)))
{
n = next;
continue;
}
else
{
next = node_create_next(n, alpha);
next->depth = n->depth + 1;
n = next;
ac_automata_register_nodeptr(thiz, n);
}
}
if(n->final)
return ACERR_DUPLICATE_PATTERN;
n->final = 1;
node_register_matchstr(n, patt);
thiz->total_patterns++;
return ACERR_SUCCESS;
}
/******************************************************************************
* FUNCTION: ac_automata_finalize
* Locate the failure node for all nodes and collect all matched pattern for
* every node. it also sorts outgoing edges of node, so binary search could be
* performed on them. after calling this function the automate literally will
* be finalized and you can not add new patterns to the automate.
* PARAMS:
* AC_AUTOMATA_t * thiz: the pointer to the automata
******************************************************************************/
void ac_automata_finalize (AC_AUTOMATA_t * thiz)
{
unsigned int i;
AC_ALPHABET_t *alphas;
AC_NODE_t * node;
if((alphas = ndpi_malloc(AC_PATTRN_MAX_LENGTH)) != NULL) {
ac_automata_traverse_setfailure (thiz, thiz->root, alphas);
for (i=0; i < thiz->all_nodes_num; i++)
{
node = thiz->all_nodes[i];
ac_automata_union_matchstrs (node);
node_sort_edges (node);
}
thiz->automata_open = 0; /* do not accept patterns any more */
ndpi_free(alphas);
}
}
/******************************************************************************
* FUNCTION: ac_automata_search
* Search in the input text using the given automata. on match event it will
* call the call-back function. and the call-back function in turn after doing
* its job, will return an integer value to ac_automata_search(). 0 value means
* continue search, and non-0 value means stop search and return to the caller.
* PARAMS:
* AC_AUTOMATA_t * thiz: the pointer to the automata
* AC_TEXT_t * txt: the input text that must be searched
* void * param: this parameter will be send to call-back function. it is
* useful for sending parameter to call-back function from caller function.
* RETURN VALUE:
* -1: failed call; automata is not finalized
* 0: success; continue searching; call-back sent me a 0 value
* 1: success; stop searching; call-back sent me a non-0 value
******************************************************************************/
int ac_automata_search (AC_AUTOMATA_t * thiz, AC_TEXT_t * txt, void * param)
{
unsigned long position;
AC_NODE_t *curr;
AC_NODE_t *next;
if(thiz->automata_open)
/* you must call ac_automata_locate_failure() first */
return -1;
position = 0;
curr = thiz->current_node;
/* This is the main search loop.
* it must be keep as lightweight as possible. */
while (position < txt->length)
{
if(!(next = node_findbs_next(curr, txt->astring[position])))
{
if(curr->failure_node /* we are not in the root node */)
curr = curr->failure_node;
else
position++;
}
else
{
curr = next;
position++;
}
if(curr->final && next)
/* We check 'next' to find out if we came here after a alphabet
* transition or due to a fail. in second case we should not report
* matching because it was reported in previous node */
{
thiz->match.position = position + thiz->base_position;
thiz->match.match_num = curr->matched_patterns_num;
thiz->match.patterns = curr->matched_patterns;
/* we found a match! do call-back */
if (thiz->match_callback(&thiz->match, param))
return 1;
}
}
/* save status variables */
thiz->current_node = curr;
thiz->base_position += position;
return 0;
}
/******************************************************************************
* FUNCTION: ac_automata_reset
* reset the automata and make it ready for doing new search on a new text.
* when you finished with the input text, you must reset automata state for
* new input, otherwise it will not work.
* PARAMS:
* AC_AUTOMATA_t * thiz: the pointer to the automata
******************************************************************************/
void ac_automata_reset (AC_AUTOMATA_t * thiz)
{
thiz->current_node = thiz->root;
thiz->base_position = 0;
}
/******************************************************************************
* FUNCTION: ac_automata_release
* Release all allocated memories to the automata
* PARAMS:
* AC_AUTOMATA_t * thiz: the pointer to the automata
******************************************************************************/
void ac_automata_release (AC_AUTOMATA_t * thiz)
{
unsigned int i;
AC_NODE_t * n;
for (i=0; i < thiz->all_nodes_num; i++)
{
n = thiz->all_nodes[i];
node_release(n);
}
ndpi_free(thiz->all_nodes);
ndpi_free(thiz);
}
#ifndef __KERNEL__
/******************************************************************************
* FUNCTION: ac_automata_display
* Prints the automata to output in human readable form. it is useful for
* debugging purpose.
* PARAMS:
* AC_AUTOMATA_t * thiz: the pointer to the automata
* char repcast: 'n': print AC_REP_t as number, 's': print AC_REP_t as string
******************************************************************************/
void ac_automata_display (AC_AUTOMATA_t * thiz, char repcast)
{
unsigned int i, j;
AC_NODE_t * n;
struct edge * e;
AC_PATTERN_t sid;
printf("---------------------------------\n");
for (i=0; iall_nodes_num; i++)
{
n = thiz->all_nodes[i];
printf("NODE(%3d)/----fail----> NODE(%3d)\n",
n->id, (n->failure_node)?n->failure_node->id:1);
for (j=0; joutgoing_degree; j++)
{
e = &n->outgoing[j];
printf(" |----(");
if(isgraph(e->alpha))
printf("%c)---", e->alpha);
else
printf("0x%x)", e->alpha);
printf("--> NODE(%3d)\n", e->next->id);
}
if (n->matched_patterns_num) {
printf("Accepted patterns: {");
for (j=0; jmatched_patterns_num; j++)
{
sid = n->matched_patterns[j];
if(j) printf(", ");
switch (repcast)
{
case 'n':
printf("%ld", sid.rep.number);
break;
case 's':
printf("%s", sid.rep.stringy);
break;
}
}
printf("}\n");
}
printf("---------------------------------\n");
}
}
#endif /* __KERNEL__ */
/******************************************************************************
* FUNCTION: ac_automata_register_nodeptr
* Adds the node pointer to all_nodes.
******************************************************************************/
static void ac_automata_register_nodeptr (AC_AUTOMATA_t * thiz, AC_NODE_t * node)
{
if(thiz->all_nodes_num >= thiz->all_nodes_max)
{
thiz->all_nodes = ndpi_realloc(thiz->all_nodes,
thiz->all_nodes_max*sizeof(AC_NODE_t *),
(REALLOC_CHUNK_ALLNODES+thiz->all_nodes_max)*sizeof(AC_NODE_t *)
);
thiz->all_nodes_max += REALLOC_CHUNK_ALLNODES;
}
thiz->all_nodes[thiz->all_nodes_num++] = node;
}
/******************************************************************************
* FUNCTION: ac_automata_union_matchstrs
* Collect accepted patterns of the node. the accepted patterns consist of the
* node's own accepted pattern plus accepted patterns of its failure node.
******************************************************************************/
static void ac_automata_union_matchstrs (AC_NODE_t * node)
{
unsigned int i;
AC_NODE_t * m = node;
while ((m = m->failure_node))
{
for (i=0; i < m->matched_patterns_num; i++)
node_register_matchstr(node, &(m->matched_patterns[i]));
if (m->final)
node->final = 1;
}
// TODO : sort matched_patterns? is that necessary? I don't think so.
}
/******************************************************************************
* FUNCTION: ac_automata_set_failure
* find failure node for the given node.
******************************************************************************/
static void ac_automata_set_failure
(AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas)
{
unsigned int i, j;
AC_NODE_t * m;
for (i=1; i < node->depth; i++)
{
m = thiz->root;
for (j=i; j < node->depth && m; j++)
m = node_find_next (m, alphas[j]);
if (m)
{
node->failure_node = m;
break;
}
}
if (!node->failure_node)
node->failure_node = thiz->root;
}
/******************************************************************************
* FUNCTION: ac_automata_traverse_setfailure
* Traverse all automata nodes using DFS (Depth First Search), meanwhile it set
* the failure node for every node it passes through. this function must be
* called after adding last pattern to automata. i.e. after calling this you
* can not add further pattern to automata.
******************************************************************************/
static void ac_automata_traverse_setfailure
(AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas)
{
unsigned int i;
AC_NODE_t * next;
for (i=0; i < node->outgoing_degree; i++)
{
alphas[node->depth] = node->outgoing[i].alpha;
next = node->outgoing[i].next;
/* At every node look for its failure node */
ac_automata_set_failure (thiz, next, alphas);
/* Recursively call itself to traverse all nodes */
ac_automata_traverse_setfailure (thiz, next, alphas);
}
}
ndpi-1.4.0+svn6932/src/lib/third_party/src/sort.c 0000644 0001750 0001750 00000005426 12116424672 021240 0 ustar cavedon cavedon /*
* A fast, small, non-recursive O(nlog n) sort for the Linux kernel
*
* Jan 23 2005 Matt Mackall
*/
#ifdef __KERNEL__
#include
#else
#ifdef WIN32
#include
typedef uint32_t u_int32_t;
#endif
#include
#include
#include
#endif
/* This is a function ported from the Linux kernel lib/sort.c */
static void u_int32_t_swap(void *a, void *b, int size)
{
u_int32_t t = *(u_int32_t *)a;
*(u_int32_t *)a = *(u_int32_t *)b;
*(u_int32_t *)b = t;
}
static void generic_swap(void *_a, void *_b, int size)
{
char t;
char *a = (char*)_a;
char *b = (char*)_b;
do {
t = *a;
*a++ = *b;
*b++ = t;
} while (--size > 0);
}
/**
* sort - sort an array of elements
* @base: pointer to data to sort
* @num: number of elements
* @size: size of each element
* @cmp_func: pointer to comparison function
* @swap_func: pointer to swap function or NULL
*
* This function does a heapsort on the given array. You may provide a
* swap_func function optimized to your element type.
*
* Sorting time is O(n log n) both on average and worst-case. While
* qsort is about 20% faster on average, it suffers from exploitable
* O(n*n) worst-case behavior and extra memory requirements that make
* it less suitable for kernel use.
*/
void sort(void *_base, size_t num, size_t size,
int (*cmp_func)(const void *, const void *),
void (*swap_func)(void *, void *, int size))
{
/* pre-scale counters for performance */
int i = (num/2 - 1) * size, n = num * size, c, r;
char *base = (char*)_base;
if (!swap_func)
swap_func = (size == 4 ? u_int32_t_swap : generic_swap);
/* heapify */
for ( ; i >= 0; i -= size) {
for (r = i; r * 2 + size < n; r = c) {
c = r * 2 + size;
if (c < n - size &&
cmp_func(base + c, base + c + size) < 0)
c += size;
if (cmp_func(base + r, base + c) >= 0)
break;
swap_func(base + r, base + c, size);
}
}
/* sort */
for (i = n - size; i > 0; i -= size) {
swap_func(base, base + i, size);
for (r = 0; r * 2 + size < i; r = c) {
c = r * 2 + size;
if (c < i - size &&
cmp_func(base + c, base + c + size) < 0)
c += size;
if (cmp_func(base + r, base + c) >= 0)
break;
swap_func(base + r, base + c, size);
}
}
}
#if 0
/* a simple boot-time regression test */
int cmpint(const void *a, const void *b)
{
return *(int *)a - *(int *)b;
}
int main(int argc, char *argv[]) {
int *a, i, r = 1;
a = ndpi_malloc(1000 * sizeof(int));
printf("testing sort()\n");
for (i = 0; i < 1000; i++) {
r = (r * 725861) % 6599;
a[i] = r;
}
sort(a, 1000, sizeof(int), cmpint, NULL);
for (i = 0; i < 999; i++)
if (a[i] > a[i+1]) {
printf("sort() failed!\n");
break;
}
return 0;
}
#endif
ndpi-1.4.0+svn6932/src/lib/third_party/include/ 0000755 0001750 0001750 00000000000 12240352354 020725 5 ustar cavedon cavedon ndpi-1.4.0+svn6932/src/lib/third_party/include/node.h 0000644 0001750 0001750 00000004612 12114425272 022026 0 ustar cavedon cavedon /*
* node.h: automata node header file
* This file is part of multifast.
*
Copyright 2010-2012 Kamiar Kanani
multifast is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
multifast is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License
along with multifast. If not, see .
*/
#ifndef _NODE_H_
#define _NODE_H_
#include "actypes.h"
/* Forward Declaration */
struct edge;
/* automata node */
typedef struct ac_node
{
int id; /* Node ID : for debugging purpose */
short int final; /* 0: no ; 1: yes, it is a final node */
struct ac_node * failure_node; /* The failure node of this node */
unsigned short depth; /* depth: distance between this node and the root */
/* Matched patterns */
AC_PATTERN_t * matched_patterns; /* Array of matched patterns */
unsigned short matched_patterns_num; /* Number of matched patterns at this node */
unsigned short matched_patterns_max; /* Max capacity of allocated memory for matched_patterns */
/* Outgoing Edges */
struct edge * outgoing; /* Array of outgoing edges */
unsigned short outgoing_degree; /* Number of outgoing edges */
unsigned short outgoing_max; /* Max capacity of allocated memory for outgoing */
} AC_NODE_t;
/* The Edge of the Node */
struct edge
{
AC_ALPHABET_t alpha; /* Edge alpha */
struct ac_node * next; /* Target of the edge */
};
AC_NODE_t * node_create (void);
AC_NODE_t * node_create_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha);
void node_register_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * str);
void node_register_outgoing (AC_NODE_t * thiz, AC_NODE_t * next, AC_ALPHABET_t alpha);
AC_NODE_t * node_find_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha);
AC_NODE_t * node_findbs_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha);
void node_release (AC_NODE_t * thiz);
void node_assign_id (AC_NODE_t * thiz);
void node_sort_edges (AC_NODE_t * thiz);
#endif
ndpi-1.4.0+svn6932/src/lib/third_party/include/ahocorasick.h 0000644 0001750 0001750 00000005202 12114404266 023363 0 ustar cavedon cavedon /*
* ahocorasick.h: the main ahocorasick header file.
* This file is part of multifast.
*
Copyright 2010-2012 Kamiar Kanani
multifast is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
multifast is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License
along with multifast. If not, see .
*/
#ifndef _AUTOMATA_H_
#define _AUTOMATA_H_
#include "node.h"
typedef struct
{
/* The root of the Aho-Corasick trie */
AC_NODE_t * root;
/* maintain all nodes pointers. it will be used to access or release
* all nodes. */
AC_NODE_t ** all_nodes;
unsigned int all_nodes_num; /* Number of all nodes in the automata */
unsigned int all_nodes_max; /* Current max allocated memory for *all_nodes */
AC_MATCH_t match; /* Any match is reported with this */
MATCH_CALBACK_f match_callback; /* Match call-back function */
/* this flag indicates that if automata is finalized by
* ac_automata_finalize() or not. 1 means finalized and 0
* means not finalized (is open). after finalizing automata you can not
* add pattern to automata anymore. */
unsigned short automata_open;
/* It is possible to feed a large input to the automata chunk by chunk to
* be searched using ac_automata_search(). in fact by default automata
* thinks that all chunks are related unless you do ac_automata_reset().
* followings are variables that keep track of searching state. */
AC_NODE_t * current_node; /* Pointer to current node while searching */
unsigned long base_position; /* Represents the position of current chunk
related to whole input text */
/* Statistic Variables */
unsigned long total_patterns; /* Total patterns in the automata */
} AC_AUTOMATA_t;
AC_AUTOMATA_t * ac_automata_init (MATCH_CALBACK_f mc);
AC_ERROR_t ac_automata_add (AC_AUTOMATA_t * thiz, AC_PATTERN_t * str);
void ac_automata_finalize (AC_AUTOMATA_t * thiz);
int ac_automata_search (AC_AUTOMATA_t * thiz, AC_TEXT_t * str, void * param);
void ac_automata_reset (AC_AUTOMATA_t * thiz);
void ac_automata_release (AC_AUTOMATA_t * thiz);
void ac_automata_display (AC_AUTOMATA_t * thiz, char repcast);
#endif
ndpi-1.4.0+svn6932/src/lib/third_party/include/sort.h 0000644 0001750 0001750 00000000324 12114425272 022064 0 ustar cavedon cavedon /* This is a function ported from the Linux kernel lib/sort.c */
void sort(void *base, size_t num, size_t len,
int (*cmp_func)(const void *, const void *),
void (*swap_func)(void *, void *, int size));
ndpi-1.4.0+svn6932/src/lib/third_party/include/actypes.h 0000644 0001750 0001750 00000013241 12114404266 022547 0 ustar cavedon cavedon /*
* actypes.h: Includes basic data types of ahocorasick library
* This file is part of multifast.
*
Copyright 2010-2012 Kamiar Kanani
multifast is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
multifast is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public License
along with multifast. If not, see .
*/
#ifndef _AC_TYPES_H_
#define _AC_TYPES_H_
/* AC_ALPHABET_t:
* defines the alphabet type.
* Actually defining AC_ALPHABET_t as a char will work, but sometimes we deal
* with streams of other (bigger) types e.g. integers, specific enum, objects.
* Although they consists of string of bytes (chars), but using their specific
* types for AC_ALPHABET_t will lead to a better performance. so instead of
* dealing with strings of chars, we assume dealing with strings of
* AC_ALPHABET_t and leave it optional for other developers to define their
* own alphabets.
**/
typedef char AC_ALPHABET_t;
/* AC_REP_t:
* Provides a more readable representative for a pattern.
* because patterns themselves are not always suitable for displaying
* (e.g. for hex patterns), we offer this type to improve intelligibility
* of output. furthermore, sometimes it is useful, for example while
* retrieving patterns from a database, to maintain their identifiers in the
* automata for further reference. we provisioned two possible types as a
* union for this purpose. you can add your desired type in it.
**/
typedef union {
char * stringy; /* null-terminated string */
unsigned long number;
} AC_REP_t;
/* AC_PATTERN_t:
* This is the pattern type that must be fed into AC automata.
* the 'astring' field is not null-terminated, due to it can contain zero
* value bytes. the 'length' field determines the number of AC_ALPHABET_t it
* carries. the 'representative' field is described in AC_REP_t. despite
* 'astring', 'representative' can have duplicate values for different given
* AC_PATTERN_t. it is an optional field and you can just fill it with 0.
* CAUTION:
* Not always the 'astring' points to the correct position in memory.
* it is the responsibility of your program to maintain a permanent allocation
* for astring field of the added pattern to automata.
**/
typedef struct
{
AC_ALPHABET_t * astring; /* String of alphabets */
unsigned int length; /* Length of pattern */
AC_REP_t rep; /* Representative string (optional) */
} AC_PATTERN_t;
/* AC_TEXT_t:
* The input text type that is fed to ac_automata_search() to be searched.
* it is similar to AC_PATTERN_t. actually we could use AC_PATTERN_t as input
* text, but for the purpose of being more readable, we defined this new type.
**/
typedef struct
{
AC_ALPHABET_t * astring; /* String of alphabets */
unsigned int length; /* Length of string */
} AC_TEXT_t;
/* AC_MATCH_t:
* Provides the structure for reporting a match event.
* a match event occurs when the automata reaches a final node. any final
* node can match one or more pattern at a position in a text. the
* 'patterns' field holds these matched patterns. obviously these
* matched patterns have same end-position in the text. there is a relationship
* between matched patterns: the shorter one is a factor (tail) of the longer
* one. the 'position' maintains the end position of matched patterns. the
* start position of patterns could be found by knowing their 'length' in
* AC_PATTERN_t. e.g. suppose "recent" and "cent" are matched at
* position 40 in the text, then the start position of them are 34 and 36
* respectively. finally the field 'match_num' maintains the number of
* matched patterns.
**/
typedef struct
{
AC_PATTERN_t * patterns; /* Array of matched pattern */
long position; /* The end position of matching pattern(s) in the text */
unsigned int match_num; /* Number of matched patterns */
} AC_MATCH_t;
/* AC_ERROR_t:
* Error that may occur while adding a pattern to the automata.
* it is returned by ac_automata_add().
**/
typedef enum
{
ACERR_SUCCESS = 0, /* No error occurred */
ACERR_DUPLICATE_PATTERN, /* Duplicate patterns */
ACERR_LONG_PATTERN, /* Pattern length is longer than AC_PATTRN_MAX_LENGTH */
ACERR_ZERO_PATTERN, /* Empty pattern (zero length) */
ACERR_AUTOMATA_CLOSED, /* Automata is closed. after calling
ac_automata_finalize() you can not add new patterns to the automata. */
} AC_ERROR_t;
/* MATCH_CALBACK_t:
* This is the call-back function type that must be given to automata at
* initialization to report match occurrence to the caller.
* at a match event, the automata will reach you using this function and sends
* you a pointer to AC_MATCH_t. using that pointer you can handle
* matches. you can send parameters to the call-back function when you call
* ac_automata_search(). at call-back, the automata will sent you those
* parameters as the second parameter (void *) of MATCH_CALBACK_t. inside
* the call-back function you can cast it to whatever you want.
* If you return 0 from MATCH_CALBACK_t function to the automata, it will
* continue searching, otherwise it will return from ac_automata_search()
* to your calling function.
**/
typedef int (*MATCH_CALBACK_f)(AC_MATCH_t *, void *);
/* AC_PATTRN_MAX_LENGTH:
* Maximum acceptable pattern length in AC_PATTERN_t.length
**/
#define AC_PATTRN_MAX_LENGTH 1024
#endif
ndpi-1.4.0+svn6932/src/lib/ndpi_cache.c 0000644 0001750 0001750 00000035261 12235473255 017211 0 ustar cavedon cavedon /*
* ndpi_cache.c
*
* Copyright (C) 2013 - ntop.org
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
static u_int8_t traceLRU = 0;
#ifndef __KERNEL__
#ifdef __GNUC__
#define likely(x) __builtin_expect((x),1)
#define unlikely(x) __builtin_expect((x),0)
#else
#define likely(x) (x)
#define unlikely(x) (x)
#endif
#endif
/* ************************************************************************ */
static u_int32_t get_now(void) {
#ifndef __KERNEL__
return((u_int32_t)time(NULL));
#else
return(jiffies);
#endif
}
/* ************************************************************************ */
static u_int32_t compute_timeout(u_int32_t t) {
#ifndef __KERNEL__
return(t);
#else
return(t*HZ);
#endif
}
/* ************************************************************************ */
int ndpi_init_lru_cache(struct ndpi_LruCache *cache, u_int32_t max_size) {
if(unlikely(traceLRU))
printf("%s(max_size=%u)", __FUNCTION__, max_size);
cache->max_cache_node_len = 4;
cache->hash_size = max_size/cache->max_cache_node_len;
#ifdef FULL_STATS
cache->mem_size += cache->hash_size*sizeof(struct ndpi_LruCacheEntry*);
#endif
if((cache->hash = (struct ndpi_LruCacheEntry**)ndpi_calloc(cache->hash_size, sizeof(struct ndpi_LruCacheEntry*))) == NULL) {
printf("ERROR: Not enough memory?");
return(-1);
}
#ifdef FULL_STATS
cache->mem_size += cache->hash_size*sizeof(u_int32_t);
#endif
if((cache->current_hash_size = (u_int32_t*)ndpi_calloc(cache->hash_size, sizeof(u_int32_t))) == NULL) {
printf("ERROR: Not enough memory?");
return(-1);
}
return(0);
}
/* ************************************ */
static void free_lru_cache_entry(struct ndpi_LruCache *cache, struct ndpi_LruCacheEntry *entry) {
if(entry->numeric_node) {
; /* Nothing to do */
} else {
#ifdef FULL_STATS
cache->mem_size -= strlen(entry->u.str.key);
cache->mem_size -= strlen(entry->u.str.value);
#endif
ndpi_free(entry->u.str.key);
ndpi_free(entry->u.str.value);
}
}
/* ************************************ */
void ndpi_free_lru_cache(struct ndpi_LruCache *cache) {
int i;
if(unlikely(traceLRU)) printf("%s()", __FUNCTION__);
for(i=0; i<(int)cache->hash_size; i++) {
struct ndpi_LruCacheEntry *head = cache->hash[i];
while(head != NULL) {
struct ndpi_LruCacheEntry *next = head->next;
free_lru_cache_entry(cache, head);
ndpi_free(head);
#ifdef FULL_STATS
cache->mem_size -= sizeof(struct ndpi_LruCacheEntry);
#endif
head = next;
}
}
ndpi_free(cache->hash);
#ifdef FULL_STATS
cache->mem_size -= cache->hash_size*sizeof(struct ndpi_LruCacheEntry*);
#endif
ndpi_free(cache->current_hash_size);
#ifdef FULL_STATS
cache->mem_size -= cache->hash_size*sizeof(u_int32_t);
#endif
}
/* ************************************ */
static u_int32_t lru_hash_string(char *a) {
u_int32_t h = 0, i;
for(i=0; a[i] != 0; i++) h += ((u_int32_t)a[i])*(i+1);
return(h);
}
/* ************************************ */
#ifdef _NOT_USED_
static u_int32_t lru_node_key_hash(struct ndpi_LruCacheEntry *a) {
if(a->numeric_node)
return((u_int32_t)a->u.num.key);
else
return(lru_hash_string(a->u.str.key));
}
#endif
/* ************************************ */
#ifdef _NOT_USED_
/*
Return codes
0 Items are the same
-1 a < b
1 a > b
*/
static int lru_node_key_entry_compare(struct ndpi_LruCacheEntry *a,
struct ndpi_LruCacheEntry *b) {
if(a->numeric_node) {
if(a->u.num.key == b->u.num.key)
return(0);
else if(a->u.num.key < b->u.num.key)
return(-1);
else
return(1);
} else
return(strcmp(a->u.str.key, b->u.str.key));
}
#endif
/* ********************************************* */
struct ndpi_LruCacheEntry* lru_allocCacheNumericNode(struct ndpi_LruCache *cache, u_int32_t key, u_int32_t value) {
struct ndpi_LruCacheEntry *node = (struct ndpi_LruCacheEntry*)ndpi_calloc(1, sizeof(struct ndpi_LruCacheEntry));
if(unlikely(traceLRU))
printf("%s(key=%lu, value=%u)", __FUNCTION__,
(long unsigned int)key, (unsigned int)value);
if(node == NULL)
printf("ERROR: Not enough memory?");
else {
node->numeric_node = 1;
node->u.num.key = key, node->u.num.value = value;
}
#ifdef FULL_STATS
cache->mem_size += sizeof(struct ndpi_LruCacheEntry);
//printf("%s(key=%lu, value=%u) [memory: %u]", __FUNCTION__, key, value, cache->mem_size);
#endif
return(node);
}
/* ************************************ */
struct ndpi_LruCacheEntry* lru_allocCacheStringNode(struct ndpi_LruCache *cache, char *key, char *value, u_int32_t timeout) {
struct ndpi_LruCacheEntry *node = (struct ndpi_LruCacheEntry*)ndpi_calloc(1, sizeof(struct ndpi_LruCacheEntry));
if(unlikely(traceLRU))
printf("%s(key=%s, value=%s)", __FUNCTION__, key, value);
if(node == NULL)
printf("ERROR: Not enough memory?");
else {
node->numeric_node = 0;
node->u.str.key = ndpi_strdup(key), node->u.str.value = ndpi_strdup(value);
node->u.str.expire_time = (timeout == 0) ? 0 : (compute_timeout(timeout) + get_now());
#ifdef FULL_STATS
cache->mem_size += sizeof(struct ndpi_LruCacheEntry) + strlen(key) + strlen(value);
//printf("%s(key=%s, value=%s) [memory: %u]", __FUNCTION__, key, value, cache->mem_size);
#endif
}
return(node);
}
/* ************************************ */
static void trim_subhash(struct ndpi_LruCache *cache, u_int32_t hash_id) {
if(unlikely(traceLRU))
printf("%s()", __FUNCTION__);
if(cache->current_hash_size[hash_id] >= cache->max_cache_node_len) {
struct ndpi_LruCacheEntry *head = cache->hash[hash_id], *prev = NULL;
/* Find the last entry and remove it */
while(head->next != NULL) {
prev = head;
head = head->next;
}
if(prev) {
prev->next = head->next;
free_lru_cache_entry(cache, head);
ndpi_free(head);
#ifdef FULL_STATS
cache->mem_size -= sizeof(struct ndpi_LruCacheEntry);
#endif
cache->current_hash_size[hash_id]--;
} else
printf("ERROR: Internal error in %s()", __FUNCTION__);
}
}
/* ************************************ */
#ifdef _NOT_USED_
static void validate_unit_len(struct ndpi_LruCache *cache, u_int32_t hash_id) {
struct ndpi_LruCacheEntry *head = cache->hash[hash_id];
u_int num = 0;
while(head != NULL) {
head = head->next, num++;
}
if(num != cache->current_hash_size[hash_id])
printf("ERROR: Invalid length [expected: %u][read: %u][hash_id: %u]",
cache->current_hash_size[hash_id], num, hash_id);
}
#endif
/* ************************************ */
int ndpi_add_to_lru_cache_num(struct ndpi_LruCache *cache,
u_int32_t key, u_int32_t value) {
if(cache->hash_size == 0)
return(0);
else {
u_int32_t hash_id = key % cache->hash_size;
struct ndpi_LruCacheEntry *node;
u_int8_t node_already_existing = 0;
int rc = 0;
if(unlikely(traceLRU))
printf("%s(key=%lu, value=%u)", __FUNCTION__, (long unsigned int)key, (unsigned int)value);
// validate_unit_len(cache, hash_id);
cache->num_cache_add++;
/* [1] Add to hash */
if(cache->hash[hash_id] == NULL) {
if((node = lru_allocCacheNumericNode(cache, key, value)) == NULL) {
rc = -1;
goto ret_add_to_lru_cache;
}
cache->hash[hash_id] = node;
cache->current_hash_size[hash_id]++;
} else {
/* Check if the element exists */
struct ndpi_LruCacheEntry *head = cache->hash[hash_id];
while(head != NULL) {
if(head->u.num.key == key) {
/* Duplicated key found */
node = head;
node->u.num.value = value; /* Overwrite old value */
node_already_existing = 1;
break;
} else
head = head->next;
}
if(!node_already_existing) {
if((node = lru_allocCacheNumericNode(cache, key, value)) == NULL) {
rc = -2;
goto ret_add_to_lru_cache;
}
node->next = cache->hash[hash_id];
cache->hash[hash_id] = node;
cache->current_hash_size[hash_id]++;
}
}
trim_subhash(cache, hash_id);
// validate_unit_len(cache, hash_id);
ret_add_to_lru_cache:
return(rc);
}
}
/* ************************************ */
int ndpi_add_to_lru_cache_str_timeout(struct ndpi_LruCache *cache,
char *key, char *value,
u_int32_t timeout) {
if(cache->hash_size == 0)
return(0);
else {
u_int32_t hash_val = lru_hash_string(key);
u_int32_t hash_id = hash_val % cache->hash_size;
struct ndpi_LruCacheEntry *node;
u_int8_t node_already_existing = 0;
int rc = 0;
if(unlikely(traceLRU))
printf("%s(key=%s, value=%s)", __FUNCTION__, key, value);
// validate_unit_len(cache, hash_id);
cache->num_cache_add++;
/* [1] Add to hash */
if(cache->hash[hash_id] == NULL) {
if((node = lru_allocCacheStringNode(cache, key, value, timeout)) == NULL) {
rc = -1;
goto ret_add_to_lru_cache;
}
cache->hash[hash_id] = node;
cache->current_hash_size[hash_id]++;
} else {
/* Check if the element exists */
struct ndpi_LruCacheEntry *head = cache->hash[hash_id];
while(head != NULL) {
if(strcmp(head->u.str.key, key) == 0) {
/* Duplicated key found */
node = head;
if(node->u.str.value) {
#ifdef FULL_STATS
cache->mem_size -= strlen(node->u.str.value);
#endif
ndpi_free(node->u.str.value);
}
node->u.str.value = ndpi_strdup(value); /* Overwrite old value */
#ifdef FULL_STATS
cache->mem_size += strlen(value);
#endif
node->u.str.expire_time = (timeout == 0) ? 0 : (compute_timeout(timeout) + get_now());
node_already_existing = 1;
break;
} else
head = head->next;
}
if(!node_already_existing) {
if((node = lru_allocCacheStringNode(cache, key, value, timeout)) == NULL) {
rc = -2;
goto ret_add_to_lru_cache;
}
node->next = cache->hash[hash_id];
cache->hash[hash_id] = node;
cache->current_hash_size[hash_id]++;
}
}
trim_subhash(cache, hash_id);
// validate_unit_len(cache, hash_id);
ret_add_to_lru_cache:
return(rc);
}
}
/* ************************************ */
int ndpi_add_to_lru_cache_str(struct ndpi_LruCache *cache, char *key, char *value) {
ndpi_add_to_lru_cache_str_timeout(cache, key, value, 0);
return(0);
}
/* ************************************ */
u_int32_t ndpi_find_lru_cache_num(struct ndpi_LruCache *cache, u_int32_t key) {
if(cache->hash_size == 0)
return(0);
else {
u_int32_t hash_id = key % cache->hash_size;
struct ndpi_LruCacheEntry *head, *prev = NULL;
u_int32_t ret_val = NDPI_PROTOCOL_UNKNOWN;
if(unlikely(traceLRU))
printf("%s(%lu)", __FUNCTION__, (long unsigned int)key);
head = cache->hash[hash_id];
// validate_unit_len(cache, hash_id);
cache->num_cache_find++;
while(head != NULL) {
if(head->u.num.key == key) {
ret_val = head->u.num.value;
/* We now need to move it in front */
if(prev != NULL) {
/* We're not the first element yet */
prev->next = head->next;
head->next = cache->hash[hash_id];
cache->hash[hash_id] = head;
}
break;
} else {
prev = head;
head = head->next;
}
}
if(ret_val == NDPI_PROTOCOL_UNKNOWN) cache->num_cache_misses++;
return(ret_val);
}
}
/* ************************************ */
char*ndpi_find_lru_cache_str(struct ndpi_LruCache *cache, char *key) {
if(cache->hash_size == 0)
return(0);
else {
u_int32_t hash_val = lru_hash_string(key);
u_int32_t hash_id = hash_val % cache->hash_size;
struct ndpi_LruCacheEntry *head, *prev = NULL;
char *ret_val = NULL;
time_t now = get_now();
if(unlikely(traceLRU))
printf("%s(%s)", __FUNCTION__, key);
// validate_unit_len(cache, hash_id);
cache->num_cache_find++;
head = cache->hash[hash_id];
while(head != NULL) {
if(strcmp(head->u.str.key, key) == 0) {
if(head->u.str.expire_time < now) {
/* The node has expired */
if(prev == NULL)
cache->hash[hash_id] = head->next;
else
prev->next = head->next;
free_lru_cache_entry(cache, head);
ndpi_free(head);
#ifdef FULL_STATS
cache->mem_size -= sizeof(struct ndpi_LruCacheEntry);
#endif
ret_val = NULL;
cache->current_hash_size[hash_id]--;
} else
ret_val = head->u.str.value;
break;
} else {
prev = head;
head = head->next;
}
}
if(ret_val == NULL) cache->num_cache_misses++;
// validate_unit_len(cache, hash_id);
return(ret_val);
}
}
/* ************************************ */
#ifdef _NOT_USED_
static void dumpndpi_LruCacheStat(struct ndpi_LruCache *cache,
char* cacheName, u_int timeDifference) {
u_int32_t tot_cache_add = 0, tot_cache_find = 0;
u_int32_t tot_mem = 0, grand_total_mem = 0;
u_int32_t num_cache_add = 0, num_cache_find = 0;
u_int32_t num_cache_misses = 0, grand_total = 0;
float a, f, m;
int j, tot;
tot_cache_add += cache->num_cache_add;
num_cache_add += cache->num_cache_add - cache->last_num_cache_add;
cache->last_num_cache_add = cache->num_cache_add;
tot_cache_find += cache->num_cache_find;
num_cache_find += cache->num_cache_find - cache->last_num_cache_find;
cache->last_num_cache_find = cache->num_cache_find;
num_cache_misses += cache->num_cache_misses - cache->last_num_cache_misses;
cache->last_num_cache_misses = cache->num_cache_misses;
for(tot=0, tot_mem=0, j=0; j<(int)cache->hash_size; j++)
tot += cache->current_hash_size[j], tot_mem += (cache->mem_size+sizeof(struct ndpi_LruCache));
grand_total += tot;
grand_total_mem += tot_mem;
#ifdef FULL_STATS
if(tot > 0)
printf("LRUCacheUnit %s [current_hash_size: %u][max_cache_node_len: %u][mem_size: %.1f MB/%.1f MB]",
cacheName, tot, cache->max_cache_node_len, (float)tot_mem/(float)(1024*1024), (float)grand_total_mem/(float)(1024*1024));
#endif
a = (timeDifference > 0) ? ((float)num_cache_add)/(float)timeDifference : 0;
f = (timeDifference > 0) ? ((float)num_cache_find)/(float)timeDifference : 0;
m = (num_cache_add > 0) ? ((float)(num_cache_misses*100))/((float)num_cache_find) : 0;
if(tot_cache_find || tot_cache_add)
printf("LRUCache %s [find: %u operations/%.1f find/sec]"
"[cache miss %u/%.1f %%][add: %u operations/%.1f add/sec][tot: %u][mem_size: %.1f MB]",
cacheName, tot_cache_find, f, num_cache_misses, m, tot_cache_add, a, grand_total,
(float)grand_total_mem/(float)(1024*1024));
}
#endif
ndpi-1.4.0+svn6932/src/lib/ndpi_main.c 0000644 0001750 0001750 00000646740 12235511527 017077 0 ustar cavedon cavedon /*
* ndpi_main.c
*
* Copyright (C) 2009-2011 by ipoque GmbH
* Copyright (C) 2011-13 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
*
* nDPI is free software: you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* nDPI is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with nDPI. If not, see .
*
*/
#ifndef __KERNEL__
#include
#include
#endif
#include "ndpi_main.h"
#include "ndpi_protocols.h"
#include "ndpi_utils.h"
#include "ahocorasick.h"
#undef DEBUG
#ifdef __KERNEL__
#include
#define printf printk
#else
#include
#ifndef WIN32
#include
#endif
#endif
// #include "ndpi_credis.c"
#include "ndpi_cache.c"
typedef struct {
char *string_to_match, *proto_name;
int protocol_id;
} ndpi_protocol_match;
#ifdef WIN32
/* http://social.msdn.microsoft.com/Forums/uk/vcgeneral/thread/963aac07-da1a-4612-be4a-faac3f1d65ca */
#ifndef strtok_r
#define strtok_r(a,b,c) strtok(a,b)
#endif
#endif
#ifdef __KERNEL__
#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,39)
static inline char _tolower(const char c)
{
return c | 0x20;
}
static int _kstrtoull(const char *s, unsigned int base, unsigned long long *res)
{
unsigned long long acc;
int ok;
if (base == 0) {
if (s[0] == '0') {
if (_tolower(s[1]) == 'x' && isxdigit(s[2]))
base = 16;
else
base = 8;
} else
base = 10;
}
if (base == 16 && s[0] == '0' && _tolower(s[1]) == 'x')
s += 2;
acc = 0;
ok = 0;
while (*s) {
unsigned int val;
if ('0' <= *s && *s <= '9')
val = *s - '0';
else if ('a' <= _tolower(*s) && _tolower(*s) <= 'f')
val = _tolower(*s) - 'a' + 10;
else if (*s == '\n') {
if (*(s + 1) == '\0')
break;
else
return -EINVAL;
} else
return -EINVAL;
if (val >= base)
return -EINVAL;
if (acc > div_u64(ULLONG_MAX - val, base))
return -ERANGE;
acc = acc * base + val;
ok = 1;
s++;
}
if (!ok)
return -EINVAL;
*res = acc;
return 0;
}
int kstrtoull(const char *s, unsigned int base, unsigned long long *res)
{
if (s[0] == '+')
s++;
return _kstrtoull(s, base, res);
}
int kstrtoll(const char *s, unsigned int base, long long *res)
{
unsigned long long tmp;
int rv;
if (s[0] == '-') {
rv = _kstrtoull(s + 1, base, &tmp);
if (rv < 0)
return rv;
if ((long long)(-tmp) >= 0)
return -ERANGE;
*res = -tmp;
} else {
rv = kstrtoull(s, base, &tmp);
if (rv < 0)
return rv;
if ((long long)tmp < 0)
return -ERANGE;
*res = tmp;
}
return 0;
}
int kstrtoint(const char *s, unsigned int base, int *res)
{
long long tmp;
int rv;
rv = kstrtoll(s, base, &tmp);
if (rv < 0)
return rv;
if (tmp != (long long)(int)tmp)
return -ERANGE;
*res = tmp;
return 0;
}
#endif
int atoi(const char *str) {
int rc;
if(kstrtoint(str, 0, &rc) == 0 /* Success */)
return(rc);
else
return(0);
}
#endif
/* ftp://ftp.cc.uoc.gr/mirrors/OpenBSD/src/lib/libc/stdlib/tsearch.c */
/* find or insert datum into search tree */
void *
ndpi_tsearch(const void *vkey, void **vrootp,
int (*compar)(const void *, const void *))
{
ndpi_node *q;
char *key = (char *)vkey;
ndpi_node **rootp = (ndpi_node **)vrootp;
if (rootp == (ndpi_node **)0)
return ((void *)0);
while (*rootp != (ndpi_node *)0) { /* Knuth's T1: */
int r;
if ((r = (*compar)(key, (*rootp)->key)) == 0) /* T2: */
return ((void *)*rootp); /* we found it! */
rootp = (r < 0) ?
&(*rootp)->left : /* T3: follow left branch */
&(*rootp)->right; /* T4: follow right branch */
}
q = (ndpi_node *) ndpi_malloc(sizeof(ndpi_node)); /* T5: key not found */
if (q != (ndpi_node *)0) { /* make new node */
*rootp = q; /* link new node to old */
q->key = key; /* initialize new node */
q->left = q->right = (ndpi_node *)0;
}
return ((void *)q);
}
/* delete node with given key */
void *
ndpi_tdelete(const void *vkey, void **vrootp,
int (*compar)(const void *, const void *))
{
ndpi_node **rootp = (ndpi_node **)vrootp;
char *key = (char *)vkey;
ndpi_node *p = (ndpi_node *)1;
ndpi_node *q;
ndpi_node *r;
int cmp;
if (rootp == (ndpi_node **)0 || *rootp == (ndpi_node *)0)
return ((ndpi_node *)0);
while ((cmp = (*compar)(key, (*rootp)->key)) != 0) {
p = *rootp;
rootp = (cmp < 0) ?
&(*rootp)->left : /* follow left branch */
&(*rootp)->right; /* follow right branch */
if (*rootp == (ndpi_node *)0)
return ((void *)0); /* key not found */
}
r = (*rootp)->right; /* D1: */
if ((q = (*rootp)->left) == (ndpi_node *)0) /* Left (ndpi_node *)0? */
q = r;
else if (r != (ndpi_node *)0) { /* Right link is null? */
if (r->left == (ndpi_node *)0) { /* D2: Find successor */
r->left = q;
q = r;
} else { /* D3: Find (ndpi_node *)0 link */
for (q = r->left; q->left != (ndpi_node *)0; q = r->left)
r = q;
r->left = q->right;
q->left = (*rootp)->left;
q->right = (*rootp)->right;
}
}
ndpi_free((ndpi_node *) *rootp); /* D4: Free node */
*rootp = q; /* link parent to new node */
return(p);
}
/* Walk the nodes of a tree */
static void
ndpi_trecurse(ndpi_node *root, void (*action)(const void *, ndpi_VISIT, int, void*), int level, void *user_data)
{
if (root->left == (ndpi_node *)0 && root->right == (ndpi_node *)0)
(*action)(root, ndpi_leaf, level, user_data);
else {
(*action)(root, ndpi_preorder, level, user_data);
if (root->left != (ndpi_node *)0)
ndpi_trecurse(root->left, action, level + 1, user_data);
(*action)(root, ndpi_postorder, level, user_data);
if (root->right != (ndpi_node *)0)
ndpi_trecurse(root->right, action, level + 1, user_data);
(*action)(root, ndpi_endorder, level, user_data);
}
}
/* Walk the nodes of a tree */
void
ndpi_twalk(const void *vroot, void (*action)(const void *, ndpi_VISIT, int, void *), void *user_data)
{
ndpi_node *root = (ndpi_node *)vroot;
if (root != (ndpi_node *)0 && action != (void (*)(const void *, ndpi_VISIT, int, void*))0)
ndpi_trecurse(root, action, 0, user_data);
}
/* find a node, or return 0 */
void *
ndpi_tfind(const void *vkey, void *vrootp,
int (*compar)(const void *, const void *))
{
char *key = (char *)vkey;
ndpi_node **rootp = (ndpi_node **)vrootp;
if (rootp == (ndpi_node **)0)
return ((ndpi_node *)0);
while (*rootp != (ndpi_node *)0) { /* T1: */
int r;
if ((r = (*compar)(key, (*rootp)->key)) == 0) /* T2: */
return (*rootp); /* key found */
rootp = (r < 0) ?
&(*rootp)->left : /* T3: follow left branch */
&(*rootp)->right; /* T4: follow right branch */
}
return (ndpi_node *)0;
}
/* ****************************************** */
/* Walk the nodes of a tree */
static void ndpi_tdestroy_recurse(ndpi_node* root, void (*free_action)(void *)) {
if (root->left != NULL)
ndpi_tdestroy_recurse(root->left, free_action);
if (root->right != NULL)
ndpi_tdestroy_recurse(root->right, free_action);
(*free_action) ((void *) root->key);
ndpi_free(root);
}
void ndpi_tdestroy(void *vrootp, void (*freefct)(void *)) {
ndpi_node *root = (ndpi_node *) vrootp;
if (root != NULL)
ndpi_tdestroy_recurse(root, freefct);
}
/* ****************************************** */
static void *(*_ndpi_malloc)(unsigned long size);
static void (*_ndpi_free)(void *ptr);
/* ****************************************** */
/* ****************************************** */
#ifdef WIN32
/* http://opensource.apple.com/source/Libc/Libc-186/string.subproj/strcasecmp.c */
/*
* This array is designed for mapping upper and lower case letter
* together for a case independent comparison. The mappings are
* based upon ascii character sequences.
*/
static const u_char charmap[] = {
'\000', '\001', '\002', '\003', '\004', '\005', '\006', '\007',
'\010', '\011', '\012', '\013', '\014', '\015', '\016', '\017',
'\020', '\021', '\022', '\023', '\024', '\025', '\026', '\027',
'\030', '\031', '\032', '\033', '\034', '\035', '\036', '\037',
'\040', '\041', '\042', '\043', '\044', '\045', '\046', '\047',
'\050', '\051', '\052', '\053', '\054', '\055', '\056', '\057',
'\060', '\061', '\062', '\063', '\064', '\065', '\066', '\067',
'\070', '\071', '\072', '\073', '\074', '\075', '\076', '\077',
'\100', '\141', '\142', '\143', '\144', '\145', '\146', '\147',
'\150', '\151', '\152', '\153', '\154', '\155', '\156', '\157',
'\160', '\161', '\162', '\163', '\164', '\165', '\166', '\167',
'\170', '\171', '\172', '\133', '\134', '\135', '\136', '\137',
'\140', '\141', '\142', '\143', '\144', '\145', '\146', '\147',
'\150', '\151', '\152', '\153', '\154', '\155', '\156', '\157',
'\160', '\161', '\162', '\163', '\164', '\165', '\166', '\167',
'\170', '\171', '\172', '\173', '\174', '\175', '\176', '\177',
'\200', '\201', '\202', '\203', '\204', '\205', '\206', '\207',
'\210', '\211', '\212', '\213', '\214', '\215', '\216', '\217',
'\220', '\221', '\222', '\223', '\224', '\225', '\226', '\227',
'\230', '\231', '\232', '\233', '\234', '\235', '\236', '\237',
'\240', '\241', '\242', '\243', '\244', '\245', '\246', '\247',
'\250', '\251', '\252', '\253', '\254', '\255', '\256', '\257',
'\260', '\261', '\262', '\263', '\264', '\265', '\266', '\267',
'\270', '\271', '\272', '\273', '\274', '\275', '\276', '\277',
'\300', '\301', '\302', '\303', '\304', '\305', '\306', '\307',
'\310', '\311', '\312', '\313', '\314', '\315', '\316', '\317',
'\320', '\321', '\322', '\323', '\324', '\325', '\326', '\327',
'\330', '\331', '\332', '\333', '\334', '\335', '\336', '\337',
'\340', '\341', '\342', '\343', '\344', '\345', '\346', '\347',
'\350', '\351', '\352', '\353', '\354', '\355', '\356', '\357',
'\360', '\361', '\362', '\363', '\364', '\365', '\366', '\367',
'\370', '\371', '\372', '\373', '\374', '\375', '\376', '\377',
};
int
strcasecmp(s1, s2)
const char *s1, *s2;
{
register const u_char *cm = charmap,
*us1 = (const u_char *)s1,
*us2 = (const u_char *)s2;
while (cm[*us1] == cm[*us2++])
if (*us1++ == '\0')
return (0);
return (cm[*us1] - cm[*--us2]);
}
int
strncasecmp(s1, s2, n)
const char *s1, *s2;
register size_t n;
{
if (n != 0) {
register const u_char *cm = charmap,
*us1 = (const u_char *)s1,
*us2 = (const u_char *)s2;
do {
if (cm[*us1] != cm[*us2++])
return (cm[*us1] - cm[*--us2]);
if (*us1++ == '\0')
break;
} while (--n != 0);
}
return (0);
}
#endif
/* ****************************************** */
/* Forward */
static void addDefaultPort(ndpi_port_range *range,
ndpi_proto_defaults_t *def, ndpi_default_ports_tree_node_t **root);
static int removeDefaultPort(ndpi_port_range *range,
ndpi_proto_defaults_t *def, ndpi_default_ports_tree_node_t **root);
/* ****************************************** */
void* ndpi_malloc(unsigned long size) { return(_ndpi_malloc(size)); }
/* ****************************************** */
void* ndpi_calloc(unsigned long count, unsigned long size) {
unsigned long len = count*size;
void *p = ndpi_malloc(len);
if(p)
memset(p, 0, len);
return(p);
}
/* ****************************************** */
void ndpi_free(void *ptr) { _ndpi_free(ptr); }
/* ****************************************** */
void *ndpi_realloc(void *ptr, size_t old_size, size_t new_size) {
void *ret = ndpi_malloc(new_size);
if(!ret)
return(ret);
else {
memcpy(ret, ptr, old_size);
ndpi_free(ptr);
return(ret);
}
}
/* ****************************************** */
char *ndpi_strdup(const char *s) {
int len = strlen(s);
char *m = ndpi_malloc(len+1);
if(m) {
memcpy(m, s, len);
m[len] = '\0';
}
return(m);
}
/* ****************************************** */
u_int32_t ndpi_detection_get_sizeof_ndpi_flow_struct(void)
{
return sizeof(struct ndpi_flow_struct);
}
/* ****************************************** */
u_int32_t ndpi_detection_get_sizeof_ndpi_id_struct(void)
{
return sizeof(struct ndpi_id_struct);
}
/* ******************************************************************** */
char* ndpi_get_proto_by_id(struct ndpi_detection_module_struct *ndpi_mod, u_int id) {
return((id >= ndpi_mod->ndpi_num_supported_protocols) ? NULL : ndpi_mod->proto_defaults[id].protoName);
}
/* ******************************************************************** */
void ndpi_enable_cache(struct ndpi_detection_module_struct *ndpi_mod, char* redis_host, u_int redis_port) {
#if 0
if(((ndpi_mod->redis = ndpi_credis_connect(redis_host, redis_port, 10000)) == NULL)
|| (ndpi_credis_ping(ndpi_mod->redis) != 0)) {
printf("Redis Connection error: %s:%d", redis_host, redis_port);
ndpi_mod->redis = NULL;
}
#endif
}
/* ******************************************************************** */
ndpi_port_range* ndpi_build_default_ports_range(ndpi_port_range *ports,
u_int16_t portA_low, u_int16_t portA_high,
u_int16_t portB_low, u_int16_t portB_high,
u_int16_t portC_low, u_int16_t portC_high,
u_int16_t portD_low, u_int16_t portD_high,
u_int16_t portE_low, u_int16_t portE_high) {
int i = 0;
ports[i].port_low = portA_low, ports[i].port_high = portA_high; i++;
ports[i].port_low = portB_low, ports[i].port_high = portB_high; i++;
ports[i].port_low = portC_low, ports[i].port_high = portC_high; i++;
ports[i].port_low = portD_low, ports[i].port_high = portD_high; i++;
ports[i].port_low = portE_low, ports[i].port_high = portE_high; i++;
return(ports);
}
/* ******************************************************************** */
ndpi_port_range* ndpi_build_default_ports(ndpi_port_range *ports,
u_int16_t portA,
u_int16_t portB,
u_int16_t portC,
u_int16_t portD,
u_int16_t portE) {
int i = 0;
ports[i].port_low = portA, ports[i].port_high = portA; i++;
ports[i].port_low = portB, ports[i].port_high = portB; i++;
ports[i].port_low = portC, ports[i].port_high = portC; i++;
ports[i].port_low = portD, ports[i].port_high = portD; i++;
ports[i].port_low = portE, ports[i].port_high = portE; i++;
return(ports);
}
/* ******************************************************************** */
void ndpi_set_proto_defaults(struct ndpi_detection_module_struct *ndpi_mod,
u_int16_t protoId, char *protoName,
ndpi_port_range *tcpDefPorts, ndpi_port_range *udpDefPorts) {
char *name = ndpi_strdup(protoName);
int j;
if(protoId >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) {
printf("[NDPI] %s(protoId=%d): INTERNAL ERROR\n", __FUNCTION__, protoId);
return;
}
ndpi_mod->proto_defaults[protoId].protoName = name,
ndpi_mod->proto_defaults[protoId].protoId = protoId;
for(j=0; jproto_defaults[protoId], &ndpi_mod->udpRoot);
if(tcpDefPorts[j].port_low != 0) addDefaultPort(&tcpDefPorts[j], &ndpi_mod->proto_defaults[protoId], &ndpi_mod->tcpRoot);
}
#if 0
printf("%s(%d, %s, %p) [%s]\n",
__FUNCTION__,
protoId,
ndpi_mod->proto_defaults[protoId].protoName,
ndpi_mod,
ndpi_mod->proto_defaults[1].protoName);
#endif
}
/* ******************************************************************** */
static int ndpi_default_ports_tree_node_t_cmp(const void *a, const void *b) {
ndpi_default_ports_tree_node_t *fa = (ndpi_default_ports_tree_node_t*)a;
ndpi_default_ports_tree_node_t *fb = (ndpi_default_ports_tree_node_t*)b;
// printf("[NDPI] %s(%d, %d)\n", __FUNCTION__, fa->default_port, fb->default_port);
return((fa->default_port == fb->default_port) ? 0 : ((fa->default_port < fb->default_port) ? -1 : 1));
}
/* ******************************************************************** */
void ndpi_default_ports_tree_node_t_walker(const void *node, const ndpi_VISIT which, const int depth) {
ndpi_default_ports_tree_node_t *f = *(ndpi_default_ports_tree_node_t **)node;
printf("<%d>Walk on node %s (%u)\n",
depth,
which == ndpi_preorder?"ndpi_preorder":
which == ndpi_postorder?"ndpi_postorder":
which == ndpi_endorder?"ndpi_endorder":
which == ndpi_leaf?"ndpi_leaf": "unknown",
f->default_port);
}
/* ******************************************************************** */
static void addDefaultPort(ndpi_port_range *range,
ndpi_proto_defaults_t *def, ndpi_default_ports_tree_node_t **root) {
ndpi_default_ports_tree_node_t *node = (ndpi_default_ports_tree_node_t*)ndpi_malloc(sizeof(ndpi_default_ports_tree_node_t));
// printf("[NDPI] %s(%d)\n", __FUNCTION__, port);
if(!node) {
printf("[NDPI] %s(): not enough memory\n", __FUNCTION__);
} else {
ndpi_default_ports_tree_node_t *ret;
u_int16_t port;
for(port=range->port_low; port<=range->port_high; port++) {
node->proto = def, node->default_port = port;
ret = *(ndpi_default_ports_tree_node_t**)ndpi_tsearch(node, (void*)root, ndpi_default_ports_tree_node_t_cmp); /* Add it to the tree */
if(ret != node) {
printf("[NDPI] %s(): found duplicate for port %u\n", __FUNCTION__, port);
ndpi_free(node);
break;
}
}
}
}
/* ****************************************************** */
/*
NOTE
This function must be called with a semaphore set, this in order to avoid
changing the datastrutures while using them
*/
static int removeDefaultPort(ndpi_port_range *range,
ndpi_proto_defaults_t *def,
ndpi_default_ports_tree_node_t **root) {
ndpi_default_ports_tree_node_t node;
ndpi_default_ports_tree_node_t *ret;
u_int16_t port;
for(port=range->port_low; port<=range->port_high; port++) {
node.proto = def, node.default_port = port;
ret = *(ndpi_default_ports_tree_node_t**)ndpi_tdelete(&node, (void*)root,
ndpi_default_ports_tree_node_t_cmp); /* Add it to the tree */
if(ret != NULL) {
ndpi_free((ndpi_default_ports_tree_node_t*)ret);
return(0);
}
}
return(-1);
}
/* ****************************************************** */
static int ndpi_add_host_url_subprotocol(struct ndpi_detection_module_struct *ndpi_struct,
char *attr, char *value, int protocol_id) {
AC_PATTERN_t ac_pattern;
/* e.g attr = "host" value = ".facebook.com" protocol_id = NDPI_PROTOCOL_FACEBOOK */
#ifdef DEBUG
printf("[NDPI] ndpi_add_host_url_subprotocol(%s, %s, %d)\n", attr, value, protocol_id);
#endif
if(protocol_id >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) {
printf("[NDPI] %s(protoId=%d): INTERNAL ERROR\n", __FUNCTION__, protocol_id);
return(-1);
}
/* The attribute is added here for future use */
if (strcmp(attr, "host") != 0) {
#ifdef DEBUG
printf("[NTOP] attribute %s not supported\n", attr);
#endif
return(-1);
}
if(ndpi_struct->ac_automa == NULL) return(-2);
ac_pattern.astring = value;
ac_pattern.rep.number = protocol_id;
ac_pattern.length = strlen(ac_pattern.astring);
ac_automata_add(((AC_AUTOMATA_t*)ndpi_struct->ac_automa), &ac_pattern);
#ifdef DEBUG
printf("[NTOP] new subprotocol: %s = %s -> %d\n", attr, value, protocol_id);
#endif
return(0);
}
/* ****************************************************** */
/*
NOTE
This function must be called with a semaphore set, this in order to avoid
changing the datastrutures while using them
*/
static int ndpi_remove_host_url_subprotocol(struct ndpi_detection_module_struct *ndpi_struct,
char *attr, char *value, int protocol_id) {
printf("[NDPI] Missing implementation of %s()\n", __FUNCTION__);
return(-1);
}
/* ******************************************************************** */
ndpi_protocol_match host_match[] = {
{ ".twitter.com", "Twitter", NDPI_PROTOCOL_TWITTER },
{ ".twttr.com", "Twitter", NDPI_PROTOCOL_TWITTER },
{ ".netflix.com", "NetFlix", NDPI_PROTOCOL_NETFLIX },
{ ".facebook.com", "FaceBook", NDPI_PROTOCOL_FACEBOOK },
{ ".fbcdn.net", "FaceBook", NDPI_PROTOCOL_FACEBOOK },
{ "fbcdn-", "FaceBook", NDPI_PROTOCOL_FACEBOOK }, /* fbcdn-video-a-akamaihd.net */
{ ".dropbox.com", "DropBox", NDPI_PROTOCOL_DROPBOX },
{ ".gmail.", "GoogleGmail", NDPI_PROTOCOL_GMAIL },
{ "maps.google.com", "GoogleMaps", NDPI_PROTOCOL_GOOGLE_MAPS },
{ "maps.gstatic.com", "GoogleMaps", NDPI_PROTOCOL_GOOGLE_MAPS },
{ ".gstatic.com", "Google", NDPI_PROTOCOL_GOOGLE },
{ ".google.com", "Google", NDPI_PROTOCOL_GOOGLE },
{ ".youtube.", "YouTube", NDPI_PROTOCOL_YOUTUBE },
{ "itunes.apple.com", "AppleiTunes", NDPI_PROTOCOL_APPLE_ITUNES },
{ ".apple.com", "Apple", NDPI_PROTOCOL_APPLE },
{ ".mzstatic.com", "Apple", NDPI_PROTOCOL_APPLE },
{ ".icloud.com", "AppleiCloud", NDPI_PROTOCOL_APPLE_ICLOUD },
{ ".viber.com", "Viber", NDPI_PROTOCOL_VIBER },
{ ".last.fm", "LastFM", NDPI_PROTOCOL_LASTFM },
{ ".grooveshark.com", "GrooveShark", NDPI_PROTOCOL_GROOVESHARK },
{ ".tuenti.com", "Tuenti", NDPI_PROTOCOL_TUENTI },
{ ".skype.com", "Skype", NDPI_PROTOCOL_SKYPE },
{ ".skypeassets.com", "Skype", NDPI_PROTOCOL_SKYPE },
{ ".yahoo.", "Yahoo", NDPI_PROTOCOL_YAHOO },
{ NULL, 0 }
};
static void init_string_based_protocols(struct ndpi_detection_module_struct *ndpi_mod) {
int i;
for(i=0; host_match[i].string_to_match != NULL; i++) {
ndpi_add_host_url_subprotocol(ndpi_mod, "host", host_match[i].string_to_match, host_match[i].protocol_id);
if(ndpi_mod->proto_defaults[host_match[i].protocol_id].protoName == NULL) {
ndpi_mod->proto_defaults[host_match[i].protocol_id].protoName = ndpi_strdup(host_match[i].proto_name);
ndpi_mod->proto_defaults[host_match[i].protocol_id].protoId = host_match[i].protocol_id;
}
}
}
/* ******************************************************************** */
/* This function is used to map protocol name and default ports and it MUST
be updated whenever a new protocol is added to NDPI
*/
static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndpi_mod) {
int i;
ndpi_port_range ports_a[MAX_DEFAULT_PORTS], ports_b[MAX_DEFAULT_PORTS];
/* Reset all settings */
memset(ndpi_mod->proto_defaults, 0, sizeof(ndpi_mod->proto_defaults));
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNKNOWN, "Unknown",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FTP, "FTP",
ndpi_build_default_ports(ports_a, 20, 21, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MAIL_POP, "POP",
ndpi_build_default_ports(ports_a, 110, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MAIL_POPS, "POPS",
ndpi_build_default_ports(ports_a, 995, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MAIL_SMTP, "SMTP",
ndpi_build_default_ports(ports_a, 25, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MAIL_SMTPS, "SMTPS",
ndpi_build_default_ports(ports_a, 465, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MAIL_IMAP, "IMAP",
ndpi_build_default_ports(ports_a, 143, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MAIL_IMAPS, "IMAPS",
ndpi_build_default_ports(ports_a, 993, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DNS, "DNS",
ndpi_build_default_ports(ports_a, 53, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 53, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_IPP, "IPP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_HTTP, "HTTP",
ndpi_build_default_ports(ports_a, 80, 0 /* ntop */, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MDNS, "MDNS",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 5353, 5354, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_NTP, "NTP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 123, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_NETBIOS, "NetBIOS",
ndpi_build_default_ports(ports_a, 139, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 137, 138, 139, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_NFS, "NFS",
ndpi_build_default_ports(ports_a, 2049, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 2049, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SSDP, "SSDP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_BGP, "BGP",
ndpi_build_default_ports(ports_a, 2605, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SNMP, "SNMP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 161, 162, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_XDMCP, "XDMCP",
ndpi_build_default_ports(ports_a, 177, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 177, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SMB, "SMB",
ndpi_build_default_ports(ports_a, 445, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SYSLOG, "Syslog",
ndpi_build_default_ports(ports_a, 514, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 514, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DHCP, "DHCP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 67, 68, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POSTGRES, "PostgreSQL",
ndpi_build_default_ports(ports_a, 5432, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MYSQL, "MySQL",
ndpi_build_default_ports(ports_a, 3306, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TDS, "TDS",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, "Direct_Download_Link",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_APPLEJUICE, "AppleJuice",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DIRECTCONNECT, "DirectConnect",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SOCRATES, "Socrates",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WINMX, "WinMX",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_VMWARE, "VMware",
ndpi_build_default_ports(ports_a, 903, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 902, 903, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FILETOPIA, "Filetopia",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_IMESH, "iMESH",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_KONTIKI, "Kontiki",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_OPENFT, "OpenFT",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FASTTRACK, "FastTrack",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_GNUTELLA, "Gnutella",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_EDONKEY, "eDonkey",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_BITTORRENT, "BitTorrent",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_OFF, "Off",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_AVI, "AVI",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FLASH, "AdobeFlash",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_OGG, "OggVorbis",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MPEG, "MPEG",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_QUICKTIME, "QuickTime",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_REALMEDIA, "RealMedia",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WINDOWSMEDIA, "WindowsMedia",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MMS, "MMS",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_XBOX, "Xbox",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_QQ, "QQ",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MOVE, "Move",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_RTSP, "RTSP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 554, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ICECAST, "IceCast",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_PPLIVE, "PPlive",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_PPSTREAM, "PPstream",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ZATTOO, "Zattoo",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SHOUTCAST, "ShoutCast",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SOPCAST, "Sopcast",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TVANTS, "Tvants",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TVUPLAYER, "TVUplayer",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV, "HTTP_APPLICATION_VEOHTV",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_QQLIVE, "QQlive",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_THUNDER, "Thunder",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SOULSEEK, "Soulseek",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SSL_NO_CERT, "SSL_No_Cert",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_IRC, "IRC",
ndpi_build_default_ports(ports_a, 194, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 194, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POPO, "POPO",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNENCRYPED_JABBER, "Unencryped_Jabber",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MSN, "MSN",
ndpi_build_default_ports(ports_a, 1863, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_OSCAR, "Oscar",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_YAHOO, "Yahoo",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_BATTLEFIELD, "BattleField",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_QUAKE, "Quake",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_VRRP, "VRRP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_STEAM, "Steam",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_HALFLIFE2, "HalfLife2",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WORLDOFWARCRAFT, "WorldOfWarcraft",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TELNET, "Telnet",
ndpi_build_default_ports(ports_a, 23, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_STUN, "STUN",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_IPSEC, "IPsec",
ndpi_build_default_ports(ports_a, 500, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 500, 4500, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_GRE, "GRE",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ICMP, "ICMP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_IGMP, "IGMP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_EGP, "EGP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SCTP, "SCTP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_OSPF, "OSPF",
ndpi_build_default_ports(ports_a, 2604, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_IP_IN_IP, "IPinIP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_RTP, "RTP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_RDP, "RDP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_VNC, "VNC",
ndpi_build_default_ports(ports_a, 5900, 5901, 5800, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_PCANYWHERE, "PcAnywhere",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SSL, "SSL",
ndpi_build_default_ports(ports_a, 443, 3001 /* ntop */, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SSH, "SSH",
ndpi_build_default_ports(ports_a, 22, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_USENET, "Usenet",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MGCP, "MGCP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_IAX, "IAX",
ndpi_build_default_ports(ports_a, 4569, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 4569, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TFTP, "TFTP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_AFP, "AFP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_STEALTHNET, "Stealthnet",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_AIMINI, "Aimini",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SIP, "SIP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 5060, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TRUPHONE, "TruPhone",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ICMPV6, "ICMPV6",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DHCPV6, "DHCPV6",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ARMAGETRON, "Armagetron",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_CROSSFIRE, "Crossfire",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DOFUS, "Dofus",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FIESTA, "Fiesta",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FLORENSIA, "Florensia",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_GUILDWARS, "Guildwars",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC, "HTTP_Application_ActiveSync",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_KERBEROS, "Kerberos",
ndpi_build_default_ports(ports_a, 88, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 88, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_LDAP, "LDAP",
ndpi_build_default_ports(ports_a, 389, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 389, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MAPLESTORY, "MapleStory",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MSSQL, "MsSQL",
ndpi_build_default_ports(ports_a, 1433, 1434, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_PPTP, "PPTP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WARCRAFT3, "Warcraft3",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WORLD_OF_KUNG_FU, "WorldOfKungFu",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_MEEBO, "Meebo",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TWITTER, "Twitter",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DROPBOX, "DropBox",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SKYPE, "Skype",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_GOOGLE, "Google",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_DCERPC, "DCE_RPC",
ndpi_build_default_ports(ports_a, 135, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_NETFLOW, "NetFlow",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 2055, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SFLOW, "sFlow",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 6343, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_HTTP_CONNECT, "HTTP_Connect",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_HTTP_PROXY, "HTTP_Proxy",
ndpi_build_default_ports(ports_a, 8080, 3128, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_CITRIX, "Citrix",
ndpi_build_default_ports(ports_a, 1494, 2598, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_NETFLIX, "NetFlix",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SKYFILE_PREPAID, "SkyFile_PrePaid",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SKYFILE_RUDICS, "SkyFile_Rudics",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SKYFILE_POSTPAID, "SkyFile_PostPaid",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_CITRIX_ONLINE, "Citrix_Online",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_APPLE, "Apple",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WEBEX, "Webex",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WHATSAPP, "WhatsApp",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_RADIUS, "Radius",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WINDOWS_UPDATE, "WindowsUpdate",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TEAMVIEWER, "TeamViewer",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_LOTUS_NOTES, "LotusNotes",
ndpi_build_default_ports(ports_a, 1352, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAP, "SAP",
ndpi_build_default_ports(ports_a, 3201, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_GTP, "GTP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 2152, 2123, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UPNP, "UPnP",
ndpi_build_default_ports(ports_a, 1780, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 1900, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */
/* http://en.wikipedia.org/wiki/Link-local_Multicast_Name_Resolution */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_LLMNR, "LLMNR",
ndpi_build_default_ports(ports_a, 5355, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 5355, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_REMOTE_SCAN, "RemoteScan",
ndpi_build_default_ports(ports_a, 6077, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 6078, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SPOTIFY, "Spotify",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WEBM, "WebM", /* Courtesy of Shreeram Ramamoorthy Swaminathan */
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_H323, "H323",
ndpi_build_default_ports(ports_a, 1719, 1720, 3478, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 1719, 1720, 3478, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_OPENVPN, "OpenVPN",
ndpi_build_default_ports(ports_a, 1194, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 1194, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_NOE, "NOE",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_CISCOVPN, "CiscoVPN",
ndpi_build_default_ports(ports_a, 10000, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 10000, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TEAMSPEAK, "TeamSpeak",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_TOR, "Tor",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SKINNY, "CiscoSkinny",
ndpi_build_default_ports(ports_a, 2000, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_RTCP, "RTCP",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_RSYNC, "RSYNC",
ndpi_build_default_ports(ports_a, 873, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ORACLE, "Oracle",
ndpi_build_default_ports(ports_a, 1521, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_CORBA, "Corba",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UBUNTUONE, "UbuntuONE",
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_WHOIS_DAS, "Whois-DAS",
ndpi_build_default_ports(ports_a, 43, 4343, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
init_string_based_protocols(ndpi_mod);
for(i=0; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++) {
if(ndpi_mod->proto_defaults[i].protoName == NULL) {
printf("[NDPI] %s(missing protoId=%d) INTERNAL ERROR: not all protocols have been initialized\n", __FUNCTION__, i);
}
}
}
/* ****************************************************** */
static int ac_match_handler(AC_MATCH_t *m, void *param) {
int *matching_protocol_id = (int*)param;
/* Stopping to the first match. We might consider searching
* for the more specific match, paying more cpu cycles. */
*matching_protocol_id = m->patterns[0].rep.number;
return 1; /* 0 to continue searching, !0 to stop */
}
/* ******************************************************************** */
struct ndpi_detection_module_struct *ndpi_init_detection_module(u_int32_t ticks_per_second,
void* (*__ndpi_malloc)(unsigned long size),
void (*__ndpi_free)(void *ptr),
ndpi_debug_function_ptr ndpi_debug_printf)
{
struct ndpi_detection_module_struct *ndpi_str;
_ndpi_malloc = __ndpi_malloc;
_ndpi_free = __ndpi_free;
ndpi_str = ndpi_malloc(sizeof(struct ndpi_detection_module_struct));
if (ndpi_str == NULL) {
ndpi_debug_printf(0, NULL, NDPI_LOG_DEBUG, "ndpi_init_detection_module initial malloc failed\n");
return NULL;
}
memset(ndpi_str, 0, sizeof(struct ndpi_detection_module_struct));
#ifdef HAVE_REDIS
ndpi_str->redis = NULL;
#endif
NDPI_BITMASK_RESET(ndpi_str->detection_bitmask);
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
ndpi_str->ndpi_debug_printf = ndpi_debug_printf;
ndpi_str->user_data = NULL;
#endif
ndpi_str->ticks_per_second = ticks_per_second;
ndpi_str->tcp_max_retransmission_window_size = NDPI_DEFAULT_MAX_TCP_RETRANSMISSION_WINDOW_SIZE;
ndpi_str->directconnect_connection_ip_tick_timeout =
NDPI_DIRECTCONNECT_CONNECTION_IP_TICK_TIMEOUT * ticks_per_second;
ndpi_str->edonkey_upper_ports_only = NDPI_EDONKEY_UPPER_PORTS_ONLY;
ndpi_str->ftp_connection_timeout = NDPI_FTP_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->pplive_connection_timeout = NDPI_PPLIVE_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->rtsp_connection_timeout = NDPI_RTSP_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->tvants_connection_timeout = NDPI_TVANTS_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->irc_timeout = NDPI_IRC_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->gnutella_timeout = NDPI_GNUTELLA_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->battlefield_timeout = NDPI_BATTLEFIELD_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->thunder_timeout = NDPI_THUNDER_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->yahoo_detect_http_connections = NDPI_YAHOO_DETECT_HTTP_CONNECTIONS;
ndpi_str->yahoo_lan_video_timeout = NDPI_YAHOO_LAN_VIDEO_TIMEOUT * ticks_per_second;
ndpi_str->zattoo_connection_timeout = NDPI_ZATTOO_CONNECTION_TIMEOUT * ticks_per_second;
ndpi_str->jabber_stun_timeout = NDPI_JABBER_STUN_TIMEOUT * ticks_per_second;
ndpi_str->jabber_file_transfer_timeout = NDPI_JABBER_FT_TIMEOUT * ticks_per_second;
ndpi_str->soulseek_connection_ip_tick_timeout = NDPI_SOULSEEK_CONNECTION_IP_TICK_TIMEOUT * ticks_per_second;
ndpi_str->ndpi_num_supported_protocols = NDPI_MAX_SUPPORTED_PROTOCOLS;
ndpi_str->ndpi_num_custom_protocols = 0;
ndpi_str->ac_automa = ac_automata_init(ac_match_handler);
ndpi_init_lru_cache(&ndpi_str->skypeCache, 4096);
#ifndef __KERNEL__
pthread_mutex_init(&ndpi_str->skypeCacheLock, NULL);
#else
spin_lock_init(&ndpi_str->skypeCacheLock);
#endif
ndpi_init_protocol_defaults(ndpi_str);
return ndpi_str;
}
void ndpi_exit_detection_module(struct ndpi_detection_module_struct
*ndpi_struct, void (*ndpi_free) (void *ptr))
{
if(ndpi_struct != NULL) {
int i;
for(i=0; i<(int)ndpi_struct->ndpi_num_supported_protocols; i++) {
if(ndpi_struct->proto_defaults[i].protoName)
ndpi_free(ndpi_struct->proto_defaults[i].protoName);
}
ndpi_tdestroy(ndpi_struct->udpRoot, ndpi_free);
ndpi_tdestroy(ndpi_struct->tcpRoot, ndpi_free);
if(ndpi_struct->ac_automa != NULL)
ac_automata_release((AC_AUTOMATA_t*)ndpi_struct->ac_automa);
ndpi_free_lru_cache(&ndpi_struct->skypeCache);
#ifndef __KERNEL__
pthread_mutex_destroy(&ndpi_struct->skypeCacheLock);
#endif
ndpi_free(ndpi_struct);
}
}
/* ******************************************************************** */
#ifndef __KERNEL__
static int add_proto_default_port(u_int16_t **ports, u_int16_t new_port,
ndpi_proto_defaults_t *def,
ndpi_default_ports_tree_node_t *root) {
u_int num_ports, i;
if(*ports == NULL) {
ndpi_port_range range = { new_port, new_port };
addDefaultPort(&range, def, &root);
return(0);
}
for(num_ports=0; (*ports)[num_ports] != 0; num_ports++)
;
if(num_ports >= MAX_DEFAULT_PORTS) {
printf("Too many ports defined: ignored port %d\n", new_port);
return(-1);
} else {
u_int16_t *new_ports = (u_int16_t*)ndpi_malloc(num_ports+1);
ndpi_port_range range;
if(new_ports == NULL) {
printf("Not enough memory\n");
return(-2);
}
for(i=0; indpi_num_supported_protocols);
}
/* ******************************************************************** */
int ndpi_handle_rule(struct ndpi_detection_module_struct *ndpi_mod, char* rule, u_int8_t do_add) {
char *at, *proto, *elem;
ndpi_proto_defaults_t *def;
int subprotocol_id, i;
at = strrchr(rule, '@');
if(at == NULL) {
printf("Invalid rule '%s'\n", rule);
return(-1);
} else
at[0] = 0, proto = &at[1];
for(i=0, def = NULL; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++) {
if(strcasecmp(ndpi_mod->proto_defaults[i].protoName, proto) == 0) {
def = &ndpi_mod->proto_defaults[i];
subprotocol_id = i;
break;
}
}
if(def == NULL) {
if(!do_add) {
/* We need to remove a rule */
printf("Unable to find protocol '%s': skipping rule '%s'\n", proto, rule);
return(-3);
} else {
ndpi_port_range ports_a[MAX_DEFAULT_PORTS], ports_b[MAX_DEFAULT_PORTS];
if(ndpi_mod->ndpi_num_custom_protocols >= (NDPI_MAX_NUM_CUSTOM_PROTOCOLS-1)) {
printf("Too many protocols defined (%u): skipping protocol %s\n",
ndpi_mod->ndpi_num_custom_protocols, proto);
return(-2);
}
ndpi_set_proto_defaults(ndpi_mod, ndpi_mod->ndpi_num_supported_protocols, ndpi_strdup(proto),
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
def = &ndpi_mod->proto_defaults[ndpi_mod->ndpi_num_supported_protocols];
subprotocol_id = ndpi_mod->ndpi_num_supported_protocols;
ndpi_mod->ndpi_num_supported_protocols++, ndpi_mod->ndpi_num_custom_protocols++;
}
}
while((elem = strsep(&rule, ",")) != NULL) {
char *attr = elem, *value = NULL;
ndpi_port_range range;
int is_tcp = 0, is_udp = 0;
if (strncmp(attr, "tcp:", 4) == 0)
is_tcp = 1, value = &attr[4];
else if (strncmp(attr, "udp:", 4) == 0)
is_udp = 1, value = &attr[4];
else if (strncmp(attr, "host:", 5) == 0) {
/* host:"",host:"",.....@ */
value = &attr[5];
if (value[0] == '"') value++; /* remove leading " */
if (value[strlen(value)-1] == '"') value[strlen(value)-1] = '\0'; /* remove trailing " */
}
if (is_tcp || is_udp) {
if(sscanf(value, "%u-%u", (unsigned int *)&range.port_low, (unsigned int *)&range.port_high) != 2)
range.port_low = range.port_high = atoi(&elem[4]);
if(do_add)
addDefaultPort(&range, def, is_tcp ? &ndpi_mod->tcpRoot : &ndpi_mod->udpRoot);
else
removeDefaultPort(&range, def, is_tcp ? &ndpi_mod->tcpRoot : &ndpi_mod->udpRoot);
} else {
if(do_add)
ndpi_add_host_url_subprotocol(ndpi_mod, "host", value, subprotocol_id);
else
ndpi_remove_host_url_subprotocol(ndpi_mod, "host", value, subprotocol_id);
}
}
return(0);
}
/* ******************************************************************** */
/*
Format:
:,:,.....@
Example:
tcp:80,tcp:3128@HTTP
udp:139@NETBIOS
*/
int ndpi_load_protocols_file(struct ndpi_detection_module_struct *ndpi_mod, char* path) {
#ifdef __KERNEL__
return(0);
#else
FILE *fd = fopen(path, "r");
int i;
if(fd == NULL) {
printf("Unable to open file %s [%s]", path, strerror(errno));
return(-1);
}
while(fd) {
char buffer[512], *line;
if(!(line = fgets(buffer, sizeof(buffer), fd)))
break;
if(((i = strlen(line)) <= 1) || (line[0] == '#'))
continue;
else
line[i-1] = '\0';
ndpi_handle_rule(ndpi_mod, line, 1);
}
fclose(fd);
#if 0
printf("\nTCP:\n");
ndpi_twalk(tcpRoot, ndpi_default_ports_tree_node_t_walker, NULL);
printf("\nUDP:\n");
ndpi_twalk(udpRoot, ndpi_default_ports_tree_node_t_walker, NULL);
#endif
#endif
return(0);
}
/* ******************************************************************** */
void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *ndpi_struct,
const NDPI_PROTOCOL_BITMASK * dbm)
{
NDPI_PROTOCOL_BITMASK detection_bitmask_local;
NDPI_PROTOCOL_BITMASK *detection_bitmask = &detection_bitmask_local;
u_int32_t a = 0;
NDPI_BITMASK_SET(detection_bitmask_local, *dbm);
NDPI_BITMASK_SET(ndpi_struct->detection_bitmask, *dbm);
/* set this here to zero to be interrupt safe */
ndpi_struct->callback_buffer_size = 0;
#ifdef NDPI_PROTOCOL_HTTP
#ifdef NDPI_PROTOCOL_MPEG
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MPEG) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_FLASH
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_FLASH) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_QUICKTIME
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_QUICKTIME) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_REALMEDIA
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_REALMEDIA) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_WINDOWSMEDIA
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_WINDOWSMEDIA) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_MMS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MMS) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_OFF
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_OFF) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_XBOX
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_XBOX) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_WINDOWS_UPDATE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_WINDOWS_UPDATE) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_QQ
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_QQ) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_AVI
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_AVI) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_OGG
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_OGG) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_MOVE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MOVE) != 0)
goto hack_do_http_detection;
#endif
#ifdef NDPI_PROTOCOL_RTSP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_RTSP) != 0)
goto hack_do_http_detection;
#endif
/* HTTP DETECTION MUST BE BEFORE DDL BUT AFTER ALL OTHER PROTOCOLS WHICH USE HTTP ALSO */
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_HTTP) != 0) {
hack_do_http_detection:
// ndpi_struct->subprotocol_conf[NDPI_PROTOCOL_HTTP].func = ndpi_http_subprotocol_conf;
ndpi_struct->callback_buffer[a].func = ndpi_search_http_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#ifdef NDPI_PROTOCOL_MPEG
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_MPEG);
#endif
#ifdef NDPI_PROTOCOL_FLASH
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_FLASH);
#endif
#ifdef NDPI_PROTOCOL_QUICKTIME
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_QUICKTIME);
#endif
#ifdef NDPI_PROTOCOL_REALMEDIA
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_REALMEDIA);
#endif
#ifdef NDPI_PROTOCOL_WINDOWSMEDIA
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask,
NDPI_PROTOCOL_WINDOWSMEDIA);
#endif
#ifdef NDPI_PROTOCOL_MMS
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_MMS);
#endif
#ifdef NDPI_PROTOCOL_OFF
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_OFF);
#endif
#ifdef NDPI_PROTOCOL_XBOX
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_XBOX);
#endif
#ifdef NDPI_PROTOCOL_WINDOWS_UPDATE
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_WINDOWS_UPDATE);
#endif
#ifdef NDPI_PROTOCOL_QQ
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_QQ);
#endif
#ifdef NDPI_PROTOCOL_AVI
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_AVI);
#endif
#ifdef NDPI_PROTOCOL_OGG
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_OGG);
#endif
#ifdef NDPI_PROTOCOL_MOVE
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_MOVE);
#endif
#ifdef NDPI_PROTOCOL_RTSP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_RTSP);
#endif
NDPI_BITMASK_SET(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
ndpi_struct->callback_buffer[a].detection_bitmask);
NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_UNKNOWN);
NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_QQ);
#ifdef NDPI_PROTOCOL_FLASH
NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_FLASH);
#endif
NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_MMS);
#ifdef NDPI_PROTOCOL_RTSP
NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_RTSP);
#endif
NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_XBOX);
NDPI_BITMASK_SET(ndpi_struct->generic_http_packet_bitmask,
ndpi_struct->callback_buffer[a].detection_bitmask);
NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->generic_http_packet_bitmask, NDPI_PROTOCOL_UNKNOWN);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SSL
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SSL) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ssl_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SSL);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SSL);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_STUN
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_STUN) != 0
#ifdef NDPI_PROTOCOL_RTP
|| NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_RTP) != 0
#endif
) {
ndpi_struct->callback_buffer[a].func = ndpi_search_stun;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_STUN);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_RTP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_RTP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_rtp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
#ifdef NDPI_PROTOCOL_STUN
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_STUN);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_RTP);
/* consider also real protocol for detection select in main loop */
ndpi_struct->callback_buffer[a].detection_feature = NDPI_SELECT_DETECTION_WITH_REAL_PROTOCOL;
a++;
}
#endif
#ifdef NDPI_PROTOCOL_RDP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_RDP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_rdp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_RDP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SIP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SIP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_sip;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD; /* Fix courtesy of Miguel Quesada */
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SIP);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SIP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_BITTORRENT
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_BITTORRENT) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_bittorrent;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_BITTORRENT);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_BITTORRENT);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_EDONKEY
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_EDONKEY) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_edonkey;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_EDONKEY);
#ifdef NDPI_PROTOCOL_BITTORRENT
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_BITTORRENT);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_EDONKEY);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_FASTTRACK
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_FASTTRACK) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_fasttrack_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_FASTTRACK);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_GNUTELLA
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_GNUTELLA) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_gnutella;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
#ifdef NDPI_PROTOCOL_XBOX
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_XBOX);
#endif
#ifdef NDPI_PROTOCOL_WINDOWS_UPDATE
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_WINDOWS_UPDATE);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_GNUTELLA);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_WINMX
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_WINMX) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_winmx_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_WINMX);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DIRECTCONNECT
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DIRECTCONNECT) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_directconnect;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask,
NDPI_PROTOCOL_DIRECTCONNECT);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_DIRECTCONNECT);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MSN
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MSN) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_msn;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_MSN);
#ifdef NDPI_PROTOCOL_HTTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#endif
#ifdef NDPI_PROTOCOL_SSL
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SSL);
#endif
NDPI_BITMASK_RESET(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MSN);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_YAHOO
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_YAHOO) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_yahoo;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_YAHOO);
#ifdef NDPI_PROTOCOL_SSL
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SSL);
#endif
#ifdef NDPI_PROTOCOL_HTTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_YAHOO);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_OSCAR
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_OSCAR) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_oscar;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_OSCAR);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_OSCAR);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_APPLEJUICE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_APPLEJUICE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_applejuice_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_APPLEJUICE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SOULSEEK
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SOULSEEK) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_soulseek_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SOULSEEK);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SOULSEEK);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_IRC
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_IRC) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_irc_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_IRC);
#ifdef NDPI_PROTOCOL_HTTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_IRC);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_UNENCRYPED_JABBER
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_UNENCRYPED_JABBER) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_jabber_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask,
NDPI_PROTOCOL_UNENCRYPED_JABBER);
#ifdef NDPI_PROTOCOL_SSL
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SSL);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_UNENCRYPED_JABBER);
#ifdef NDPI_PROTOCOL_TRUPHONE
/* also exlude truphone since this is detected in jabber */
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_TRUPHONE);
#endif
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MAIL_POP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MAIL_POP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mail_pop_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MAIL_POP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MAIL_IMAP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MAIL_IMAP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mail_imap_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MAIL_IMAP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MAIL_SMTP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MAIL_SMTP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mail_smtp_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MAIL_SMTP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_FTP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_FTP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ftp_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_FTP);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_FTP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_USENET
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_USENET) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_usenet_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_USENET);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DNS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DNS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_dns;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_DNS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_FILETOPIA
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_FILETOPIA) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_filetopia_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_FILETOPIA);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_VMWARE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_VMWARE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_vmware;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_VMWARE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_IMESH
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_IMESH) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_imesh_tcp_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SSL);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_IMESH);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MMS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MMS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mms_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MMS);
a++;
}
#endif
#if defined(NDPI_PROTOCOL_IPSEC) || defined(NDPI_PROTOCOL_GRE) || defined(NDPI_PROTOCOL_ICMP) || defined(NDPI_PROTOCOL_IGMP) || defined(NDPI_PROTOCOL_EGP) || defined(NDPI_PROTOCOL_SCTP) || defined(NDPI_PROTOCOL_OSPF) || defined(NDPI_PROTOCOL_IP_IN_IP) || defined(NDPI_PROTOCOL_ICMPV6)
/* always add non tcp/udp if one protocol is compiled in */
if (1) {
ndpi_struct->callback_buffer[a].func = ndpi_search_in_non_tcp_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_BITMASK_RESET(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask);
#ifdef NDPI_PROTOCOL_IPSEC
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_IPSEC);
#endif
#ifdef NDPI_PROTOCOL_GRE
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_GRE);
#endif
#ifdef NDPI_PROTOCOL_IGMP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_ICMP);
#endif
#ifdef NDPI_PROTOCOL_IGMP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_IGMP);
#endif
#ifdef NDPI_PROTOCOL_EGP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_EGP);
#endif
#ifdef NDPI_PROTOCOL_SCTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_SCTP);
#endif
#ifdef NDPI_PROTOCOL_OSPF
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_OSPF);
#endif
#ifdef NDPI_PROTOCOL_IP_IN_IP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_IP_IN_IP);
#endif
#ifdef NDPI_PROTOCOL_ICMPV6
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_ICMPV6);
#endif
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TVANTS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TVANTS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_tvants_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TVANTS);
a++;
}
#endif
ndpi_struct->callback_buffer[a].func = ndpi_search_tcp_or_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
a++;
#ifdef NDPI_PROTOCOL_SOPCAST
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SOPCAST) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_sopcast;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SOPCAST);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TVUPLAYER
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TVUPLAYER) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_tvuplayer;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TVUPLAYER);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_PPSTREAM
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_PPSTREAM) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ppstream;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_PPSTREAM);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_PPLIVE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_PPLIVE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_pplive_tcp_udp;
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_PPLIVE);
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_PPLIVE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_IAX
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_IAX) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_iax;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_IAX);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_IAX);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MGCP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MGCP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mgcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
//NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_MGCP);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MGCP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_ZATTOO
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_ZATTOO) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_zattoo;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_ZATTOO);
#ifdef NDPI_PROTOCOL_FLASH
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_FLASH);
#endif
#ifdef NDPI_PROTOCOL_HTTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_ZATTOO);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_QQ
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_QQ) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_qq;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_QQ);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_QQ);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SSH
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SSH) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ssh_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SSH);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_POPO
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_POPO) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_popo_tcp_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_POPO);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_THUNDER
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_THUNDER) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_thunder;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_VNC
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_VNC) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_vnc_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_VNC);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TEAMVIEWER
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TEAMVIEWER) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_teamview;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_TEAMVIEWER);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TEAMVIEWER);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DHCP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DHCP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_dhcp_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_DHCP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SOCRATES
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SOCRATES) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_socrates;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SOCRATES);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_STEAM
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_STEAM) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_steam;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_STEAM);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_HALFLIFE2
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_HALFLIFE2) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_halflife2;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_HALFLIFE2);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_XBOX
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_XBOX) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_xbox;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_XBOX);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_activesync;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SMB
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SMB) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_smb_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SMB);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TELNET
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TELNET) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_telnet_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TELNET);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_NTP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_NTP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ntp_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_NTP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_NFS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_NFS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_nfs;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_NFS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SSDP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SSDP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ssdp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SSDP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_WORLDOFWARCRAFT
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_WORLDOFWARCRAFT) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_worldofwarcraft;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_WORLDOFWARCRAFT);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_FLASH
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_FLASH) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_flash;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_FLASH);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_FLASH);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_POSTGRES
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_POSTGRES) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_postgres_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_POSTGRES);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MYSQL
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MYSQL) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mysql_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MYSQL);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_BGP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_BGP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_bgp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_BGP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_QUAKE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_QUAKE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_quake;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_QUAKE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_BATTLEFIELD
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_BATTLEFIELD) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_battlefield;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_BATTLEFIELD);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_PCANYWHERE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_PCANYWHERE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_pcanywhere;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_PCANYWHERE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SNMP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SNMP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_snmp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SNMP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_KONTIKI
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_KONTIKI) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_kontiki;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_KONTIKI);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_ICECAST
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_ICECAST) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_icecast_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
#ifdef NDPI_PROTOCOL_HTTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#endif
#ifdef NDPI_PROTOCOL_MPEG
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_MPEG);
#endif
#ifdef NDPI_PROTOCOL_QUICKTIME
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_QUICKTIME);
#endif
#ifdef NDPI_PROTOCOL_REALMEDIA
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_REALMEDIA);
#endif
#ifdef NDPI_PROTOCOL_WINDOWSMEDIA
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask,
NDPI_PROTOCOL_WINDOWSMEDIA);
#endif
#ifdef NDPI_PROTOCOL_AVI
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_AVI);
#endif
#ifdef NDPI_PROTOCOL_OGG
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_OGG);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_ICECAST);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SHOUTCAST
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SHOUTCAST) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_shoutcast_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
#ifdef NDPI_PROTOCOL_HTTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SHOUTCAST);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_veohtv_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
#ifdef NDPI_PROTOCOL_HTTP
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_HTTP);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_KERBEROS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_KERBEROS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_kerberos;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_KERBEROS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_OPENFT
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_OPENFT) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_openft_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_OPENFT);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SYSLOG
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SYSLOG) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_syslog;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SYSLOG);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TDS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TDS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_tds_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TDS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_direct_download_link_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask,
NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_NETBIOS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_NETBIOS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_netbios;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_NETBIOS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MDNS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MDNS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mdns;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MDNS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_IPP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_IPP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ipp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_IPP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_LDAP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_LDAP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ldap;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_LDAP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_WARCRAFT3
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_WARCRAFT3) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_warcraft3;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_WARCRAFT3);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_WARCRAFT3);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_XDMCP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_XDMCP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_xdmcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_XDMCP);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_XDMCP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TFTP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TFTP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_tftp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TFTP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MSSQL
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MSSQL) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_mssql;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MSSQL);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_PPTP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_PPTP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_pptp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_PPTP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_STEALTHNET
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_STEALTHNET) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_stealthnet;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_STEALTHNET);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DHCPV6
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DHCPV6) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_dhcpv6_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_DHCPV6);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MEEBO
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MEEBO) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_meebo;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
#ifdef NDPI_PROTOCOL_FLASH
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_FLASH);
#endif
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MEEBO);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_AFP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_AFP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_afp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_AFP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_AIMINI
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_AIMINI) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_aimini;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_AIMINI);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_FLORENSIA
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_FLORENSIA) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_florensia;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_FLORENSIA);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_MAPLESTORY
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_MAPLESTORY) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_maplestory;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_MAPLESTORY);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DOFUS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DOFUS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_dofus;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_DOFUS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_WORLD_OF_KUNG_FU
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_WORLD_OF_KUNG_FU) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_world_of_kung_fu;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask,
NDPI_PROTOCOL_WORLD_OF_KUNG_FU);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_FIESTA
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_FIESTA) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_fiesta;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_FIESTA);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_CROSSFIRE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_CROSSFIRE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_crossfire_tcp_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_CROSSFIRE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_GUILDWARS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_GUILDWARS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_guildwars_tcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_GUILDWARS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_ARMAGETRON
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_ARMAGETRON) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_armagetron_udp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask = NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_ARMAGETRON);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DROPBOX
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DROPBOX) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_dropbox;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_DROPBOX);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_DROPBOX);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SPOTIFY
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SPOTIFY) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_spotify;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SPOTIFY);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SPOTIFY);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SKYPE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SKYPE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_skype;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SKYPE);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SKYPE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_RADIUS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_RADIUS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_radius;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_RADIUS);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_RADIUS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_CITRIX
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_CITRIX) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_citrix;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_CITRIX);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_CITRIX);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_LOTUS_NOTES
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_LOTUS_NOTES) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_lotus_notes;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_LOTUS_NOTES);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_LOTUS_NOTES);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_GTP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_GTP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_gtp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_GTP);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_GTP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_DCERPC
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_DCERPC) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_dcerpc;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_DCERPC);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_DCERPC);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_NETFLOW
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_NETFLOW) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_netflow;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_NETFLOW);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_NETFLOW);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SFLOW
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SFLOW) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_sflow;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SFLOW);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SFLOW);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_H323
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_H323) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_h323;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_H323);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_H323);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_OPENVPN
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_OPENVPN) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_openvpn;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_OPENVPN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_OPENVPN);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_NOE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_NOE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_noe;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_NOE);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_NOE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_CISCOVPN
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_CISCOVPN) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_ciscovpn;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_CISCOVPN);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_CISCOVPN);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TEAMSPEAK
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TEAMSPEAK) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_teamspeak;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_TEAMSPEAK);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TEAMSPEAK);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_VIBER
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_VIBER) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_viber;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_VIBER);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_VIBER);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_TOR
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_TOR) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_tor;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_TOR);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_TOR);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_SKINNY
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_SKINNY) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_skinny;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_SKINNY);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_SKINNY);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_RTCP
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_RTCP) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_rtcp;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_RTCP);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_RTCP);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_RSYNC
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_RSYNC) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_rsync;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_RSYNC);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_RSYNC);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_WHOIS_DAS
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_WHOIS_DAS) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_whois_das;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_WHOIS_DAS);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_WHOIS_DAS);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_ORACLE
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_ORACLE) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_oracle;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_ORACLE);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_ORACLE);
a++;
}
#endif
#ifdef NDPI_PROTOCOL_CORBA
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, NDPI_PROTOCOL_CORBA) != 0) {
ndpi_struct->callback_buffer[a].func = ndpi_search_corba;
ndpi_struct->callback_buffer[a].ndpi_selection_bitmask =
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION;
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_UNKNOWN);
NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[a].detection_bitmask, NDPI_PROTOCOL_CORBA);
NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_CORBA);
a++;
}
#endif
ndpi_struct->callback_buffer_size = a;
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG,
"callback_buffer_size is %u\n", ndpi_struct->callback_buffer_size);
/* now build the specific buffer for tcp, udp and non_tcp_udp */
ndpi_struct->callback_buffer_size_tcp_payload = 0;
ndpi_struct->callback_buffer_size_tcp_no_payload = 0;
for (a = 0; a < ndpi_struct->callback_buffer_size; a++) {
if ((ndpi_struct->callback_buffer[a].ndpi_selection_bitmask & (NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP |
NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP |
NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC))
!= 0) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG,
"callback_buffer_tcp_payload, adding buffer %u as entry %u\n", a,
ndpi_struct->callback_buffer_size_tcp_payload);
memcpy(&ndpi_struct->callback_buffer_tcp_payload[ndpi_struct->callback_buffer_size_tcp_payload],
&ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct));
ndpi_struct->callback_buffer_size_tcp_payload++;
if ((ndpi_struct->
callback_buffer[a].ndpi_selection_bitmask & NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) == 0) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG,
"callback_buffer_tcp_no_payload, additional adding buffer %u to no_payload process\n", a);
memcpy(&ndpi_struct->callback_buffer_tcp_no_payload
[ndpi_struct->callback_buffer_size_tcp_no_payload], &ndpi_struct->callback_buffer[a],
sizeof(struct ndpi_call_function_struct));
ndpi_struct->callback_buffer_size_tcp_no_payload++;
}
}
}
ndpi_struct->callback_buffer_size_udp = 0;
for (a = 0; a < ndpi_struct->callback_buffer_size; a++) {
if ((ndpi_struct->callback_buffer[a].ndpi_selection_bitmask & (NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP |
NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP |
NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC))
!= 0) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG,
"callback_buffer_size_udp, adding buffer %u\n", a);
memcpy(&ndpi_struct->callback_buffer_udp[ndpi_struct->callback_buffer_size_udp],
&ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct));
ndpi_struct->callback_buffer_size_udp++;
}
}
ndpi_struct->callback_buffer_size_non_tcp_udp = 0;
for (a = 0; a < ndpi_struct->callback_buffer_size; a++) {
if ((ndpi_struct->callback_buffer[a].ndpi_selection_bitmask & (NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP |
NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP |
NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP))
== 0
|| (ndpi_struct->
callback_buffer[a].ndpi_selection_bitmask & NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC) != 0) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG,
"callback_buffer_size_non_tcp_udp, adding buffer %u\n", a);
memcpy(&ndpi_struct->callback_buffer_non_tcp_udp[ndpi_struct->callback_buffer_size_non_tcp_udp],
&ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct));
ndpi_struct->callback_buffer_size_non_tcp_udp++;
}
}
}
#ifdef NDPI_DETECTION_SUPPORT_IPV6
/* handle extension headers in IPv6 packets
* arguments:
* l4ptr: pointer to the byte following the initial IPv6 header
* l4len: the length of the IPv6 packet excluding the IPv6 header
* nxt_hdr: next header value from the IPv6 header
* result:
* l4ptr: pointer to the start of the actual packet payload
* l4len: length of the actual payload
* nxt_hdr: protocol of the actual payload
* returns 0 upon success and 1 upon failure
*/
static int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struct *ndpi_struct,
const u_int8_t ** l4ptr, u_int16_t * l4len, u_int8_t * nxt_hdr)
{
while ((*nxt_hdr == 0 || *nxt_hdr == 43 || *nxt_hdr == 44 || *nxt_hdr == 60 || *nxt_hdr == 135 || *nxt_hdr == 59)) {
u_int16_t ehdr_len;
// no next header
if (*nxt_hdr == 59) {
return 1;
}
// fragment extension header has fixed size of 8 bytes and the first byte is the next header type
if (*nxt_hdr == 44) {
if (*l4len < 8) {
return 1;
}
*nxt_hdr = (*l4ptr)[0];
*l4len -= 8;
(*l4ptr) += 8;
continue;
}
// the other extension headers have one byte for the next header type
// and one byte for the extension header length in 8 byte steps minus the first 8 bytes
ehdr_len = (*l4ptr)[1];
ehdr_len *= 8;
ehdr_len += 8;
if (*l4len < ehdr_len) {
return 1;
}
*nxt_hdr = (*l4ptr)[0];
*l4len -= ehdr_len;
(*l4ptr) += ehdr_len;
}
return 0;
}
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
static u_int8_t ndpi_iph_is_valid_and_not_fragmented(const struct ndpi_iphdr *iph, const u_int16_t ipsize)
{
//#ifdef REQUIRE_FULL_PACKETS
if (ipsize < iph->ihl * 4 ||
ipsize < ntohs(iph->tot_len) || ntohs(iph->tot_len) < iph->ihl * 4 || (iph->frag_off & htons(0x1FFF)) != 0) {
return 0;
}
//#endif
return 1;
}
static u_int8_t ndpi_detection_get_l4_internal(struct ndpi_detection_module_struct *ndpi_struct,
const u_int8_t * l3, u_int16_t l3_len, const u_int8_t ** l4_return, u_int16_t * l4_len_return,
u_int8_t * l4_protocol_return, u_int32_t flags)
{
const struct ndpi_iphdr *iph = NULL;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
const struct ndpi_ipv6hdr *iph_v6 = NULL;
#endif
u_int16_t l4len = 0;
const u_int8_t *l4ptr = NULL;
u_int8_t l4protocol = 0;
if (l3 == NULL || l3_len < sizeof(struct ndpi_iphdr))
return 1;
iph = (const struct ndpi_iphdr *) l3;
if (iph->version == 4 && iph->ihl >= 5) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv4 header\n");
}
#ifdef NDPI_DETECTION_SUPPORT_IPV6
else if (iph->version == 6 && l3_len >= sizeof(struct ndpi_ipv6hdr)) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv6 header\n");
iph_v6 = (const struct ndpi_ipv6hdr *) iph;
iph = NULL;
}
#endif
else {
return 1;
}
if ((flags & NDPI_DETECTION_ONLY_IPV6) && iph != NULL) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv4 header found but excluded by flag\n");
return 1;
}
#ifdef NDPI_DETECTION_SUPPORT_IPV6
else if ((flags & NDPI_DETECTION_ONLY_IPV4) && iph_v6 != NULL) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv6 header found but excluded by flag\n");
return 1;
}
#endif
if (iph != NULL && ndpi_iph_is_valid_and_not_fragmented(iph, l3_len)) {
u_int16_t len = ntohs(iph->tot_len);
u_int16_t hlen = (iph->ihl * 4);
l4ptr = (((const u_int8_t *) iph) + iph->ihl * 4);
if(len == 0) len = l3_len;
l4len = (len > hlen) ? (len - hlen) : 0;
l4protocol = iph->protocol;
}
#ifdef NDPI_DETECTION_SUPPORT_IPV6
else if (iph_v6 != NULL && (l3_len - sizeof(struct ndpi_ipv6hdr)) >= ntohs(iph_v6->payload_len)) {
l4ptr = (((const u_int8_t *) iph_v6) + sizeof(struct ndpi_ipv6hdr));
l4len = ntohs(iph_v6->payload_len);
l4protocol = iph_v6->nexthdr;
// we need to handle IPv6 extension headers if present
if (ndpi_handle_ipv6_extension_headers(ndpi_struct, &l4ptr, &l4len, &l4protocol) != 0) {
return 1;
}
}
#endif
else {
return 1;
}
if (l4_return != NULL) {
*l4_return = l4ptr;
}
if (l4_len_return != NULL) {
*l4_len_return = l4len;
}
if (l4_protocol_return != NULL) {
*l4_protocol_return = l4protocol;
}
return 0;
}
#if !defined(WIN32)
#define ATTRIBUTE_ALWAYS_INLINE static inline
#else
__forceinline static
#endif
void ndpi_apply_flow_protocol_to_packet(struct ndpi_flow_struct *flow,
struct ndpi_packet_struct *packet)
{
memcpy(&packet->detected_protocol_stack[0],
&flow->detected_protocol_stack[0], sizeof(packet->detected_protocol_stack));
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
memcpy(&packet->protocol_stack_info, &flow->protocol_stack_info, sizeof(packet->protocol_stack_info));
#endif
}
static int ndpi_init_packet_header(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
unsigned short packetlen)
{
const struct ndpi_iphdr *decaps_iph = NULL;
u_int16_t l3len;
u_int16_t l4len;
const u_int8_t *l4ptr;
u_int8_t l4protocol;
u_int8_t l4_result;
/* reset payload_packet_len, will be set if ipv4 tcp or udp */
flow->packet.payload_packet_len = 0;
flow->packet.l4_packet_len = 0;
flow->packet.l3_packet_len = packetlen;
flow->packet.tcp = NULL;
flow->packet.udp = NULL;
flow->packet.generic_l4_ptr = NULL;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
flow->packet.iphv6 = NULL;
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
if (flow) {
ndpi_apply_flow_protocol_to_packet(flow, &flow->packet);
} else {
ndpi_int_reset_packet_protocol(&flow->packet);
}
l3len =flow->packet.l3_packet_len;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (flow->packet.iph != NULL) {
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
decaps_iph =flow->packet.iph;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
}
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
if (decaps_iph->version == 4 && decaps_iph->ihl >= 5) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv4 header\n");
}
#ifdef NDPI_DETECTION_SUPPORT_IPV6
else if (decaps_iph->version == 6 && l3len >= sizeof(struct ndpi_ipv6hdr) &&
(ndpi_struct->ip_version_limit & NDPI_DETECTION_ONLY_IPV4) == 0) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv6 header\n");
flow->packet.iphv6 = (struct ndpi_ipv6hdr *)flow->packet.iph;
flow->packet.iph = NULL;
}
#endif
else {
flow->packet.iph = NULL;
return 1;
}
/* needed:
* - unfragmented packets
* - ip header <= packet len
* - ip total length >= packet len
*/
l4ptr = NULL;
l4len = 0;
l4protocol = 0;
l4_result =
ndpi_detection_get_l4_internal(ndpi_struct, (const u_int8_t *) decaps_iph, l3len, &l4ptr, &l4len, &l4protocol, 0);
if (l4_result != 0) {
return 1;
}
flow->packet.l4_protocol = l4protocol;
flow->packet.l4_packet_len = l4len;
/* tcp / udp detection */
if (l4protocol == 6 /* TCP */ &&flow->packet.l4_packet_len >= 20 /* min size of tcp */ ) {
/* tcp */
flow->packet.tcp = (struct ndpi_tcphdr *) l4ptr;
if (flow->packet.l4_packet_len >=flow->packet.tcp->doff * 4) {
flow->packet.payload_packet_len =
flow->packet.l4_packet_len -flow->packet.tcp->doff * 4;
flow->packet.actual_payload_len =flow->packet.payload_packet_len;
flow->packet.payload = ((u_int8_t *)flow->packet.tcp) + (flow->packet.tcp->doff * 4);
/* check for new tcp syn packets, here
* idea: reset detection state if a connection is unknown
*/
if (flow && flow->packet.tcp->syn != 0
&& flow->packet.tcp->ack == 0
&& flow->init_finished != 0
&& flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
memset(flow, 0, sizeof(*(flow)));
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct,
NDPI_LOG_DEBUG,
"%s:%u: tcp syn packet for unknown protocol, reset detection state\n", __FUNCTION__, __LINE__);
}
} else {
/* tcp header not complete */
flow->packet.tcp = NULL;
}
} else if (l4protocol == 17 /* udp */ &&flow->packet.l4_packet_len >= 8 /* size of udp */ ) {
flow->packet.udp = (struct ndpi_udphdr *) l4ptr;
flow->packet.payload_packet_len =flow->packet.l4_packet_len - 8;
flow->packet.payload = ((u_int8_t *)flow->packet.udp) + 8;
} else {
flow->packet.generic_l4_ptr = l4ptr;
}
return 0;
}
#if !defined(WIN32)
static inline
#else
__forceinline static
#endif
void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow)
{
/* const for gcc code optimisation and cleaner code */
struct ndpi_packet_struct *packet = &flow->packet;
const struct ndpi_iphdr *iph = packet->iph;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
const struct ndpi_ipv6hdr *iphv6 = packet->iphv6;
#endif
const struct ndpi_tcphdr *tcph = packet->tcp;
//const struct ndpi_udphdr *udph=flow->packet.udp;
//struct ndpi_unique_flow_struct unique_flow;
//uint8_t new_connection;
u_int8_t proxy_enabled = 0;
packet->tcp_retransmission = 0;
packet->packet_direction = 0;
if (iph != NULL && iph->saddr < iph->daddr)
packet->packet_direction = 1;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (iphv6 != NULL && NDPI_COMPARE_IPV6_ADDRESS_STRUCTS(&iphv6->saddr, &iphv6->daddr) != 0)
packet->packet_direction = 1;
#endif
packet->packet_lines_parsed_complete = 0;
packet->packet_unix_lines_parsed_complete = 0;
if (flow == NULL)
return;
if (flow->init_finished == 0) {
flow->init_finished = 1;
flow->setup_packet_direction = packet->packet_direction;
}
if (tcph != NULL) {
/* reset retried bytes here before setting it */
packet->num_retried_bytes = 0;
if (tcph->syn != 0 && tcph->ack == 0 && flow->l4.tcp.seen_syn == 0 && flow->l4.tcp.seen_syn_ack == 0
&& flow->l4.tcp.seen_ack == 0) {
flow->l4.tcp.seen_syn = 1;
}
if (tcph->syn != 0 && tcph->ack != 0 && flow->l4.tcp.seen_syn == 1 && flow->l4.tcp.seen_syn_ack == 0
&& flow->l4.tcp.seen_ack == 0) {
flow->l4.tcp.seen_syn_ack = 1;
}
if (tcph->syn == 0 && tcph->ack == 1 && flow->l4.tcp.seen_syn == 1 && flow->l4.tcp.seen_syn_ack == 1
&& flow->l4.tcp.seen_ack == 0) {
flow->l4.tcp.seen_ack = 1;
}
if ((flow->next_tcp_seq_nr[0] == 0 && flow->next_tcp_seq_nr[1] == 0)
|| (proxy_enabled && (flow->next_tcp_seq_nr[0] == 0 || flow->next_tcp_seq_nr[1] == 0))) {
/* initalize tcp sequence counters */
/* the ack flag needs to be set to get valid sequence numbers from the other
* direction. Usually it will catch the second packet syn+ack but it works
* also for asymmetric traffic where it will use the first data packet
*
* if the syn flag is set add one to the sequence number,
* otherwise use the payload length.
*/
if (tcph->ack != 0) {
flow->next_tcp_seq_nr[flow->packet.packet_direction] =
ntohl(tcph->seq) + (tcph->syn ? 1 : packet->payload_packet_len);
if (!proxy_enabled) {
flow->next_tcp_seq_nr[1 -flow->packet.packet_direction] = ntohl(tcph->ack_seq);
}
}
} else if (packet->payload_packet_len > 0) {
/* check tcp sequence counters */
if (((u_int32_t)
(ntohl(tcph->seq) -
flow->next_tcp_seq_nr[packet->packet_direction])) >
ndpi_struct->tcp_max_retransmission_window_size) {
packet->tcp_retransmission = 1;
/*CHECK IF PARTIAL RETRY IS HAPPENENING */
if ((flow->next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq) < packet->payload_packet_len)) {
/* num_retried_bytes actual_payload_len hold info about the partial retry
analyzer which require this info can make use of this info
Other analyzer can use packet->payload_packet_len */
packet->num_retried_bytes = (u_int16_t)(flow->next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq));
packet->actual_payload_len = packet->payload_packet_len - packet->num_retried_bytes;
flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
}
}
/*normal path
actual_payload_len is initialized to payload_packet_len during tcp header parsing itself.
It will be changed only in case of retransmission */
else {
packet->num_retried_bytes = 0;
flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len;
}
}
if (tcph->rst) {
flow->next_tcp_seq_nr[0] = 0;
flow->next_tcp_seq_nr[1] = 0;
}
}
if (flow->packet_counter < MAX_PACKET_COUNTER && packet->payload_packet_len) {
flow->packet_counter++;
}
if (flow->packet_direction_counter[packet->packet_direction] < MAX_PACKET_COUNTER && packet->payload_packet_len) {
flow->packet_direction_counter[packet->packet_direction]++;
}
if (flow->byte_counter[packet->packet_direction] + packet->payload_packet_len >
flow->byte_counter[packet->packet_direction]) {
flow->byte_counter[packet->packet_direction] += packet->payload_packet_len;
}
}
unsigned int ndpi_detection_process_packet(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
const unsigned char *packet,
const unsigned short packetlen,
const u_int32_t current_tick,
struct ndpi_id_struct *src,
struct ndpi_id_struct *dst)
{
u_int32_t a;
NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_packet;
NDPI_PROTOCOL_BITMASK detection_bitmask;
/* need at least 20 bytes for ip header */
if (packetlen < 20) {
/* reset protocol which is normally done in init_packet_header */
ndpi_int_reset_packet_protocol(&flow->packet);
return NDPI_PROTOCOL_UNKNOWN;
}
flow->packet.tick_timestamp = current_tick;
/* parse packet */
flow->packet.iph = (struct ndpi_iphdr *) packet;
/* we are interested in ipv4 packet */
if (ndpi_init_packet_header(ndpi_struct, flow, packetlen) != 0) {
return NDPI_PROTOCOL_UNKNOWN;
}
/* detect traffic for tcp or udp only */
flow->src = src, flow->dst = dst;
ndpi_connection_tracking(ndpi_struct, flow);
if (flow == NULL && (flow->packet.tcp != NULL || flow->packet.udp != NULL)) {
return (NDPI_PROTOCOL_UNKNOWN);
}
/* build ndpi_selction packet bitmask */
ndpi_selection_packet = NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC;
if (flow->packet.iph != NULL) {
ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6;
}
if (flow->packet.tcp != NULL) {
ndpi_selection_packet |=
(NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP);
}
if (flow->packet.udp != NULL) {
ndpi_selection_packet |=
(NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP);
}
if (flow->packet.payload_packet_len != 0) {
ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD;
}
if (flow->packet.tcp_retransmission == 0) {
ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION;
}
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (flow->packet.iphv6 != NULL) {
ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6;
}
#endif /* NDPI_DETECTION_SUPPORT_IPV6 */
NDPI_SAVE_AS_BITMASK(detection_bitmask, flow->packet.detected_protocol_stack[0]);
if (flow != NULL && flow->packet.tcp != NULL) {
if (flow->packet.payload_packet_len != 0) {
for (a = 0; a < ndpi_struct->callback_buffer_size_tcp_payload; a++) {
if ((ndpi_struct->callback_buffer_tcp_payload[a].ndpi_selection_bitmask & ndpi_selection_packet) ==
ndpi_struct->callback_buffer_tcp_payload[a].ndpi_selection_bitmask
&& NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask,
ndpi_struct->callback_buffer_tcp_payload[a].excluded_protocol_bitmask) == 0
&& NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_tcp_payload[a].detection_bitmask,
detection_bitmask) != 0) {
ndpi_struct->callback_buffer_tcp_payload[a].func(ndpi_struct, flow);
if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN)
break; /* Stop after detecting the first protocol */
}
}
} else { /* no payload */
for (a = 0; a < ndpi_struct->callback_buffer_size_tcp_no_payload; a++) {
if ((ndpi_struct->callback_buffer_tcp_no_payload[a].ndpi_selection_bitmask & ndpi_selection_packet) ==
ndpi_struct->callback_buffer_tcp_no_payload[a].ndpi_selection_bitmask
&& NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask,
ndpi_struct->
callback_buffer_tcp_no_payload[a].excluded_protocol_bitmask) == 0
&& NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_tcp_no_payload[a].detection_bitmask,
detection_bitmask) != 0) {
ndpi_struct->callback_buffer_tcp_no_payload[a].func(ndpi_struct, flow);
if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN)
break; /* Stop after detecting the first protocol */
}
}
}
} else if (flow != NULL && flow->packet.udp != NULL) {
for (a = 0; a < ndpi_struct->callback_buffer_size_udp; a++) {
if ((ndpi_struct->callback_buffer_udp[a].ndpi_selection_bitmask & ndpi_selection_packet) ==
ndpi_struct->callback_buffer_udp[a].ndpi_selection_bitmask
&& NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask,
ndpi_struct->callback_buffer_udp[a].excluded_protocol_bitmask) == 0
&& NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_udp[a].detection_bitmask,
detection_bitmask) != 0) {
ndpi_struct->callback_buffer_udp[a].func(ndpi_struct, flow);
if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN)
break; /* Stop after detecting the first protocol */
}
}
} else {
for (a = 0; a < ndpi_struct->callback_buffer_size_non_tcp_udp; a++) {
if ((ndpi_struct->callback_buffer_non_tcp_udp[a].ndpi_selection_bitmask & ndpi_selection_packet) ==
ndpi_struct->callback_buffer_non_tcp_udp[a].ndpi_selection_bitmask
&& (flow == NULL
||
NDPI_BITMASK_COMPARE
(flow->excluded_protocol_bitmask,
ndpi_struct->callback_buffer_non_tcp_udp[a].excluded_protocol_bitmask) == 0)
&& NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_non_tcp_udp[a].detection_bitmask,
detection_bitmask) != 0) {
ndpi_struct->callback_buffer_non_tcp_udp[a].func(ndpi_struct, flow);
if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN)
break; /* Stop after detecting the first protocol */
}
}
}
a = flow->packet.detected_protocol_stack[0];
if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask, a) == 0)
a = NDPI_PROTOCOL_UNKNOWN;
return a;
}
static u_int8_t ndpi_detection_build_key_internal(struct ndpi_detection_module_struct *ndpi_struct,
const u_int8_t * l3, u_int16_t l3_len, const u_int8_t * l4, u_int16_t l4_len, u_int8_t l4_protocol,
struct ndpi_unique_flow_ipv4_and_6_struct *key_return, u_int8_t * dir_return,
u_int32_t flags)
{
const struct ndpi_iphdr *iph = NULL;
u_int8_t swapped = 0;
if (key_return == NULL || l3 == NULL)
return 1;
if (l3_len < sizeof(*iph))
return 1;
iph = (const struct ndpi_iphdr *) l3;
if (iph->version == 4 && ((iph->ihl * 4) > l3_len || l3_len < ntohs(iph->tot_len)
|| (iph->frag_off & htons(0x1FFF)) != 0)) {
return 1;
}
if ((flags & NDPI_DETECTION_ONLY_IPV6) && iph->version == 4) {
return 1;
}
#ifdef NDPI_DETECTION_SUPPORT_IPV6
else if ((flags & NDPI_DETECTION_ONLY_IPV4) && iph->version == 6) {
return 1;
}
#endif
//memset( key_return, 0, sizeof( *key_return ) );
/* needed:
* - unfragmented or first part of the fragmented packet
* - ip header <= packet len
* - ip total length >= packet len
*/
if (iph->version == 4 && iph->ihl >= 5) {
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv4 header\n");
key_return->is_ip_v6 = 0;
key_return->protocol = l4_protocol;
if (iph->saddr < iph->daddr) {
key_return->ip.ipv4.lower_ip = iph->saddr;
key_return->ip.ipv4.upper_ip = iph->daddr;
} else {
key_return->ip.ipv4.upper_ip = iph->saddr;
key_return->ip.ipv4.lower_ip = iph->daddr;
swapped = 1;
}
key_return->ip.ipv4.dummy[0] = 0;
key_return->ip.ipv4.dummy[1] = 0;
key_return->ip.ipv4.dummy[2] = 0;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
} else if (iph->version == 6 && l3_len >= sizeof(struct ndpi_ipv6hdr)) {
const struct ndpi_ipv6hdr *ip6h = (const struct ndpi_ipv6hdr *) iph;
if ((l3_len - sizeof(struct ndpi_ipv6hdr)) < ntohs(ip6h->payload_len)) {
return 3;
}
key_return->is_ip_v6 = 1;
key_return->protocol = l4_protocol;
if (NDPI_COMPARE_IPV6_ADDRESS_STRUCTS(&ip6h->saddr, &ip6h->daddr)) {
key_return->ip.ipv6.lower_ip[0] = ((u_int64_t *) & ip6h->saddr)[0];
key_return->ip.ipv6.lower_ip[1] = ((u_int64_t *) & ip6h->saddr)[1];
key_return->ip.ipv6.upper_ip[0] = ((u_int64_t *) & ip6h->daddr)[0];
key_return->ip.ipv6.upper_ip[1] = ((u_int64_t *) & ip6h->daddr)[1];
} else {
key_return->ip.ipv6.lower_ip[0] = ((u_int64_t *) & ip6h->daddr)[0];
key_return->ip.ipv6.lower_ip[1] = ((u_int64_t *) & ip6h->daddr)[1];
key_return->ip.ipv6.upper_ip[0] = ((u_int64_t *) & ip6h->saddr)[0];
key_return->ip.ipv6.upper_ip[1] = ((u_int64_t *) & ip6h->saddr)[1];
swapped = 1;
}
#endif
} else {
return 5;
}
/* tcp / udp detection */
if (key_return->protocol == 6 /* TCP */ && l4_len >= sizeof(struct ndpi_tcphdr)) {
const struct ndpi_tcphdr *tcph = (const struct ndpi_tcphdr *) l4;
if (swapped == 0) {
key_return->lower_port = tcph->source;
key_return->upper_port = tcph->dest;
} else {
key_return->lower_port = tcph->dest;
key_return->upper_port = tcph->source;
}
} else if (key_return->protocol == 17 /* UDP */ && l4_len >= sizeof(struct ndpi_udphdr)) {
const struct ndpi_udphdr *udph = (struct ndpi_udphdr *) l4;
if (swapped == 0) {
key_return->lower_port = udph->source;
key_return->upper_port = udph->dest;
} else {
key_return->lower_port = udph->dest;
key_return->upper_port = udph->source;
}
} else {
/* non tcp/udp protocols, one connection between two ip addresses */
key_return->lower_port = 0;
key_return->upper_port = 0;
}
if (dir_return != NULL) {
*dir_return = swapped;
}
return 0;
}
u_int32_t ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read)
{
u_int32_t val;
val = 0;
// cancel if eof, ' ' or line end chars are reached
while (*str >= '0' && *str <= '9' && max_chars_to_read > 0) {
val *= 10;
val += *str - '0';
str++;
max_chars_to_read = max_chars_to_read - 1;
*bytes_read = *bytes_read + 1;
}
return (val);
}
u_int32_t ndpi_bytestream_dec_or_hex_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read)
{
u_int32_t val;
val = 0;
if (max_chars_to_read <= 2 || str[0] != '0' || str[1] != 'x') {
return ndpi_bytestream_to_number(str, max_chars_to_read, bytes_read);
} else {
/*use base 16 system */
str += 2;
max_chars_to_read -= 2;
*bytes_read = *bytes_read + 2;
while (max_chars_to_read > 0) {
if (*str >= '0' && *str <= '9') {
val *= 16;
val += *str - '0';
} else if (*str >= 'a' && *str <= 'f') {
val *= 16;
val += *str + 10 - 'a';
} else if (*str >= 'A' && *str <= 'F') {
val *= 16;
val += *str + 10 - 'A';
} else {
break;
}
str++;
max_chars_to_read = max_chars_to_read - 1;
*bytes_read = *bytes_read + 1;
}
}
return (val);
}
u_int64_t ndpi_bytestream_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read)
{
u_int64_t val;
val = 0;
// cancel if eof, ' ' or line end chars are reached
while (max_chars_to_read > 0 && *str >= '0' && *str <= '9') {
val *= 10;
val += *str - '0';
str++;
max_chars_to_read = max_chars_to_read - 1;
*bytes_read = *bytes_read + 1;
}
return (val);
}
u_int64_t ndpi_bytestream_dec_or_hex_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read)
{
u_int64_t val;
val = 0;
if (max_chars_to_read <= 2 || str[0] != '0' || str[1] != 'x') {
return ndpi_bytestream_to_number64(str, max_chars_to_read, bytes_read);
} else {
/*use base 16 system */
str += 2;
max_chars_to_read -= 2;
*bytes_read = *bytes_read + 2;
while (max_chars_to_read > 0) {
if (*str >= '0' && *str <= '9') {
val *= 16;
val += *str - '0';
} else if (*str >= 'a' && *str <= 'f') {
val *= 16;
val += *str + 10 - 'a';
} else if (*str >= 'A' && *str <= 'F') {
val *= 16;
val += *str + 10 - 'A';
} else {
break;
}
str++;
max_chars_to_read = max_chars_to_read - 1;
*bytes_read = *bytes_read + 1;
}
}
return (val);
}
u_int32_t ndpi_bytestream_to_ipv4(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read)
{
u_int32_t val;
u_int16_t read = 0;
u_int16_t oldread;
u_int32_t c;
/* ip address must be X.X.X.X with each X between 0 and 255 */
oldread = read;
c = ndpi_bytestream_to_number(str, max_chars_to_read, &read);
if (c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.')
return 0;
read++;
val = c << 24;
oldread = read;
c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read);
if (c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.')
return 0;
read++;
val = val + (c << 16);
oldread = read;
c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read);
if (c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.')
return 0;
read++;
val = val + (c << 8);
oldread = read;
c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read);
if (c > 255 || oldread == read || max_chars_to_read == read)
return 0;
val = val + c;
*bytes_read = *bytes_read + read;
return htonl(val);
}
/* internal function for every detection to parse one packet and to increase the info buffer */
void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow)
{
u_int32_t a;
struct ndpi_packet_struct *packet = &flow->packet;
u_int16_t end = packet->payload_packet_len - 1;
if (packet->packet_lines_parsed_complete != 0)
return;
packet->packet_lines_parsed_complete = 1;
packet->parsed_lines = 0;
packet->empty_line_position_set = 0;
packet->host_line.ptr = NULL;
packet->host_line.len = 0;
packet->referer_line.ptr = NULL;
packet->referer_line.len = 0;
packet->content_line.ptr = NULL;
packet->content_line.len = 0;
packet->accept_line.ptr = NULL;
packet->accept_line.len = 0;
packet->user_agent_line.ptr = NULL;
packet->user_agent_line.len = 0;
packet->http_url_name.ptr = NULL;
packet->http_url_name.len = 0;
packet->http_encoding.ptr = NULL;
packet->http_encoding.len = 0;
packet->http_transfer_encoding.ptr = NULL;
packet->http_transfer_encoding.len = 0;
packet->http_contentlen.ptr = NULL;
packet->http_contentlen.len = 0;
packet->http_cookie.ptr = NULL;
packet->http_cookie.len = 0;
packet->http_x_session_type.ptr = NULL;
packet->http_x_session_type.len = 0;
packet->server_line.ptr = NULL;
packet->server_line.len = 0;
packet->http_method.ptr = NULL;
packet->http_method.len = 0;
packet->http_response.ptr = NULL;
packet->http_response.len = 0;
if((packet->payload_packet_len == 0)
|| (packet->payload == NULL))
return;
packet->line[packet->parsed_lines].ptr = packet->payload;
packet->line[packet->parsed_lines].len = 0;
for (a = 0; (a+1) < end; a++) {
if (get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) {
packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr));
if (packet->parsed_lines == 0 && packet->line[0].len >= NDPI_STATICSTRING_LEN("HTTP/1.1 200 ") &&
memcmp(packet->line[0].ptr, "HTTP/1.", NDPI_STATICSTRING_LEN("HTTP/1.")) == 0 &&
packet->line[0].ptr[NDPI_STATICSTRING_LEN("HTTP/1.1 ")] > '0' &&
packet->line[0].ptr[NDPI_STATICSTRING_LEN("HTTP/1.1 ")] < '6') {
packet->http_response.ptr = &packet->line[0].ptr[NDPI_STATICSTRING_LEN("HTTP/1.1 ")];
packet->http_response.len = packet->line[0].len - NDPI_STATICSTRING_LEN("HTTP/1.1 ");
NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG,
"ndpi_parse_packet_line_info: HTTP response parsed: \"%.*s\"\n",
packet->http_response.len, packet->http_response.ptr);
}
if (packet->line[packet->parsed_lines].len > NDPI_STATICSTRING_LEN("Server:") + 1
&& memcmp(packet->line[packet->parsed_lines].ptr, "Server:", NDPI_STATICSTRING_LEN("Server:")) == 0) {
// some stupid clients omit a space and place the servername directly after the colon
if (packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:")] == ' ') {
packet->server_line.ptr =
&packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:") + 1];
packet->server_line.len =
packet->line[packet->parsed_lines].len - (NDPI_STATICSTRING_LEN("Server:") + 1);
} else {
packet->server_line.ptr = &packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:")];
packet->server_line.len = packet->line[packet->parsed_lines].len - NDPI_STATICSTRING_LEN("Server:");
}
}
if (packet->line[packet->parsed_lines].len > 6
&& memcmp(packet->line[packet->parsed_lines].ptr, "Host:", 5) == 0) {
// some stupid clients omit a space and place the hostname directly after the colon
if (packet->line[packet->parsed_lines].ptr[5] == ' ') {
packet->host_line.ptr = &packet->line[packet->parsed_lines].ptr[6];
packet->host_line.len = packet->line[packet->parsed_lines].len - 6;
} else {
packet->host_line.ptr = &packet->line[packet->parsed_lines].ptr[5];
packet->host_line.len = packet->line[packet->parsed_lines].len - 5;
}
}
if (packet->line[packet->parsed_lines].len > 14
&&
(memcmp
(packet->line[packet->parsed_lines].ptr, "Content-Type: ",
14) == 0 || memcmp(packet->line[packet->parsed_lines].ptr, "Content-type: ", 14) == 0)) {
packet->content_line.ptr = &packet->line[packet->parsed_lines].ptr[14];
packet->content_line.len = packet->line[packet->parsed_lines].len - 14;
}
if (packet->line[packet->parsed_lines].len > 13
&& memcmp(packet->line[packet->parsed_lines].ptr, "Content-type:", 13) == 0) {
packet->content_line.ptr = &packet->line[packet->parsed_lines].ptr[13];
packet->content_line.len = packet->line[packet->parsed_lines].len - 13;
}
if (packet->line[packet->parsed_lines].len > 8
&& memcmp(packet->line[packet->parsed_lines].ptr, "Accept: ", 8) == 0) {
packet->accept_line.ptr = &packet->line[packet->parsed_lines].ptr[8];
packet->accept_line.len = packet->line[packet->parsed_lines].len - 8;
}
if (packet->line[packet->parsed_lines].len > 9
&& memcmp(packet->line[packet->parsed_lines].ptr, "Referer: ", 9) == 0) {
packet->referer_line.ptr = &packet->line[packet->parsed_lines].ptr[9];
packet->referer_line.len = packet->line[packet->parsed_lines].len - 9;
}
if (packet->line[packet->parsed_lines].len > 12
&& (memcmp(packet->line[packet->parsed_lines].ptr, "User-Agent: ", 12) == 0 ||
memcmp(packet->line[packet->parsed_lines].ptr, "User-agent: ", 12) == 0)) {
packet->user_agent_line.ptr = &packet->line[packet->parsed_lines].ptr[12];
packet->user_agent_line.len = packet->line[packet->parsed_lines].len - 12;
}
if (packet->line[packet->parsed_lines].len > 18
&& memcmp(packet->line[packet->parsed_lines].ptr, "Content-Encoding: ", 18) == 0) {
packet->http_encoding.ptr = &packet->line[packet->parsed_lines].ptr[18];
packet->http_encoding.len = packet->line[packet->parsed_lines].len - 18;
}
if (packet->line[packet->parsed_lines].len > 19
&& memcmp(packet->line[packet->parsed_lines].ptr, "Transfer-Encoding: ", 19) == 0) {
packet->http_transfer_encoding.ptr = &packet->line[packet->parsed_lines].ptr[19];
packet->http_transfer_encoding.len = packet->line[packet->parsed_lines].len - 19;
}
if (packet->line[packet->parsed_lines].len > 16
&& ((memcmp(packet->line[packet->parsed_lines].ptr, "Content-Length: ", 16) == 0)
|| (memcmp(packet->line[packet->parsed_lines].ptr, "content-length: ", 16) == 0))) {
packet->http_contentlen.ptr = &packet->line[packet->parsed_lines].ptr[16];
packet->http_contentlen.len = packet->line[packet->parsed_lines].len - 16;
}
if (packet->line[packet->parsed_lines].len > 8
&& memcmp(packet->line[packet->parsed_lines].ptr, "Cookie: ", 8) == 0) {
packet->http_cookie.ptr = &packet->line[packet->parsed_lines].ptr[8];
packet->http_cookie.len = packet->line[packet->parsed_lines].len - 8;
}
if (packet->line[packet->parsed_lines].len > 16
&& memcmp(packet->line[packet->parsed_lines].ptr, "X-Session-Type: ", 16) == 0) {
packet->http_x_session_type.ptr = &packet->line[packet->parsed_lines].ptr[16];
packet->http_x_session_type.len = packet->line[packet->parsed_lines].len - 16;
}
if (packet->line[packet->parsed_lines].len == 0) {
packet->empty_line_position = a;
packet->empty_line_position_set = 1;
}
if (packet->parsed_lines >= (NDPI_MAX_PARSE_LINES_PER_PACKET - 1)) {
return;
}
packet->parsed_lines++;
packet->line[packet->parsed_lines].ptr = &packet->payload[a + 2];
packet->line[packet->parsed_lines].len = 0;
if ((a + 2) >= packet->payload_packet_len) {
return;
}
a++;
}
}
if (packet->parsed_lines >= 1) {
packet->line[packet->parsed_lines].len
= (u_int16_t)(((unsigned long) &packet->payload[packet->payload_packet_len]) -
((unsigned long) packet->line[packet->parsed_lines].ptr));
packet->parsed_lines++;
}
}
void ndpi_parse_packet_line_info_unix(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
u_int32_t a;
u_int16_t end = packet->payload_packet_len;
if (packet->packet_unix_lines_parsed_complete != 0)
return;
packet->packet_unix_lines_parsed_complete = 1;
packet->parsed_unix_lines = 0;
if (packet->payload_packet_len == 0)
return;
packet->unix_line[packet->parsed_unix_lines].ptr = packet->payload;
packet->unix_line[packet->parsed_unix_lines].len = 0;
for (a = 0; a < end; a++) {
if (packet->payload[a] == 0x0a) {
packet->unix_line[packet->parsed_unix_lines].len = (u_int16_t)(
((unsigned long) &packet->payload[a]) -
((unsigned long) packet->unix_line[packet->parsed_unix_lines].ptr));
if (packet->parsed_unix_lines >= (NDPI_MAX_PARSE_LINES_PER_PACKET - 1)) {
break;
}
packet->parsed_unix_lines++;
packet->unix_line[packet->parsed_unix_lines].ptr = &packet->payload[a + 1];
packet->unix_line[packet->parsed_unix_lines].len = 0;
if ((a + 1) >= packet->payload_packet_len) {
break;
}
//a++;
}
}
}
u_int16_t ndpi_check_for_email_address(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow, u_int16_t counter)
{
struct ndpi_packet_struct *packet = &flow->packet;
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "called ndpi_check_for_email_address\n");
if (packet->payload_packet_len > counter && ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z')
|| (packet->payload[counter] >= 'A' && packet->payload[counter] <= 'Z')
|| (packet->payload[counter] >= '0' && packet->payload[counter] <= '9')
|| packet->payload[counter] == '-' || packet->payload[counter] == '_')) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "first letter\n");
counter++;
while (packet->payload_packet_len > counter
&& ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z')
|| (packet->payload[counter] >= 'A' && packet->payload[counter] <= 'Z')
|| (packet->payload[counter] >= '0' && packet->payload[counter] <= '9')
|| packet->payload[counter] == '-' || packet->payload[counter] == '_'
|| packet->payload[counter] == '.')) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "further letter\n");
counter++;
if (packet->payload_packet_len > counter && packet->payload[counter] == '@') {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "@\n");
counter++;
while (packet->payload_packet_len > counter
&& ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z')
|| (packet->payload[counter] >= 'A' && packet->payload[counter] <= 'Z')
|| (packet->payload[counter] >= '0' && packet->payload[counter] <= '9')
|| packet->payload[counter] == '-' || packet->payload[counter] == '_')) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "letter\n");
counter++;
if (packet->payload_packet_len > counter && packet->payload[counter] == '.') {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, ".\n");
counter++;
if (packet->payload_packet_len > counter + 1
&& ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z')
&& (packet->payload[counter + 1] >= 'a' && packet->payload[counter + 1] <= 'z'))) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "two letters\n");
counter += 2;
if (packet->payload_packet_len > counter
&& (packet->payload[counter] == ' ' || packet->payload[counter] == ';')) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "whitespace1\n");
return counter;
} else if (packet->payload_packet_len > counter && packet->payload[counter] >= 'a'
&& packet->payload[counter] <= 'z') {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "one letter\n");
counter++;
if (packet->payload_packet_len > counter
&& (packet->payload[counter] == ' ' || packet->payload[counter] == ';')) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "whitespace2\n");
return counter;
} else if (packet->payload_packet_len > counter && packet->payload[counter] >= 'a'
&& packet->payload[counter] <= 'z') {
counter++;
if (packet->payload_packet_len > counter
&& (packet->payload[counter] == ' ' || packet->payload[counter] == ';')) {
NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "whitespace3\n");
return counter;
} else {
return 0;
}
} else {
return 0;
}
} else {
return 0;
}
} else {
return 0;
}
}
}
return 0;
}
}
}
return 0;
}
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
void ndpi_debug_get_last_log_function_line(struct ndpi_detection_module_struct
*ndpi_struct, const char **file, const char **func, u_int32_t * line)
{
*file = "";
*func = "";
if (ndpi_struct->ndpi_debug_print_file != NULL)
*file = ndpi_struct->ndpi_debug_print_file;
if (ndpi_struct->ndpi_debug_print_function != NULL)
*func = ndpi_struct->ndpi_debug_print_function;
*line = ndpi_struct->ndpi_debug_print_line;
}
#endif
u_int8_t ndpi_detection_get_l4(const u_int8_t * l3, u_int16_t l3_len, const u_int8_t ** l4_return, u_int16_t * l4_len_return,
u_int8_t * l4_protocol_return, u_int32_t flags)
{
return ndpi_detection_get_l4_internal(NULL, l3, l3_len, l4_return, l4_len_return, l4_protocol_return, flags);
}
u_int8_t ndpi_detection_build_key(const u_int8_t * l3, u_int16_t l3_len, const u_int8_t * l4, u_int16_t l4_len, u_int8_t l4_protocol,
struct ndpi_unique_flow_ipv4_and_6_struct * key_return, u_int8_t * dir_return, u_int32_t flags)
{
return ndpi_detection_build_key_internal(NULL, l3, l3_len, l4, l4_len, l4_protocol, key_return, dir_return,
flags);
}
void ndpi_int_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type)
{
struct ndpi_id_struct *src = flow->src;
struct ndpi_id_struct *dst = flow->dst;
ndpi_int_change_protocol(ndpi_struct, flow, detected_protocol, protocol_type);
if (src != NULL) {
NDPI_ADD_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, detected_protocol);
}
if (dst != NULL) {
NDPI_ADD_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, detected_protocol);
}
}
void ndpi_int_change_flow_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type)
{
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
u_int8_t a;
u_int8_t stack_size;
u_int8_t new_is_real = 0;
u_int16_t preserve_bitmask;
#endif
if (!flow)
return;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
stack_size = flow->protocol_stack_info.current_stack_size_minus_one + 1;
/* here are the rules for stack manipulations:
* 1.if the new protocol is a real protocol, insert it at the position
* of the top-most real protocol or below the last non-unknown correlated
* protocol.
* 2.if the new protocol is not real, put it on top of stack but if there is
* a real protocol in the stack, make sure at least one real protocol remains
* in the stack
*/
if (protocol_type == NDPI_CORRELATED_PROTOCOL) {
u_int16_t saved_real_protocol = NDPI_PROTOCOL_UNKNOWN;
if (stack_size == NDPI_PROTOCOL_HISTORY_SIZE) {
/* check whether we will lost real protocol information due to shifting */
u_int16_t real_protocol = flow->protocol_stack_info.entry_is_real_protocol;
for (a = 0; a < stack_size; a++) {
if (real_protocol & 1)
break;
real_protocol >>= 1;
}
if (a == (stack_size - 1)) {
/* oh, only one real protocol at the end, store it and insert it later */
saved_real_protocol = flow->detected_protocol_stack[stack_size - 1];
}
} else {
flow->protocol_stack_info.current_stack_size_minus_one++;
stack_size++;
}
/* now shift and insert */
for (a = stack_size - 1; a > 0; a--) {
flow->detected_protocol_stack[a] = flow->detected_protocol_stack[a - 1];
}
flow->protocol_stack_info.entry_is_real_protocol <<= 1;
/* now set the new protocol */
flow->detected_protocol_stack[0] = detected_protocol;
/* restore real protocol */
if (saved_real_protocol != NDPI_PROTOCOL_UNKNOWN) {
flow->detected_protocol_stack[stack_size - 1] = saved_real_protocol;
flow->protocol_stack_info.entry_is_real_protocol |= 1 << (stack_size - 1);
}
/* done */
} else {
u_int8_t insert_at = 0;
if (!(flow->protocol_stack_info.entry_is_real_protocol & 1)) {
u_int16_t real_protocol = flow->protocol_stack_info.entry_is_real_protocol;
for (a = 0; a < stack_size; a++) {
if (real_protocol & 1)
break;
real_protocol >>= 1;
}
insert_at = a;
}
if (insert_at >= stack_size) {
/* no real protocol found, insert it at the bottom */
insert_at = stack_size - 1;
}
if (stack_size < NDPI_PROTOCOL_HISTORY_SIZE) {
flow->protocol_stack_info.current_stack_size_minus_one++;
stack_size++;
}
/* first shift all stacks */
for (a = stack_size - 1; a > insert_at; a--) {
flow->detected_protocol_stack[a] = flow->detected_protocol_stack[a - 1];
}
preserve_bitmask = (1 << insert_at) - 1;
new_is_real = (flow->protocol_stack_info.entry_is_real_protocol & (~preserve_bitmask)) << 1;
new_is_real |= flow->protocol_stack_info.entry_is_real_protocol & preserve_bitmask;
flow->protocol_stack_info.entry_is_real_protocol = new_is_real;
/* now set the new protocol */
flow->detected_protocol_stack[insert_at] = detected_protocol;
/* and finally update the additional stack information */
flow->protocol_stack_info.entry_is_real_protocol |= 1 << insert_at;
}
#else
flow->detected_protocol_stack[0] = detected_protocol;
flow->detected_subprotocol_stack[0] = detected_subprotocol;
#endif
}
void ndpi_int_change_packet_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type)
{
struct ndpi_packet_struct *packet = &flow->packet;
/* NOTE: everything below is identically to change_flow_protocol
* except flow->packet If you want to change something here,
* don't! Change it for the flow function and apply it here
* as well */
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
u_int8_t a;
u_int8_t stack_size;
u_int16_t new_is_real = 0;
u_int16_t preserve_bitmask;
#endif
if (!packet)
return;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
stack_size = packet->protocol_stack_info.current_stack_size_minus_one + 1;
/* here are the rules for stack manipulations:
* 1.if the new protocol is a real protocol, insert it at the position
* of the top-most real protocol or below the last non-unknown correlated
* protocol.
* 2.if the new protocol is not real, put it on top of stack but if there is
* a real protocol in the stack, make sure at least one real protocol remains
* in the stack
*/
if (protocol_type == NDPI_CORRELATED_PROTOCOL) {
u_int16_t saved_real_protocol = NDPI_PROTOCOL_UNKNOWN;
if (stack_size == NDPI_PROTOCOL_HISTORY_SIZE) {
/* check whether we will lost real protocol information due to shifting */
u_int16_t real_protocol = packet->protocol_stack_info.entry_is_real_protocol;
for (a = 0; a < stack_size; a++) {
if (real_protocol & 1)
break;
real_protocol >>= 1;
}
if (a == (stack_size - 1)) {
/* oh, only one real protocol at the end, store it and insert it later */
saved_real_protocol = packet->detected_protocol_stack[stack_size - 1];
}
} else {
packet->protocol_stack_info.current_stack_size_minus_one++;
stack_size++;
}
/* now shift and insert */
for (a = stack_size - 1; a > 0; a--) {
packet->detected_protocol_stack[a] = packet->detected_protocol_stack[a - 1];
}
packet->protocol_stack_info.entry_is_real_protocol <<= 1;
/* now set the new protocol */
packet->detected_protocol_stack[0] = detected_protocol;
/* restore real protocol */
if (saved_real_protocol != NDPI_PROTOCOL_UNKNOWN) {
packet->detected_protocol_stack[stack_size - 1] = saved_real_protocol;
packet->protocol_stack_info.entry_is_real_protocol |= 1 << (stack_size - 1);
}
/* done */
} else {
u_int8_t insert_at = 0;
if (!(packet->protocol_stack_info.entry_is_real_protocol & 1)) {
u_int16_t real_protocol = packet->protocol_stack_info.entry_is_real_protocol;
for (a = 0; a < stack_size; a++) {
if (real_protocol & 1)
break;
real_protocol >>= 1;
}
insert_at = a;
}
if (insert_at >= stack_size) {
/* no real protocol found, insert it at the first unknown protocol */
insert_at = stack_size - 1;
}
if (stack_size < NDPI_PROTOCOL_HISTORY_SIZE) {
packet->protocol_stack_info.current_stack_size_minus_one++;
stack_size++;
}
/* first shift all stacks */
for (a = stack_size - 1; a > insert_at; a--) {
packet->detected_protocol_stack[a] = packet->detected_protocol_stack[a - 1];
}
preserve_bitmask = (1 << insert_at) - 1;
new_is_real = (packet->protocol_stack_info.entry_is_real_protocol & (~preserve_bitmask)) << 1;
new_is_real |= packet->protocol_stack_info.entry_is_real_protocol & preserve_bitmask;
packet->protocol_stack_info.entry_is_real_protocol = (u_int8_t)new_is_real;
/* now set the new protocol */
packet->detected_protocol_stack[insert_at] = detected_protocol;
/* and finally update the additional stack information */
packet->protocol_stack_info.entry_is_real_protocol |= 1 << insert_at;
}
#else
packet->detected_protocol_stack[0] = detected_protocol;
packet->detected_subprotocol_stack[0] = detected_subprotocol;
#endif
}
/*
* this function returns the real protocol of the flow. Actually it
* accesses the packet stack since this is what leaves the library but
* it could also use the flow stack.
*/
u_int16_t ndpi_detection_get_real_protocol_of_flow(struct ndpi_detection_module_struct * ndpi_struct,
struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
u_int8_t a;
u_int8_t stack_size;
u_int16_t real_protocol;
#endif
if (!packet)
return NDPI_PROTOCOL_UNKNOWN;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
stack_size = packet->protocol_stack_info.current_stack_size_minus_one + 1;
real_protocol = packet->protocol_stack_info.entry_is_real_protocol;
for (a = 0; a < stack_size; a++) {
if (real_protocol & 1)
return packet->detected_protocol_stack[a];
real_protocol >>= 1;
}
return NDPI_PROTOCOL_UNKNOWN;
#else
return packet->detected_protocol_stack[0];
#endif
}
/*
* this function checks whether a protocol can be found in the
* history. Actually it accesses the packet stack since this is what
* leaves the library but it could also use the flow stack.
*/
u_int8_t ndpi_detection_flow_protocol_history_contains_protocol(struct ndpi_detection_module_struct * ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t protocol_id)
{
u_int8_t a;
u_int8_t stack_size;
struct ndpi_packet_struct *packet = &flow->packet;
if (!packet)
return 0;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
stack_size = packet->protocol_stack_info.current_stack_size_minus_one + 1;
#else
stack_size = 1;
#endif
for (a = 0; a < stack_size; a++) {
if (packet->detected_protocol_stack[a] == protocol_id)
return 1;
}
return 0;
}
/* generic function for setting a protocol for a flow
*
* what it does is:
* 1.call ndpi_int_change_protocol
* 2.set protocol in detected bitmask for src and dst
*/
void ndpi_int_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type);
/* generic function for changing the flow protocol
*
* what it does is:
* 1.update the flow protocol stack with the new protocol
*/
void ndpi_int_change_flow_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type);
/* generic function for changing the packetprotocol
*
* what it does is:
* 1.update the packet protocol stack with the new protocol
*/
void ndpi_int_change_packet_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol, ndpi_protocol_type_t protocol_type);
/* generic function for changing the protocol
*
* what it does is:
* 1.update the flow protocol stack with the new protocol
* 2.update the packet protocol stack with the new protocol
*/
void ndpi_int_change_protocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
u_int16_t detected_protocol,
ndpi_protocol_type_t protocol_type)
{
ndpi_int_change_flow_protocol(ndpi_struct, flow, detected_protocol, protocol_type);
ndpi_int_change_packet_protocol(ndpi_struct, flow, detected_protocol, protocol_type);
}
/* turns a packet back to unknown */
void ndpi_int_reset_packet_protocol(struct ndpi_packet_struct *packet) {
packet->detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
packet->protocol_stack_info.current_stack_size_minus_one = 0;
packet->protocol_stack_info.entry_is_real_protocol = 0;
#endif
}
void ndpi_int_reset_protocol(struct ndpi_flow_struct *flow)
{
if (flow) {
flow->detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN;
#if NDPI_PROTOCOL_HISTORY_SIZE > 1
flow->protocol_stack_info.current_stack_size_minus_one = 0;
flow->protocol_stack_info.entry_is_real_protocol = 0;
#endif
}
}
void ndpi_ip_clear(ndpi_ip_addr_t * ip)
{
memset(ip, 0, sizeof(ndpi_ip_addr_t));
}
/* NTOP */
int ndpi_ip_is_set(const ndpi_ip_addr_t * ip)
{
return memcmp(ip, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", sizeof(ndpi_ip_addr_t)) != 0;
}
/* check if the source ip address in packet and ip are equal */
/* NTOP */
int ndpi_packet_src_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip)
{
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (packet->iphv6 != NULL) {
if (packet->iphv6->saddr.ndpi_v6_u.u6_addr64[0] == ip->ipv6.ndpi_v6_u.u6_addr64[0] &&
packet->iphv6->saddr.ndpi_v6_u.u6_addr64[1] == ip->ipv6.ndpi_v6_u.u6_addr64[1]) {
return 1;
} else {
return 0;
}
}
#endif
if (packet->iph->saddr == ip->ipv4) {
return 1;
}
return 0;
}
/* check if the destination ip address in packet and ip are equal */
int ndpi_packet_dst_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip)
{
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (packet->iphv6 != NULL) {
if (packet->iphv6->daddr.ndpi_v6_u.u6_addr64[0] == ip->ipv6.ndpi_v6_u.u6_addr64[0] &&
packet->iphv6->daddr.ndpi_v6_u.u6_addr64[1] == ip->ipv6.ndpi_v6_u.u6_addr64[1]) {
return 1;
} else {
return 0;
}
}
#endif
if (packet->iph->daddr == ip->ipv4) {
return 1;
}
return 0;
}
/* get the source ip address from packet and put it into ip */
/* NTOP */
void ndpi_packet_src_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip)
{
ndpi_ip_clear(ip);
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (packet->iphv6 != NULL) {
ip->ipv6.ndpi_v6_u.u6_addr64[0] = packet->iphv6->saddr.ndpi_v6_u.u6_addr64[0];
ip->ipv6.ndpi_v6_u.u6_addr64[1] = packet->iphv6->saddr.ndpi_v6_u.u6_addr64[1];
} else
#endif
ip->ipv4 = packet->iph->saddr;
}
/* get the destination ip address from packet and put it into ip */
/* NTOP */
void ndpi_packet_dst_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip)
{
ndpi_ip_clear(ip);
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (packet->iphv6 != NULL) {
ip->ipv6.ndpi_v6_u.u6_addr64[0] = packet->iphv6->daddr.ndpi_v6_u.u6_addr64[0];
ip->ipv6.ndpi_v6_u.u6_addr64[1] = packet->iphv6->daddr.ndpi_v6_u.u6_addr64[1];
} else
#endif
ip->ipv4 = packet->iph->daddr;
}
#ifdef NDPI_ENABLE_DEBUG_MESSAGES
/* get the string representation of ip
* returns a pointer to a static string
* only valid until the next call of this function */
char *ndpi_get_ip_string(struct ndpi_detection_module_struct *ndpi_struct,
const ndpi_ip_addr_t * ip)
{
const u_int8_t *a = (const u_int8_t *) &ip->ipv4;
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if (ip->ipv6.ndpi_v6_u.u6_addr32[1] != 0 || ip->ipv6.ndpi_v6_u.u6_addr64[1] != 0) {
const u_int16_t *b = ip->ipv6.ndpi_v6_u.u6_addr16;
snprintf(ndpi_struct->ip_string, NDPI_IP_STRING_SIZE, "%x:%x:%x:%x:%x:%x:%x:%x",
ntohs(b[0]), ntohs(b[1]), ntohs(b[2]), ntohs(b[3]),
ntohs(b[4]), ntohs(b[5]), ntohs(b[6]), ntohs(b[7]));
return ndpi_struct->ip_string;
}
#endif
snprintf(ndpi_struct->ip_string, NDPI_IP_STRING_SIZE, "%u.%u.%u.%u", a[0], a[1], a[2], a[3]);
return ndpi_struct->ip_string;
}
/* get the string representation of the source ip address from packet */
char *ndpi_get_packet_src_ip_string(struct ndpi_detection_module_struct *ndpi_struct,
const struct ndpi_packet_struct *packet)
{
ndpi_ip_addr_t ip;
ndpi_packet_src_ip_get(packet, &ip);
return ndpi_get_ip_string(ndpi_struct, &ip);
}
/* get the string representation of the destination ip address from packet */
char *ndpi_get_packet_dst_ip_string(struct ndpi_detection_module_struct *ndpi_struct,
const struct ndpi_packet_struct *packet)
{
ndpi_ip_addr_t ip;
ndpi_packet_dst_ip_get(packet, &ip);
return ndpi_get_ip_string(ndpi_struct, &ip);
}
#endif /* NDPI_ENABLE_DEBUG_MESSAGES */
/* ****************************************************** */
u_int16_t ntohs_ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read)
{
u_int16_t val = ndpi_bytestream_to_number(str, max_chars_to_read, bytes_read);
return ntohs(val);
}
/* ****************************************************** */
#ifndef __KERNEL__
static u_int is_port(u_int16_t sport, u_int16_t dport, u_int16_t match_port) {
return(((match_port == sport) || (match_port == dport)) ? 1 : 0);
}
#endif
/* ****************************************************** */
unsigned int ndpi_find_port_based_protocol(struct ndpi_detection_module_struct *ndpi_struct /* NOTUSED */,
u_int8_t proto,
u_int32_t shost, u_int16_t sport,
u_int32_t dhost, u_int16_t dport) {
/* Skyfile (host 193.252.234.246 or host 10.10.102.80) */
if((shost == 0xC1FCEAF6) || (dhost == 0xC1FCEAF6)
|| (shost == 0x0A0A6650) || (dhost == 0x0A0A6650)) {
if((sport == 4708) || (dport == 4708)) return(NDPI_PROTOCOL_SKYFILE_PREPAID);
else if((sport == 4709) || (dport == 4709)) return(NDPI_PROTOCOL_SKYFILE_RUDICS);
else if((sport == 4710) || (dport == 4710)) return(NDPI_PROTOCOL_SKYFILE_POSTPAID);
}
return(NDPI_PROTOCOL_UNKNOWN);
}
/* ****************************************************** */
unsigned int ndpi_guess_undetected_protocol(struct ndpi_detection_module_struct *ndpi_struct,
u_int8_t proto,
u_int32_t shost, u_int16_t sport,
u_int32_t dhost, u_int16_t dport) {
const void *ret;
ndpi_default_ports_tree_node_t node;
if(sport && dport) {
node.default_port = sport;
ret = ndpi_tfind(&node, (proto == IPPROTO_TCP) ? (void*)&ndpi_struct->tcpRoot : (void*)&ndpi_struct->udpRoot, ndpi_default_ports_tree_node_t_cmp);
if(ret == NULL) {
node.default_port = dport;
ret = ndpi_tfind(&node, (proto == IPPROTO_TCP) ? (void*)&ndpi_struct->tcpRoot : (void*)&ndpi_struct->udpRoot, ndpi_default_ports_tree_node_t_cmp);
}
if(ret != NULL) {
ndpi_default_ports_tree_node_t *found = *(ndpi_default_ports_tree_node_t**)ret;
return(found->proto->protoId);
}
}
/* Use skype as last resort */
if(shost && dhost && is_skype_connection(ndpi_struct, shost, dhost))
return(NDPI_PROTOCOL_SKYPE);
return(ndpi_search_tcp_or_udp_raw(ndpi_struct, proto, shost, dhost, sport, dport));
}
/* ****************************************************** */
char* ndpi_get_proto_name(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t proto_id) {
if((proto_id >= ndpi_mod->ndpi_num_supported_protocols)
&& ((proto_id < NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS)
&& (ndpi_mod->proto_defaults[proto_id].protoName == NULL)))
proto_id = NDPI_PROTOCOL_UNKNOWN;
return(ndpi_mod->proto_defaults[proto_id].protoName);
}
/* ****************************************************** */
int ndpi_get_protocol_id(struct ndpi_detection_module_struct *ndpi_mod, char *proto) {
int i;
for(i=0; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++)
if(strcasecmp(proto, ndpi_mod->proto_defaults[i].protoName) == 0)
return(i);
return(-1);
}
/* ****************************************************** */
void ndpi_dump_protocols(struct ndpi_detection_module_struct *ndpi_mod) {
int i;
for(i=0; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++)
printf("[%3d] %s\n", i, ndpi_mod->proto_defaults[i].protoName);
}
/* ****************************************************** */
/*
* Find the first occurrence of find in s, where the search is limited to the
* first slen characters of s.
*/
char* ndpi_strnstr(const char *s, const char *find, size_t slen) {
char c, sc;
size_t len;
if ((c = *find++) != '\0') {
len = strlen(find);
do {
do {
if (slen-- < 1 || (sc = *s++) == '\0')
return (NULL);
} while (sc != c);
if (len > slen)
return (NULL);
} while (strncmp(s, find, len) != 0);
s--;
}
return ((char *)s);
}
/* ****************************************************** */
int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
char *string_to_match, u_int string_to_match_len) {
int matching_protocol_id;
struct ndpi_packet_struct *packet = &flow->packet;
AC_TEXT_t ac_input_text;
if((ndpi_struct->ac_automa == NULL) || (string_to_match_len== 0)) return(NDPI_PROTOCOL_UNKNOWN);
if(!ndpi_struct->ac_automa_finalized) {
ac_automata_finalize((AC_AUTOMATA_t*)ndpi_struct->ac_automa);
ndpi_struct->ac_automa_finalized = 1;
}
matching_protocol_id = NDPI_PROTOCOL_UNKNOWN;
ac_input_text.astring = string_to_match, ac_input_text.length = string_to_match_len;
ac_automata_search (((AC_AUTOMATA_t*)ndpi_struct->ac_automa), &ac_input_text, (void*)&matching_protocol_id);
ac_automata_reset(((AC_AUTOMATA_t*)ndpi_struct->ac_automa));
#ifdef DEBUG
{
char m[256];
int len = ndpi_min(sizeof(m), string_to_match_len);
strncpy(m, string_to_match, len);
m[len] = '\0';
printf("[NDPI] ndpi_match_string_subprotocol(%s): %s\n", m, ndpi_struct->proto_defaults[matching_protocol_id].protoName);
}
#endif
if (matching_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
packet->detected_protocol_stack[0] = matching_protocol_id;
return(packet->detected_protocol_stack[0]);
}
#ifdef DEBUG
string_to_match[string_to_match_len] = '\0';
printf("[NTOP] Unable to find a match for '%s'\n", string_to_match);
#endif
return(NDPI_PROTOCOL_UNKNOWN);
}
/* ****************************************************** */
void* ndpi_create_empty_automa(struct ndpi_detection_module_struct *ndpi_struct) {
int i;
void *automa = ac_automata_init(ac_match_handler);
for(i=0; host_match[i].string_to_match != NULL; i++)
ndpi_add_host_url_subprotocol_to_automa(ndpi_struct,
host_match[i].string_to_match,
host_match[i].protocol_id, automa);
return(automa);
}
/* ****************************************************** */
int ndpi_add_host_url_subprotocol_to_automa(struct ndpi_detection_module_struct *ndpi_struct, char *value, int protocol_id, void* automa) {
AC_PATTERN_t ac_pattern;
/* e.g attr = "host" value = ".facebook.com" protocol_id = NDPI_PROTOCOL_FACEBOOK */
#ifdef DEBUG
printf("[NDPI] ndpi_add_host_url_subprotocol(%s, %s, %d)\n", attr, value, protocol_id);
#endif
if(protocol_id >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) {
printf("[NDPI] %s(protoId=%d): INTERNAL ERROR\n", __FUNCTION__, protocol_id);
return(-1);
}
if(automa == NULL) return(-2);
ac_pattern.astring = value;
ac_pattern.rep.number = protocol_id;
ac_pattern.length = strlen(ac_pattern.astring);
ac_automata_add(((AC_AUTOMATA_t*)automa), &ac_pattern);
#ifdef DEBUG
printf("[NTOP] new subprotocol: %s = %s -> %d\n", attr, value, protocol_id);
#endif
return(0);
}
/* ****************************************************** */
void ndpi_set_automa(struct ndpi_detection_module_struct *ndpi_struct, void* automa) {
void *old_automa;
ac_automata_finalize((AC_AUTOMATA_t*)automa);
ndpi_struct->ac_automa_finalized = 1;
old_automa = ndpi_struct->ac_automa;
ndpi_struct->ac_automa = automa;
if(old_automa != NULL) {
#ifndef __KERNEL__
sleep(1); /* Make sure nobody is using it */
#endif
ac_automata_release((AC_AUTOMATA_t*)old_automa);
}
}
/* ****************************************************** */
char* ndpi_revision() {
return("$Revision: 6926 $");
}
/* ****************************************************** */
#ifdef WIN32
/*
int pthread_mutex_init(pthread_mutex_t *mutex, void *unused) {
unused = NULL;
*mutex = CreateMutex(NULL, FALSE, NULL);
return *mutex == NULL ? -1 : 0;
}
int pthread_mutex_destroy(pthread_mutex_t *mutex) {
return CloseHandle(*mutex) == 0 ? -1 : 0;
}
int pthread_mutex_lock(pthread_mutex_t *mutex) {
return WaitForSingleObject(*mutex, INFINITE) == WAIT_OBJECT_0 ? 0 : -1;
}
int pthread_mutex_unlock(pthread_mutex_t *mutex) {
return ReleaseMutex(*mutex) == 0 ? -1 : 0;
}
*/
/* http://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=src/port/gettimeofday.c;h=75a91993b74414c0a1c13a2a09ce739cb8aa8a08;hb=HEAD */
int gettimeofday(struct timeval * tp, struct timezone * tzp) {
/* FILETIME of Jan 1 1970 00:00:00. */
const unsigned __int64 epoch = (__int64)(116444736000000000);
FILETIME file_time;
SYSTEMTIME system_time;
ULARGE_INTEGER ularge;
GetSystemTime(&system_time);
SystemTimeToFileTime(&system_time, &file_time);
ularge.LowPart = file_time.dwLowDateTime;
ularge.HighPart = file_time.dwHighDateTime;
tp->tv_sec = (long) ((ularge.QuadPart - epoch) / 10000000L);
tp->tv_usec = (long) (system_time.wMilliseconds * 1000);
return 0;
}
#endif
int NDPI_BITMASK_COMPARE(NDPI_PROTOCOL_BITMASK a, NDPI_PROTOCOL_BITMASK b) {
int i;
for(i=0; i