Skip to content

Commit aad7f82

Browse files
IvanNardiIvanNardi
committed
IRC: simplify detection
The long term goal is to simplify how we handle packet lines
1 parent 91da2cf commit aad7f82

107 files changed

Lines changed: 145 additions & 262 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/include/ndpi_private.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -693,7 +693,6 @@ char *ndpi_user_agent_set(struct ndpi_flow_struct *flow, const u_int8_t *value,
693693

694694
void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struct,
695695
struct ndpi_flow_struct *flow);
696-
void ndpi_parse_packet_line_info_any(struct ndpi_detection_module_struct *ndpi_struct);
697696

698697
void load_common_alpns(struct ndpi_detection_module_struct *ndpi_str);
699698
u_int8_t is_a_common_alpn(struct ndpi_detection_module_struct *ndpi_str,

‎src/include/ndpi_typedefs.h‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -906,9 +906,6 @@ struct ndpi_flow_tcp_struct {
906906
/* NDPI_PROTOCOL_WHATSAPP */
907907
u_int8_t wa_matched_so_far;
908908

909-
/* NDPI_PROTOCOL_IRC */
910-
u_int8_t irc_stage;
911-
912909
/* NDPI_PROTOCOL_NEST_LOG_SINK */
913910
u_int8_t nest_log_sink_matches;
914911

@@ -919,7 +916,7 @@ struct ndpi_flow_tcp_struct {
919916
u_int64_t seen_syn:1, seen_syn_ack:1, seen_ack:1;
920917

921918
/* NDPI_PROTOCOL_IRC */
922-
u_int64_t irc_3a_counter:3;
919+
u_int64_t irc_stage:2;
923920

924921
/* NDPI_PROTOCOL_USENET */
925922
u_int64_t usenet_stage:2;
@@ -970,7 +967,7 @@ struct ndpi_flow_tcp_struct {
970967
u_int64_t rdp_protocol_detected:1;
971968

972969
/* Reserved for future use */
973-
u_int64_t reserved:20;
970+
u_int64_t reserved:21;
974971
};
975972

976973
/* ************************************************** */

‎src/lib/ndpi_main.c‎

Lines changed: 0 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -11120,47 +11120,6 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_str,
1112011120

1112111121
/* ********************************************************************************* */
1112211122

11123-
void ndpi_parse_packet_line_info_any(struct ndpi_detection_module_struct *ndpi_str) {
11124-
struct ndpi_packet_struct *packet = &ndpi_str->packet;
11125-
u_int32_t a;
11126-
u_int16_t end = packet->payload_packet_len;
11127-
11128-
if(packet->packet_lines_parsed_complete != 0)
11129-
return;
11130-
11131-
packet->packet_lines_parsed_complete = 1;
11132-
packet->parsed_lines = 0;
11133-
11134-
if(packet->payload_packet_len == 0)
11135-
return;
11136-
11137-
packet->line[packet->parsed_lines].ptr = packet->payload;
11138-
packet->line[packet->parsed_lines].len = 0;
11139-
11140-
for(a = 0; a < end; a++) {
11141-
if(packet->payload[a] == 0x0a) {
11142-
packet->line[packet->parsed_lines].len = (u_int16_t)(((size_t) &packet->payload[a]) - ((size_t) packet->line[packet->parsed_lines].ptr));
11143-
11144-
if(a > 0 && packet->payload[a - 1] == 0x0d)
11145-
packet->line[packet->parsed_lines].len--;
11146-
11147-
if(packet->parsed_lines >= (NDPI_MAX_PARSE_LINES_PER_PACKET - 1))
11148-
break;
11149-
11150-
packet->parsed_lines++;
11151-
packet->line[packet->parsed_lines].ptr = &packet->payload[a + 1];
11152-
packet->line[packet->parsed_lines].len = 0;
11153-
11154-
if((a + 1) >= packet->payload_packet_len)
11155-
break;
11156-
11157-
//a++;
11158-
}
11159-
}
11160-
}
11161-
11162-
/* ********************************************************************************* */
11163-
1116411123
u_int8_t ndpi_detection_get_l4(const u_int8_t *l3, u_int16_t l3_len, const u_int8_t **l4_return,
1116511124
u_int16_t *l4_len_return, u_int8_t *l4_protocol_return, u_int32_t flags) {
1116611125
return(ndpi_detection_get_l4_internal(NULL, l3, l3_len, l4_return, l4_len_return, l4_protocol_return, flags));

‎src/lib/protocols/irc.c‎

Lines changed: 38 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232

3333
static void ndpi_int_irc_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, ndpi_confidence_t confidence)
3434
{
35+
NDPI_LOG_INFO(ndpi_struct, "Found IRC\n");
3536
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IRC, NDPI_PROTOCOL_UNKNOWN, confidence);
3637
}
3738

@@ -50,122 +51,49 @@ static void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct
5051
{
5152
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
5253

53-
u_int16_t c = 0;
54-
u_int16_t i = 0;
55-
5654
NDPI_LOG_DBG(ndpi_struct, "search irc\n");
57-
if((flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && (flow->packet_counter > 10))
58-
|| (flow->packet_counter >= 10)) {
59-
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
60-
return;
61-
}
62-
63-
if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter < 20
64-
&& packet->payload_packet_len >= 8) {
65-
if (get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x0a
66-
|| (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0a00)) {
67-
if (memcmp(packet->payload, ":", 1) == 0) {
68-
if (packet->payload[packet->payload_packet_len - 2] != 0x0d
69-
&& packet->payload[packet->payload_packet_len - 1] == 0x0a) {
70-
ndpi_parse_packet_line_info_any(ndpi_struct);
71-
} else if (packet->payload[packet->payload_packet_len - 2] == 0x0d) {
72-
ndpi_parse_packet_line_info(ndpi_struct, flow);
73-
} else {
74-
flow->l4.tcp.irc_3a_counter++;
75-
packet->parsed_lines = 0;
76-
}
77-
for (i = 0; i < packet->parsed_lines; i++) {
78-
if ((packet->line[i].len > 0) && packet->line[i].ptr[0] == ':') {
79-
flow->l4.tcp.irc_3a_counter++;
80-
if (flow->l4.tcp.irc_3a_counter == 7) { /* ':' == 0x3a */
81-
NDPI_LOG_INFO(ndpi_struct, "found irc. 0x3a. seven times.");
82-
ndpi_int_irc_add_connection(ndpi_struct, flow, NDPI_CONFIDENCE_DPI);
83-
return;
84-
}
85-
}
86-
}
87-
if (flow->l4.tcp.irc_3a_counter == 7) { /* ':' == 0x3a */
88-
NDPI_LOG_INFO(ndpi_struct, "found irc. 0x3a. seven times.");
89-
ndpi_int_irc_add_connection(ndpi_struct, flow, NDPI_CONFIDENCE_DPI);
90-
return;
91-
}
92-
}
9355

94-
if ((memcmp(packet->payload, "USER ", 5) == 0)
95-
|| (memcmp(packet->payload, "NICK ", 5) == 0)
96-
|| (memcmp(packet->payload, "PASS ", 5) == 0)
97-
|| (memcmp(packet->payload, ":", 1) == 0 && ndpi_check_for_NOTICE_or_PRIVMSG(ndpi_struct) != 0)
98-
|| (memcmp(packet->payload, "PONG ", 5) == 0)
99-
|| (memcmp(packet->payload, "PING ", 5) == 0)
100-
|| (memcmp(packet->payload, "JOIN ", 5) == 0)
101-
|| (memcmp(packet->payload, "MODE ", 5) == 0)
102-
|| (memcmp(packet->payload, "NOTICE ", 7) == 0)
103-
|| (memcmp(packet->payload, "PRIVMSG ", 8) == 0)
104-
|| (memcmp(packet->payload, "VERSION ", 8) == 0)) {
105-
char *user = ndpi_strnstr((char*)packet->payload, "USER ", packet->payload_packet_len);
106-
107-
if(user) {
108-
char buf[32], msg[64], *sp;
109-
110-
snprintf(buf, sizeof(buf), "%.*s", (int)(packet->payload_packet_len - (user + 5 - (char *)packet->payload)), user + 5);
111-
sp = buf;
112-
strsep(&sp, " \r\n");
56+
/* Simple detection, expecially from the beginning of the flow */
57+
58+
if(packet->payload_packet_len >= 8 &&
59+
(get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x0a ||
60+
ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0a00)) {
61+
62+
if (memcmp(packet->payload, "USER ", 5) == 0 ||
63+
memcmp(packet->payload, "NICK ", 5) == 0 ||
64+
memcmp(packet->payload, "PASS ", 5) == 0 ||
65+
(memcmp(packet->payload, ":", 1) == 0 && ndpi_check_for_NOTICE_or_PRIVMSG(ndpi_struct) != 0) ||
66+
memcmp(packet->payload, "PONG ", 5) == 0 ||
67+
memcmp(packet->payload, "HELLO ", 6) == 0 ||
68+
memcmp(packet->payload, "YOURIP ", 7) == 0 ||
69+
memcmp(packet->payload, "PING ", 5) == 0 ||
70+
memcmp(packet->payload, "JOIN ", 5) == 0 ||
71+
memcmp(packet->payload, "MODE ", 5) == 0 ||
72+
memcmp(packet->payload, "NOTICE ", 7) == 0 ||
73+
memcmp(packet->payload, "PRIVMSG ", 8) == 0 ||
74+
memcmp(packet->payload, "VERSION ", 8) == 0) {
75+
char *user = ndpi_strnstr((char*)packet->payload, "USER ", packet->payload_packet_len);
76+
77+
if(user) {
78+
char buf[32], msg[64], *sp;
79+
80+
snprintf(buf, sizeof(buf), "%.*s", (int)(packet->payload_packet_len - (user + 5 - (char *)packet->payload)), user + 5);
81+
sp = buf;
82+
strsep(&sp, " \r\n");
11383

114-
snprintf(msg, sizeof(msg), "Found IRC username (%s)", buf);
115-
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS, msg);
116-
}
117-
118-
NDPI_LOG_DBG2(ndpi_struct,
119-
"USER, NICK, PASS, NOTICE, PRIVMSG one time");
120-
if (flow->l4.tcp.irc_stage == 2) {
121-
NDPI_LOG_INFO(ndpi_struct, "found irc");
122-
ndpi_int_irc_add_connection(ndpi_struct, flow, NDPI_CONFIDENCE_DPI);
123-
flow->l4.tcp.irc_stage = 3;
124-
}
125-
if (flow->l4.tcp.irc_stage == 1) {
126-
NDPI_LOG_DBG2(ndpi_struct, "second time, stage=2");
127-
flow->l4.tcp.irc_stage = 2;
128-
}
129-
if (flow->l4.tcp.irc_stage == 0) {
130-
NDPI_LOG_DBG2(ndpi_struct, "first time, stage=1");
131-
flow->l4.tcp.irc_stage = 1;
132-
}
133-
/* irc packets can have either windows line breaks (0d0a) or unix line breaks (0a) */
134-
if (packet->payload[packet->payload_packet_len - 2] == 0x0d
135-
&& packet->payload[packet->payload_packet_len - 1] == 0x0a) {
136-
ndpi_parse_packet_line_info(ndpi_struct, flow);
137-
if (packet->parsed_lines > 1) {
138-
NDPI_LOG_DBG2(ndpi_struct, "packet contains more than one line");
139-
for (c = 1; c < packet->parsed_lines; c++) {
140-
if (packet->line[c].len > 4 && (memcmp(packet->line[c].ptr, "NICK ", 5) == 0
141-
|| memcmp(packet->line[c].ptr, "USER ", 5) == 0)) {
142-
NDPI_LOG_INFO(ndpi_struct, "found IRC: two icq signal words in the same packet");
143-
ndpi_int_irc_add_connection(ndpi_struct, flow, NDPI_CONFIDENCE_DPI);
144-
flow->l4.tcp.irc_stage = 3;
145-
return;
146-
}
147-
}
148-
}
149-
150-
} else if (packet->payload[packet->payload_packet_len - 1] == 0x0a) {
151-
ndpi_parse_packet_line_info_any(ndpi_struct);
152-
if (packet->parsed_lines > 1) {
153-
NDPI_LOG_DBG2(ndpi_struct, "packet contains more than one line");
154-
for (c = 1; c < packet->parsed_lines; c++) {
155-
if (packet->line[c].len > 4 && (memcmp(packet->line[c].ptr, "NICK ", 5) == 0
156-
|| memcmp(packet->line[c].ptr, "USER ",
157-
5) == 0)) {
158-
NDPI_LOG_INFO(ndpi_struct, "found IRC: two icq signal words in the same packet");
159-
ndpi_int_irc_add_connection(ndpi_struct, flow, NDPI_CONFIDENCE_DPI);
160-
flow->l4.tcp.irc_stage = 3;
161-
return;
162-
}
163-
}
164-
}
165-
}
84+
snprintf(msg, sizeof(msg), "Found IRC username (%s)", buf);
85+
ndpi_set_risk(ndpi_struct, flow, NDPI_CLEAR_TEXT_CREDENTIALS, msg);
16686
}
87+
88+
NDPI_LOG_DBG2(ndpi_struct, "IRC stage: %d\n", flow->l4.tcp.irc_stage);
89+
flow->l4.tcp.irc_stage++;
90+
/* 3 consecutive valid packets */
91+
if(flow->l4.tcp.irc_stage == 3)
92+
ndpi_int_irc_add_connection(ndpi_struct, flow, NDPI_CONFIDENCE_DPI);
93+
return;
16794
}
16895
}
96+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
16997
}
17098

17199
void init_irc_dissector(struct ndpi_detection_module_struct *ndpi_struct)

‎tests/cfgs/caches_cfg/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 572 (95.33 diss/flow)
6+
Num dissector calls: 566 (94.33 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_cfg/result/teams.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI : 80 (flows)
9-
Num dissector calls: 524 (6.31 diss/flow)
9+
Num dissector calls: 523 (6.30 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache stun: 30/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 572 (95.33 diss/flow)
7+
Num dissector calls: 566 (94.33 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/teams.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI (partial) : 4 (flows)
99
Confidence DPI : 76 (flows)
10-
Num dissector calls: 524 (6.31 diss/flow)
10+
Num dissector calls: 523 (6.30 diss/flow)
1111
LRU cache ookla: 0/0/0 (insert/search/found)
1212
LRU cache bittorrent: 0/9/0 (insert/search/found)
1313
LRU cache stun: 30/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/bittorrent_tcp_miss.pcapng.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 10 (10.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 227 (227.00 diss/flow)
3+
Num dissector calls: 223 (223.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 5/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 38 (6.33 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 572 (95.33 diss/flow)
7+
Num dissector calls: 566 (94.33 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

0 commit comments

Comments
 (0)