Skip to content

Commit 9ab7b03

Browse files
utoniutoni
committed
Improved GearUP Booster proprietary TCP protocol detection
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
1 parent 1d65775 commit 9ab7b03

157 files changed

Lines changed: 584 additions & 538 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/lib/protocols/gearup_booster.c‎

Lines changed: 42 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,19 +42,54 @@ static void ndpi_search_gearup_booster(struct ndpi_detection_module_struct *ndpi
4242

4343
NDPI_LOG_DBG(ndpi_struct, "search GearUP Booster\n");
4444

45-
if (packet->udp->source != htons(9999) && packet->udp->dest != htons(9999))
46-
{
47-
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
45+
if (packet->tcp != NULL && packet->payload_packet_len >= 16) {
46+
if (flow->packet_counter <= 3) {
47+
int32_t pdu_length = ntohl(get_u_int32_t(packet->payload, 0));
48+
if (pdu_length != packet->payload_packet_len - 4) {
49+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
50+
return;
51+
}
52+
}
53+
if (packet->payload[4] != 0x08) {
54+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
55+
return;
56+
}
57+
if (flow->packet_counter <= 2) {
58+
if (packet->payload_packet_len > 128 ||
59+
packet->payload[5] != 0x01)
60+
{
61+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
62+
return;
63+
}
64+
} else {
65+
if (get_u_int16_t(packet->payload, 7) != ntohs(0x0510) ||
66+
get_u_int16_t(packet->payload, 13) != ntohs(0x2000))
67+
{
68+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
69+
return;
70+
}
71+
}
72+
if (flow->packet_counter >= 4) {
73+
ndpi_int_gearup_booster_add_connection(ndpi_struct, flow);
74+
}
4875
return;
4976
}
5077

51-
if (flow->packet_counter == 1)
52-
{
53-
if (packet->packet_direction != 0 || packet->udp->dest != htons(9999))
78+
if (packet->udp != NULL) {
79+
if (packet->udp->source != htons(9999) && packet->udp->dest != htons(9999))
5480
{
5581
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
5682
return;
5783
}
84+
85+
if (flow->packet_counter == 1)
86+
{
87+
if (packet->packet_direction != 0 || packet->udp->dest != htons(9999))
88+
{
89+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
90+
return;
91+
}
92+
}
5893
}
5994

6095
if (packet->payload_packet_len == 4)
@@ -86,7 +121,7 @@ void init_gearup_booster_dissector(struct ndpi_detection_module_struct *ndpi_str
86121
{
87122
ndpi_register_dissector("GeaUP_Booster", ndpi_struct,
88123
ndpi_search_gearup_booster,
89-
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
124+
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
90125
1, NDPI_PROTOCOL_GEARUP_BOOSTER);
91126
}
92127

‎tests/cfgs/caches_cfg/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 566 (94.33 diss/flow)
6+
Num dissector calls: 569 (94.83 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_cfg/result/teams.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI : 80 (flows)
9-
Num dissector calls: 523 (6.30 diss/flow)
9+
Num dissector calls: 524 (6.31 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache stun: 30/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 566 (94.33 diss/flow)
7+
Num dissector calls: 569 (94.83 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/teams.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI (partial) : 4 (flows)
99
Confidence DPI : 76 (flows)
10-
Num dissector calls: 523 (6.30 diss/flow)
10+
Num dissector calls: 524 (6.31 diss/flow)
1111
LRU cache ookla: 0/0/0 (insert/search/found)
1212
LRU cache bittorrent: 0/9/0 (insert/search/found)
1313
LRU cache stun: 30/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/bittorrent_tcp_miss.pcapng.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 10 (10.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 223 (223.00 diss/flow)
3+
Num dissector calls: 224 (224.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 5/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 38 (6.33 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 566 (94.33 diss/flow)
7+
Num dissector calls: 569 (94.83 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/teams.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI (partial) : 6 (flows)
99
Confidence DPI : 74 (flows)
10-
Num dissector calls: 523 (6.30 diss/flow)
10+
Num dissector calls: 524 (6.31 diss/flow)
1111
LRU cache ookla: 0/0/0 (insert/search/found)
1212
LRU cache bittorrent: 0/9/0 (insert/search/found)
1313
LRU cache stun: 24/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/waze.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow)
55
Confidence Unknown : 1 (flows)
66
Confidence Match by port : 9 (flows)
77
Confidence DPI : 23 (flows)
8-
Num dissector calls: 346 (10.48 diss/flow)
8+
Num dissector calls: 347 (10.52 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/30/0 (insert/search/found)
1111
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/default/pcap/gearup_booster.pcap‎

6.29 KB
Binary file not shown.

0 commit comments

Comments
 (0)