| | 1 | {{{ |
| | 2 | #!NetPDL |
| | 3 | <protocol name="xmpp" longname="Extensible Messaging and Presence Protocol" showsumtemplate="xmpp"> |
| | 4 | <execute-code> |
| | 5 | <verify> |
| | 6 | <!--<if expr="hasstring($packet[$currentoffset:0],'\x3cstream.*\x3e',0)">--> |
| | 7 | <if expr="hasstring($packet[$currentoffset:0],'\x3cstream:stream[\x09-\x0d ][ -~]*[\x09-\x0d ]xmlns=[\x27\x22]jabber',0)"> |
| | 8 | <if-true> |
| | 9 | <assign-variable name="$protoverify_result" value="%FOUND"/> |
| | 10 | </if-true> |
| | 11 | </if> |
| | 12 | </verify> |
| | 13 | |
| | 14 | <before when="$protoverify_result == %FOUND"> |
| | 15 | <assign-variable name="$session_hit" value="1"/> |
| | 16 | <update-lookuptable name="$tcpsessiontable" action="add" validity="updateonhit" keeptime="300" hittime="300"> |
| | 17 | <lookupkey value="$firstip"/> |
| | 18 | <lookupkey value="$secondip"/> |
| | 19 | <lookupkey value="$firstport"/> |
| | 20 | <lookupkey value="$secondport"/> |
| | 21 | <lookupdata value="#xmpp"/> |
| | 22 | <lookupdata value="0"/> |
| | 23 | </update-lookuptable> |
| | 24 | |
| | 25 | <if expr="$enable_servertable"> |
| | 26 | <if-true> |
| | 27 | <if expr="checklookuptable($CandidateServersTable, $ipsrc, $portsrc)"> |
| | 28 | <if-true> |
| | 29 | <update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300"> |
| | 30 | <lookupkey value="$ipsrc"/> |
| | 31 | <lookupkey value="$portsrc"/> |
| | 32 | <lookupdata value="#xmpp"/> |
| | 33 | </update-lookuptable> |
| | 34 | <!-- delete entry from CandidateServersTable --> |
| | 35 | <update-lookuptable name="$CandidateServersTable" action="purge"> |
| | 36 | <lookupkey value="$ipsrc"/> |
| | 37 | <lookupkey value="$portsrc"/> |
| | 38 | </update-lookuptable> |
| | 39 | </if-true> |
| | 40 | <if-false> |
| | 41 | <if expr="checklookuptable($CandidateServersTable, $ipdst, $portdst)"> |
| | 42 | <if-true> |
| | 43 | <update-lookuptable name="$KnownServerTable" action="add" validity="updateonhit" keeptime="300" hittime="300"> |
| | 44 | <lookupkey value="$ipdst"/> |
| | 45 | <lookupkey value="$portdst"/> |
| | 46 | <lookupdata value="#xmpp"/> |
| | 47 | </update-lookuptable> |
| | 48 | <update-lookuptable name="$CandidateServersTable" action="purge"> |
| | 49 | <lookupkey value="$ipdst"/> |
| | 50 | <lookupkey value="$portdst"/> |
| | 51 | </update-lookuptable> |
| | 52 | </if-true> |
| | 53 | </if> |
| | 54 | </if-false> |
| | 55 | </if> |
| | 56 | </if-true> |
| | 57 | </if> |
| | 58 | </before> |
| | 59 | </execute-code> |
| | 60 | |
| | 61 | <format> |
| | 62 | <fields> |
| | 63 | <field type="variable" name="xmppdata" longname="XMPP Data" expr="$packetlength - $currentoffset" showtemplate="FieldAscii"/> |
| | 64 | </fields> |
| | 65 | </format> |
| | 66 | |
| | 67 | <visualization> |
| | 68 | <showsumtemplate name="xmpp"> |
| | 69 | <section name="next"/> |
| | 70 | <text value="XMPP"/> |
| | 71 | </showsumtemplate> |
| | 72 | </visualization> |
| | 73 | </protocol> |
| | 74 | |
| | 75 | }}} |