示例#1
0
文件: manolito.c 项目: houcy/nDPI-1
void ndpi_search_manolito_tcp_udp(struct
				  ndpi_detection_module_struct
				  *ndpi_struct, struct ndpi_flow_struct *flow)
{
  struct ndpi_packet_struct *packet = &flow->packet;
	
  struct ndpi_id_struct *src = flow->src;
  struct ndpi_id_struct *dst = flow->dst;


  if (packet->tcp != NULL) {
    if (search_manolito_tcp(ndpi_struct, flow) != 0)
      return;
  } else if (packet->udp != NULL) {
    if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_MANOLITO) {
      if (src != NULL) {
	src->manolito_last_pkt_arrival_time = packet->tick_timestamp;
      }
      if (dst != NULL) {
	dst->manolito_last_pkt_arrival_time = packet->tick_timestamp;
      }
      return;
    } else if (packet->udp->source == htons(41170)
	       || packet->udp->dest == htons(41170)) {
      if (src != NULL && src->manolito_last_pkt_arrival_time != 0
	  && (packet->tick_timestamp - src->manolito_last_pkt_arrival_time <
	      ndpi_struct->manolito_subscriber_timeout)) {
	NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO: UDP detected \n");
	ndpi_int_manolito_add_connection(ndpi_struct, flow);
	return;
      } else if (src != NULL
		 && (packet->tick_timestamp - src->manolito_last_pkt_arrival_time) >=
		 ndpi_struct->manolito_subscriber_timeout) {
	src->manolito_last_pkt_arrival_time = 0;
      }

      if (dst != NULL && dst->manolito_last_pkt_arrival_time != 0
	  && (packet->tick_timestamp - dst->manolito_last_pkt_arrival_time <
	      ndpi_struct->manolito_subscriber_timeout)) {
	NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO: UDP detected \n");
	ndpi_int_manolito_add_connection(ndpi_struct, flow);
	return;
      } else if (dst != NULL
		 && (packet->tick_timestamp - dst->manolito_last_pkt_arrival_time) >=
		 ndpi_struct->manolito_subscriber_timeout) {
	dst->manolito_last_pkt_arrival_time = 0;
      }

      if ((packet->payload_packet_len == 20 && htons(0x3d4b) == get_u_int16_t(packet->payload, 0)
	   && packet->payload[2] == 0xd9 && htons(0xedbb) == get_u_int16_t(packet->payload, 16))
	  || (packet->payload_packet_len == 25 && htons(0x3e4a) == get_u_int16_t(packet->payload, 0)
	      && htons(0x092f) == get_u_int16_t(packet->payload, 20) && packet->payload[22] == 0x20)
	  || (packet->payload_packet_len == 20 && !get_u_int16_t(packet->payload, 2) && !get_u_int32_t(packet->payload, 8)
	      && !get_u_int16_t(packet->payload, 18) && get_u_int16_t(packet->payload, 0))
	  ) {				//20B pkt is For PING
	NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO: UDP detected \n");
	ndpi_int_manolito_add_connection(ndpi_struct, flow);
	return;
      } else if (flow->packet_counter < 7) {
	return;
      }
    }
  }

  NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MANOLITO);
}
示例#2
0
void ipoque_search_manolito_tcp_udp(struct
									ipoque_detection_module_struct
									*ipoque_struct)
{
	struct ipoque_packet_struct *packet = &ipoque_struct->packet;
	struct ipoque_flow_struct *flow = ipoque_struct->flow;
	struct ipoque_id_struct *src = ipoque_struct->src;
	struct ipoque_id_struct *dst = ipoque_struct->dst;


	if (packet->tcp != NULL) {
		if (search_manolito_tcp(ipoque_struct) != 0)
			return;
	} else if (packet->udp != NULL) {
		if (flow->detected_protocol_stack[0] == IPOQUE_PROTOCOL_MANOLITO) {
			if (src != NULL) {
				src->manolito_last_pkt_arrival_time = packet->tick_timestamp;
			}
			if (dst != NULL) {
				dst->manolito_last_pkt_arrival_time = packet->tick_timestamp;
			}
			return;
		} else if (packet->udp->source == htons(41170)
				   || packet->udp->dest == htons(41170)) {
			if (src != NULL && src->manolito_last_pkt_arrival_time != 0
				&& (packet->tick_timestamp - src->manolito_last_pkt_arrival_time <
					ipoque_struct->manolito_subscriber_timeout)) {
				IPQ_LOG(IPOQUE_PROTOCOL_MANOLITO, ipoque_struct, IPQ_LOG_DEBUG, "MANOLITO: UDP detected \n");
				ipoque_int_manolito_add_connection(ipoque_struct);
				return;
			} else if (src != NULL
					   && (packet->tick_timestamp - src->manolito_last_pkt_arrival_time) >=
					   ipoque_struct->manolito_subscriber_timeout) {
				src->manolito_last_pkt_arrival_time = 0;
			}

			if (dst != NULL && dst->manolito_last_pkt_arrival_time != 0
				&& (packet->tick_timestamp - dst->manolito_last_pkt_arrival_time <
					ipoque_struct->manolito_subscriber_timeout)) {
				IPQ_LOG(IPOQUE_PROTOCOL_MANOLITO, ipoque_struct, IPQ_LOG_DEBUG, "MANOLITO: UDP detected \n");
				ipoque_int_manolito_add_connection(ipoque_struct);
				return;
			} else if (dst != NULL
					   && (packet->tick_timestamp - dst->manolito_last_pkt_arrival_time) >=
					   ipoque_struct->manolito_subscriber_timeout) {
				dst->manolito_last_pkt_arrival_time = 0;
			}

			if ((packet->payload_packet_len == 20 && htons(0x3d4b) == get_u16(packet->payload, 0)
				 && packet->payload[2] == 0xd9 && htons(0xedbb) == get_u16(packet->payload, 16))
				|| (packet->payload_packet_len == 25 && htons(0x3e4a) == get_u16(packet->payload, 0)
					&& htons(0x092f) == get_u16(packet->payload, 20) && packet->payload[22] == 0x20)
				|| (packet->payload_packet_len == 20 && !get_u16(packet->payload, 2) && !get_u32(packet->payload, 8)
					&& !get_u16(packet->payload, 18) && get_u16(packet->payload, 0))
				) {				//20B pkt is For PING
				IPQ_LOG(IPOQUE_PROTOCOL_MANOLITO, ipoque_struct, IPQ_LOG_DEBUG, "MANOLITO: UDP detected \n");
				ipoque_int_manolito_add_connection(ipoque_struct);
				return;
			} else if (flow->packet_counter < 7) {
				return;
			}
		}
	}

	IPOQUE_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, IPOQUE_PROTOCOL_MANOLITO);
}