Skip to content

Commit 5b0374c

Browse files
IvanNardiIvanNardi
committed
Add detection of SurfShark VPN
1 parent 85ebda4 commit 5b0374c

12 files changed

+488
-74
lines changed

‎doc/configuration_parameters.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -52,4 +52,4 @@ TODO
5252
| "openvpn" | "subclassification_by_ip" | enable | NULL | NULL | Enable/disable sub-classification of OpenVPN flows using server IP. Useful to detect the specific VPN application/app. At the moment, this knob allows to identify: Mullvad, NordVPN, ProtonVPN. |
5353
| "wireguard" | "subclassification_by_ip" | enable | NULL | NULL | Enable/disable sub-classification of Wireguard flows using server IP. Useful to detect the specific VPN application/app. At the moment, this knob allows to identify: Mullvad, NordVPN, ProtonVPN. |
5454
| $PROTO_NAME | "log" | disable | NULL | NULL | Enable/disable logging/debug for specific protocol. Use "any" as protocol name if you want to easily enable/disable logging/debug for all protocols |
55-
| $PROTO_NAME | "ip_list.load" | 1 | NULL | NULL | Enable/disable loading of internal list of IP addresses (used for (sub)classification) specific to that protocol. Use "any" as protocol name if you want to easily enable/disable all lists. This knob is valid only for the following protocols: Alibaba, Amazon AWS, Apple, Avast, Bloomberg, Cachefly, Cloudflare, Discord, Disney+, Dropbox, Edgecast, EpicGames, Ethereum, Facebook, Github, Google, Google Cloud, GoTo, Hotspot Shield, Hulu, Line, Microsoft 365, Microsoft Azure, Microsoft One Drive, Microsoft Outlook, Mullvad, Netflix, NordVPN, Nvidia, OpenDNS, ProtonVPN, RiotGames, Roblox, Skype/Teams, Starcraft, Steam, Teamviewer, Telegram, Tencent, Threema, TOR, Twitch, Twitter, UbuntuONE, VK, Yandex, Yandex Cloud, Webex, Whatsapp, Zoom |
55+
| $PROTO_NAME | "ip_list.load" | 1 | NULL | NULL | Enable/disable loading of internal list of IP addresses (used for (sub)classification) specific to that protocol. Use "any" as protocol name if you want to easily enable/disable all lists. This knob is valid only for the following protocols: Alibaba, Amazon AWS, Apple, Avast, Bloomberg, Cachefly, Cloudflare, Discord, Disney+, Dropbox, Edgecast, EpicGames, Ethereum, Facebook, Github, Google, Google Cloud, GoTo, Hotspot Shield, Hulu, Line, Microsoft 365, Microsoft Azure, Microsoft One Drive, Microsoft Outlook, Mullvad, Netflix, NordVPN, Nvidia, OpenDNS, ProtonVPN, RiotGames, Roblox, Skype/Teams, Starcraft, Steam, SurfSharkVPN, Teamviewer, Telegram, Tencent, Threema, TOR, Twitch, Twitter, UbuntuONE, VK, Yandex, Yandex Cloud, Webex, Whatsapp, Zoom |

‎doc/protocols.rst

+9
Original file line numberDiff line numberDiff line change
@@ -938,3 +938,12 @@ References: `Main site: <https://www.lustre.org/>`_
938938
NordVPN is a VPN service.
939939

940940
References: `Main site: <https://nordvpn.com>`_
941+
942+
943+
.. _Proto 427:
944+
945+
`NDPI_PROTOCOL_SURFSHARK`
946+
========================
947+
Surfshark is a brand of VPN services offered by the Netherlands-based company Surfshark B.V.
948+
949+
References: `Main site: <https://surfshark.com/>`_

‎src/include/ndpi_protocol_ids.h

+1
Original file line numberDiff line numberDiff line change
@@ -455,6 +455,7 @@ typedef enum {
455455
NDPI_PROTOCOL_TRDP = 424,
456456
NDPI_PROTOCOL_LUSTRE = 425,
457457
NDPI_PROTOCOL_NORDVPN = 426,
458+
NDPI_PROTOCOL_SURFSHARK = 427,
458459

459460
#ifdef CUSTOM_NDPI_PROTOCOLS
460461
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"

‎src/lib/inc_generated/ndpi_surfshark_match.c.inc

+352
Large diffs are not rendered by default.

‎src/lib/ndpi_content_match.c.inc

+2
Original file line numberDiff line numberDiff line change
@@ -1679,6 +1679,8 @@ static ndpi_protocol_match host_match[] =
16791679
{ "napps-1.com", "NordVPN", NDPI_PROTOCOL_NORDVPN, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
16801680
{ "napps-2.com", "NordVPN", NDPI_PROTOCOL_NORDVPN, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
16811681

1682+
{ "surfshark.com", "SurfShark", NDPI_PROTOCOL_SURFSHARK, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
1683+
16821684
#ifdef CUSTOM_NDPI_PROTOCOLS
16831685
#include "../../../nDPI-custom/custom_ndpi_content_match_host_match.c.inc"
16841686
#endif

‎src/lib/ndpi_main.c

+5
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@
8888
#include "inc_generated/ndpi_protonvpn_out_match.c.inc"
8989
#include "inc_generated/ndpi_mullvad_match.c.inc"
9090
#include "inc_generated/ndpi_nordvpn_match.c.inc"
91+
#include "inc_generated/ndpi_surfshark_match.c.inc"
9192
#include "inc_generated/ndpi_asn_telegram.c.inc"
9293
#include "inc_generated/ndpi_asn_apple.c.inc"
9394
#include "inc_generated/ndpi_asn_twitter.c.inc"
@@ -3642,6 +3643,10 @@ int ndpi_finalize_initialization(struct ndpi_detection_module_struct *ndpi_str)
36423643
ndpi_init_ptree_ipv4(ndpi_str->protocols->v4, ndpi_protocol_nordvpn_protocol_list);
36433644
ndpi_init_ptree_ipv6(ndpi_str, ndpi_str->protocols->v6, ndpi_protocol_nordvpn_protocol_list_6);
36443645
}
3646+
if(is_ip_list_enabled(ndpi_str, NDPI_PROTOCOL_SURFSHARK)) {
3647+
ndpi_init_ptree_ipv4(ndpi_str->protocols->v4, ndpi_protocol_surfshark_protocol_list);
3648+
ndpi_init_ptree_ipv6(ndpi_str, ndpi_str->protocols->v6, ndpi_protocol_surfshark_protocol_list_6);
3649+
}
36453650
if(is_ip_list_enabled(ndpi_str, NDPI_PROTOCOL_TELEGRAM)) {
36463651
ndpi_init_ptree_ipv4(ndpi_str->protocols->v4, ndpi_protocol_telegram_protocol_list);
36473652
ndpi_init_ptree_ipv6(ndpi_str, ndpi_str->protocols->v6, ndpi_protocol_telegram_protocol_list_6);

‎tests/cfgs/default/pcap/sites.pcapng

13.3 KB
Binary file not shown.

‎tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out

+2-2
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,6 @@ CustomProtocolC 3 222 1
2626

2727
Acceptable 8 592 3
2828

29-
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.433/TLS.CustomProtocolA][IP: 433/CustomProtocolA][Encrypted][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
29+
1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.434/TLS.CustomProtocolA][IP: 434/CustomProtocolA][Encrypted][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
3030
2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 800/CustomProtocolC][IP: 800/CustomProtocolC][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
31-
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 434/CustomProtocolB][IP: 434/CustomProtocolB][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
31+
3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 435/CustomProtocolB][IP: 435/CustomProtocolB][ClearText][Confidence: Match by custom rule][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

0 commit comments

Comments
 (0)