Skip to content

Commit cc11ec5

Browse files
committed
Add (generic) JSON protocol dissector.
Signed-off-by: Toni Uhlig <[email protected]>
1 parent 11cc612 commit cc11ec5

File tree

214 files changed

+750
-555
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

214 files changed

+750
-555
lines changed

src/include/ndpi_private.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1086,6 +1086,7 @@ void init_mudfish_dissector(struct ndpi_detection_module_struct *ndpi_struct);
10861086
void init_tristation_dissector(struct ndpi_detection_module_struct *ndpi_struct);
10871087
void init_samsung_sdp_dissector(struct ndpi_detection_module_struct *ndpi_struct);
10881088
void init_matter_dissector(struct ndpi_detection_module_struct *ndpi_struct);
1089+
void init_json_dissector(struct ndpi_detection_module_struct *ndpi_struct);
10891090

10901091
#ifdef CUSTOM_NDPI_PROTOCOLS
10911092
#include "../../../nDPI-custom/custom_ndpi_private.h"

src/include/ndpi_protocol_ids.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -497,6 +497,7 @@ typedef enum {
497497
NDPI_PROTOCOL_AWS_DYNAMODB = 465,
498498
NDPI_PROTOCOL_ESPN = 466,
499499
NDPI_PROTOCOL_AKAMAI = 467,
500+
NDPI_PROTOCOL_JSON = 468,
500501

501502
/* If you add a new protocol, please update the documentation at doc/protocols.rst, too! */
502503

src/lib/ndpi_main.c

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2962,12 +2962,16 @@ static void init_protocol_defaults(struct ndpi_detection_module_struct *ndpi_str
29622962
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */ ,
29632963
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */,
29642964
0);
2965-
29662965
ndpi_set_proto_defaults(ndpi_str, 1 , 1 , NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AKAMAI,
29672966
"Akamai", NDPI_PROTOCOL_CATEGORY_DATABASE, NDPI_PROTOCOL_QOE_CATEGORY_UNSPECIFIED,
29682967
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */ ,
29692968
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */,
29702969
0);
2970+
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_JSON,
2971+
"JSON", NDPI_PROTOCOL_CATEGORY_NETWORK, NDPI_PROTOCOL_QOE_CATEGORY_UNSPECIFIED,
2972+
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
2973+
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */,
2974+
0);
29712975

29722976
#ifdef CUSTOM_NDPI_PROTOCOLS
29732977
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -7453,6 +7457,9 @@ static int dissectors_init(struct ndpi_detection_module_struct *ndpi_str) {
74537457
/* MATTER */
74547458
init_matter_dissector(ndpi_str);
74557459

7460+
/* JSON */
7461+
init_json_dissector(ndpi_str);
7462+
74567463
#ifdef CUSTOM_NDPI_PROTOCOLS
74577464
#include "../../../nDPI-custom/custom_ndpi_main_init.c"
74587465
#endif

src/lib/protocols/json.c

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
/*
2+
* json.c
3+
*
4+
* Copyright (C) 2025 - Toni Uhlig <[email protected]>
5+
*
6+
* This file is part of nDPI, an open source deep packet inspection
7+
* library based on the OpenDPI and PACE technology by ipoque GmbH
8+
*
9+
* nDPI is free software: you can redistribute it and/or modify
10+
* it under the terms of the GNU Lesser General Public License as published by
11+
* the Free Software Foundation, either version 3 of the License, or
12+
* (at your option) any later version.
13+
*
14+
* nDPI is distributed in the hope that it will be useful,
15+
* but WITHOUT ANY WARRANTY; without even the implied warranty of
16+
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17+
* GNU Lesser General Public License for more details.
18+
*
19+
* You should have received a copy of the GNU Lesser General Public License
20+
* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
21+
*
22+
*/
23+
24+
#include "ndpi_protocol_ids.h"
25+
26+
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_JSON
27+
28+
#include "ndpi_api.h"
29+
#include "ndpi_private.h"
30+
31+
static void ndpi_int_json_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
32+
struct ndpi_flow_struct * const flow)
33+
{
34+
NDPI_LOG_INFO(ndpi_struct, "found JSON\n");
35+
ndpi_set_detected_protocol(ndpi_struct, flow,
36+
NDPI_PROTOCOL_JSON,
37+
NDPI_PROTOCOL_UNKNOWN,
38+
NDPI_CONFIDENCE_DPI);
39+
}
40+
41+
static void ndpi_search_json(struct ndpi_detection_module_struct *ndpi_struct,
42+
struct ndpi_flow_struct *flow)
43+
{
44+
struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
45+
size_t offset = 0;
46+
size_t bytes_checked = 0;
47+
const size_t max_bytes_to_check = 16;
48+
49+
NDPI_LOG_DBG(ndpi_struct, "search JSON\n");
50+
51+
if (packet->payload_packet_len < 2) {
52+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
53+
return;
54+
}
55+
56+
do {
57+
if (offset >= packet->payload_packet_len) {
58+
break;
59+
}
60+
if (packet->payload[offset] == '{') {
61+
break;
62+
}
63+
if (packet->payload[offset] != ' ' &&
64+
packet->payload[offset] != '\t' &&
65+
packet->payload[offset] != '\r' &&
66+
packet->payload[offset] != '\n' &&
67+
isalnum(packet->payload[offset]) == 0 &&
68+
offset >= 8)
69+
{
70+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
71+
return;
72+
}
73+
} while (++offset < max_bytes_to_check);
74+
75+
if (offset == max_bytes_to_check || offset >= packet->payload_packet_len) {
76+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
77+
return;
78+
}
79+
80+
offset = packet->payload_packet_len;
81+
82+
do {
83+
if (packet->payload[offset - 1] == '}') {
84+
break;
85+
}
86+
if (packet->payload[offset - 1] != ' ' &&
87+
packet->payload[offset - 1] != '\t' &&
88+
packet->payload[offset - 1] != '\r' &&
89+
packet->payload[offset - 1] != '\n' &&
90+
isalnum(packet->payload[offset - 1]) == 0)
91+
{
92+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
93+
return;
94+
}
95+
} while (--offset > 0 && ++bytes_checked < max_bytes_to_check);
96+
97+
if (bytes_checked == max_bytes_to_check) {
98+
NDPI_EXCLUDE_DISSECTOR(ndpi_struct, flow);
99+
return;
100+
}
101+
102+
ndpi_int_json_add_connection(ndpi_struct, flow);
103+
}
104+
105+
void init_json_dissector(struct ndpi_detection_module_struct *ndpi_struct)
106+
{
107+
register_dissector("JSON", ndpi_struct,
108+
ndpi_search_json,
109+
NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
110+
1, NDPI_PROTOCOL_JSON);
111+
}

tests/cfgs/caches_cfg/result/ookla.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 572 (95.33 diss/flow)
6+
Num dissector calls: 575 (95.83 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache stun: 0/0/0 (insert/search/found)

tests/cfgs/caches_cfg/result/teams.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ DPI Packets (other): 1 (1.00 pkts/flow)
66
Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI : 80 (flows)
9-
Num dissector calls: 521 (6.28 diss/flow)
9+
Num dissector calls: 523 (6.30 diss/flow)
1010
LRU cache ookla: 0/0/0 (insert/search/found)
1111
LRU cache bittorrent: 0/9/0 (insert/search/found)
1212
LRU cache stun: 30/0/0 (insert/search/found)

tests/cfgs/caches_global/result/lru_ipv6_caches.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ DPI Packets (TCP): 9 (3.00 pkts/flow)
22
DPI Packets (UDP): 35 (3.89 pkts/flow)
33
Confidence DPI (cache) : 4 (flows)
44
Confidence DPI : 8 (flows)
5-
Num dissector calls: 337 (28.08 diss/flow)
5+
Num dissector calls: 339 (28.25 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 25/4/2 (insert/search/found)
88
LRU cache stun: 6/0/0 (insert/search/found)

tests/cfgs/caches_global/result/ookla.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 572 (95.33 diss/flow)
7+
Num dissector calls: 575 (95.83 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

tests/cfgs/caches_global/result/teams.pcap.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ Confidence Unknown : 1 (flows)
77
Confidence Match by port : 2 (flows)
88
Confidence DPI (partial) : 4 (flows)
99
Confidence DPI : 76 (flows)
10-
Num dissector calls: 521 (6.28 diss/flow)
10+
Num dissector calls: 523 (6.30 diss/flow)
1111
LRU cache ookla: 0/0/0 (insert/search/found)
1212
LRU cache bittorrent: 0/9/0 (insert/search/found)
1313
LRU cache stun: 30/0/0 (insert/search/found)

tests/cfgs/classification_only/result/bittorrent_tcp_miss.pcapng.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 10 (10.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 227 (227.00 diss/flow)
3+
Num dissector calls: 228 (228.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 5/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

0 commit comments

Comments
 (0)