227 lines
5.8 KiB
C
227 lines
5.8 KiB
C
#pragma once
|
|
|
|
#include "libprotoident/libprotoident.h"
|
|
#include "uthash/uthash.h"
|
|
|
|
#define MAX_APP_ID_NUM 8
|
|
|
|
typedef enum {
|
|
LPI_PROTO_EXTEND_FRIST = LPI_PROTO_LAST,
|
|
LPI_PROTO_IKE, //unsupport
|
|
LPI_PROTO_DOH, //unsupport
|
|
LPI_PROTO_MAIL, //unsupport
|
|
LPI_PROTO_ESNI, //unsupport
|
|
LPI_PROTP_FTPS,
|
|
LPI_PROTO_EXTEND_LAST
|
|
} extend_lpi_protocol_t;
|
|
|
|
struct l7_protocol_label
|
|
{
|
|
int continue_scan_flag; //0: stop; 1: continue
|
|
int protocol_id_num;
|
|
unsigned short protocol_id[MAX_APP_ID_NUM];
|
|
};
|
|
|
|
struct l7_protocol_hash
|
|
{
|
|
int protocol_id;
|
|
int lpi_protocol;
|
|
char name[64];
|
|
UT_hash_handle hh;
|
|
};
|
|
|
|
|
|
struct ovpn_ctx
|
|
{
|
|
uint64_t local_session_id;
|
|
int contain_local_session_id_pkt_num;
|
|
int valid_opcode_cnt;
|
|
};
|
|
|
|
struct traffic_context
|
|
{
|
|
unsigned char is_identify;
|
|
unsigned char is_first_payload;
|
|
unsigned short pkt_cnt;
|
|
unsigned short s2c_pkt;
|
|
unsigned short c2s_pkt;
|
|
lpi_data_t lpi_data; // lpi API
|
|
union{
|
|
uint64_t ctx[2];
|
|
struct ovpn_ctx ovpn;
|
|
};
|
|
};
|
|
|
|
//https://github.com/quicwg/base-drafts/wiki/QUIC-Versions
|
|
enum _QUIC_VERSION
|
|
{
|
|
QUIC_VERSION_UNKNOWN=0,
|
|
//NetApp
|
|
QUANT_VERSION_00=0x45474700,
|
|
QUANT_VERSION_FF=0x454747FF,
|
|
|
|
//Private Octopus
|
|
PICOQUIC_VERSION_30=0x50435130,
|
|
|
|
//google
|
|
GQUIC_VERSION_Q001=0x51303031,
|
|
GQUIC_VERSION_Q002=0x51303032,
|
|
GQUIC_VERSION_Q003=0x51303033,
|
|
GQUIC_VERSION_Q004=0x51303034,
|
|
GQUIC_VERSION_Q005=0x51303035,
|
|
GQUIC_VERSION_Q006=0x51303036,
|
|
GQUIC_VERSION_Q007=0x51303037,
|
|
GQUIC_VERSION_Q008=0x51303038,
|
|
GQUIC_VERSION_Q009=0x51303039,
|
|
|
|
GQUIC_VERSION_Q010=0x51303130,
|
|
GQUIC_VERSION_Q011=0x51303131,
|
|
GQUIC_VERSION_Q012=0x51303132,
|
|
GQUIC_VERSION_Q013=0x51303133,
|
|
GQUIC_VERSION_Q014=0x51303134,
|
|
GQUIC_VERSION_Q015=0x51303135,
|
|
GQUIC_VERSION_Q016=0x51303136,
|
|
GQUIC_VERSION_Q017=0x51303137,
|
|
GQUIC_VERSION_Q018=0x51303138,
|
|
GQUIC_VERSION_Q019=0x51303139,
|
|
|
|
GQUIC_VERSION_Q020=0x51303230,
|
|
GQUIC_VERSION_Q021=0x51303231,
|
|
GQUIC_VERSION_Q022=0x51303232,
|
|
GQUIC_VERSION_Q023=0x51303233,
|
|
GQUIC_VERSION_Q024=0x51303234,
|
|
GQUIC_VERSION_Q025=0x51303235,
|
|
GQUIC_VERSION_Q026=0x51303236,
|
|
GQUIC_VERSION_Q027=0x51303237,
|
|
GQUIC_VERSION_Q028=0x51303238,
|
|
GQUIC_VERSION_Q029=0x51303239,
|
|
|
|
GQUIC_VERSION_Q030=0x51303330,
|
|
GQUIC_VERSION_Q031=0x51303331,
|
|
GQUIC_VERSION_Q032=0x51303332,
|
|
GQUIC_VERSION_Q033=0x51303333,
|
|
GQUIC_VERSION_Q034=0x51303334,
|
|
GQUIC_VERSION_Q035=0x51303335,
|
|
GQUIC_VERSION_Q036=0x51303336,
|
|
GQUIC_VERSION_Q037=0x51303337,
|
|
GQUIC_VERSION_Q038=0x51303338,
|
|
GQUIC_VERSION_Q039=0x51303339,
|
|
|
|
GQUIC_VERSION_Q040=0x51303430,
|
|
GQUIC_VERSION_Q041=0x51303431,
|
|
GQUIC_VERSION_Q042=0x51303432,
|
|
GQUIC_VERSION_Q043=0x51303433,
|
|
GQUIC_VERSION_Q044=0x51303434,
|
|
GQUIC_VERSION_Q045=0x51303435,
|
|
GQUIC_VERSION_Q046=0x51303436,
|
|
GQUIC_VERSION_Q047=0x51303437,
|
|
GQUIC_VERSION_Q048=0x51303438,
|
|
GQUIC_VERSION_Q049=0x51303439,
|
|
|
|
GQUIC_VERSION_Q050=0x51303530,
|
|
GQUIC_VERSION_Q051=0x51303531,
|
|
GQUIC_VERSION_Q052=0x51303532,
|
|
GQUIC_VERSION_Q053=0x51303533,
|
|
GQUIC_VERSION_Q054=0x51303534,
|
|
GQUIC_VERSION_Q055=0x51303535,
|
|
GQUIC_VERSION_Q056=0x51303536,
|
|
GQUIC_VERSION_Q057=0x51303537,
|
|
GQUIC_VERSION_Q058=0x51303538,
|
|
GQUIC_VERSION_Q059=0x51303539,
|
|
|
|
GQUIC_VERSION_Q099=0x51303939,
|
|
|
|
//Google QUIC with TLS 48 - 49 (T048 - T049)
|
|
GQUIC_VERSION_T048=0x54303438,
|
|
GQUIC_VERSION_T049=0x54303439,
|
|
|
|
//Google QUIC with TLS 50 - 59 (T050 - T059)
|
|
GQUIC_VERSION_T050=0x54303530,
|
|
GQUIC_VERSION_T051=0x54303531,
|
|
GQUIC_VERSION_T052=0x54303532,
|
|
GQUIC_VERSION_T053=0x54303533,
|
|
GQUIC_VERSION_T054=0x54303534,
|
|
GQUIC_VERSION_T055=0x54303535,
|
|
GQUIC_VERSION_T056=0x54303536,
|
|
GQUIC_VERSION_T057=0x54303537,
|
|
GQUIC_VERSION_T058=0x54303538,
|
|
GQUIC_VERSION_T059=0x54303539,
|
|
|
|
//Google QUIC with TLS 99 (T099)
|
|
GQUIC_VERSION_T099=0x54303939,
|
|
|
|
//Google Proxied QUIC
|
|
PQUIC_VERSION_PROX=0x50524f58,
|
|
|
|
//quic-go
|
|
QUIC_GO_VERSION_00=0x51474F00,
|
|
QUIC_GO_VERSION_FF=0x51474FFF,
|
|
|
|
//quicly
|
|
QUICLY_VERSION_00=0x91c17000,
|
|
QUICLY_VERSION_FF=0x91c170FF,
|
|
|
|
//Microsoft
|
|
MSQUIC_VERSION_00=0xabcd0000,
|
|
MSQUIC_VERSION_0F=0xabcd000F,
|
|
|
|
//Mozilla
|
|
MOZQUIC_VERSION_00=0xf123f0c0,
|
|
MOZQUIC_VERSION_0F=0xf123f0cF,
|
|
|
|
//Facebook
|
|
MVFST_VERSION_00=0xfaceb000,
|
|
MVFST_VERSION_01=0xfaceb001,
|
|
MVFST_VERSION_02=0xfaceb002,
|
|
MVFST_VERSION_03=0xfaceb003,
|
|
MVFST_VERSION_04=0xfaceb004,
|
|
MVFST_VERSION_05=0xfaceb005,
|
|
MVFST_VERSION_06=0xfaceb006,
|
|
MVFST_VERSION_07=0xfaceb007,
|
|
MVFST_VERSION_08=0xfaceb008,
|
|
MVFST_VERSION_09=0xfaceb009,
|
|
MVFST_VERSION_0A=0xfaceb00A,
|
|
MVFST_VERSION_0B=0xfaceb00B,
|
|
MVFST_VERSION_0C=0xfaceb00C,
|
|
MVFST_VERSION_0D=0xfaceb00D,
|
|
MVFST_VERSION_0E=0xfaceb00E,
|
|
MVFST_VERSION_0F=0xfaceb00F,
|
|
|
|
//IETF
|
|
IQUIC_VERSION_RFC9000=0x00000001,
|
|
IQUIC_VERSION_I001=0xFF000001,
|
|
IQUIC_VERSION_I002=0xFF000002,
|
|
IQUIC_VERSION_I003=0xFF000003,
|
|
IQUIC_VERSION_I004=0xFF000004,
|
|
IQUIC_VERSION_I005=0xFF000005,
|
|
IQUIC_VERSION_I006=0xFF000006,
|
|
IQUIC_VERSION_I007=0xFF000007,
|
|
IQUIC_VERSION_I008=0xFF000008,
|
|
IQUIC_VERSION_I009=0xFF000009,
|
|
IQUIC_VERSION_I010=0xFF00000A,
|
|
IQUIC_VERSION_I011=0xFF00000B,
|
|
IQUIC_VERSION_I012=0xFF00000C,
|
|
IQUIC_VERSION_I013=0xFF00000D,
|
|
IQUIC_VERSION_I014=0xFF00000E,
|
|
IQUIC_VERSION_I015=0xFF00000F,
|
|
IQUIC_VERSION_I016=0xFF000010,
|
|
IQUIC_VERSION_I017=0xFF000011,
|
|
IQUIC_VERSION_I018=0xFF000012,
|
|
IQUIC_VERSION_I019=0xFF000013,
|
|
IQUIC_VERSION_I020=0xFF000014,
|
|
IQUIC_VERSION_I021=0xFF000015,
|
|
IQUIC_VERSION_I022=0xFF000016,
|
|
IQUIC_VERSION_I023=0xFF000017,
|
|
IQUIC_VERSION_I024=0xFF000018,
|
|
IQUIC_VERSION_I025=0xFF000019,
|
|
IQUIC_VERSION_I026=0xFF00001A,
|
|
IQUIC_VERSION_I027=0xFF00001B,
|
|
IQUIC_VERSION_I028=0xFF00001C,
|
|
IQUIC_VERSION_I029=0xFF00001D,
|
|
IQUIC_VERSION_I030=0xFF00001E,
|
|
IQUIC_VERSION_I031=0xFF00001F,
|
|
IQUIC_VERSION_I032=0xFF000020
|
|
};
|
|
|
|
enum _QUIC_VERSION app_identify_get_quic_protocol(int curdir_is_c2s, const unsigned char *payload, const int payload_len);
|
|
int app_identify_guess_openvpn(const unsigned char *payload, int payload_len, int c2s_pkt_cnt, int s2c_pkt_cnt, struct ovpn_ctx *ovpn, int l4_is_tcp, int curdir_is_c2s); |