Added Toca Boca protocol dissector. (#1517)

Signed-off-by: lns <matzeton@googlemail.com>

6 files changed, 127 insertions, 4 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index f2d164850..918e567c7 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -183,7 +183,7 @@ typedef enum {
   NDPI_PROTOCOL_GTP                   = 152,
   NDPI_PROTOCOL_WSD                   = 153,
   NDPI_PROTOCOL_LLMNR                 = 154,
-  NDPI_PROTOCOL_FREE_155              = 155, /* FREE */
+  NDPI_PROTOCOL_TOCA_BOCA             = 155,
   NDPI_PROTOCOL_SPOTIFY               = 156,
   NDPI_PROTOCOL_MESSENGER             = 157,
   NDPI_PROTOCOL_H323                  = 158,
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 9338d5a71..e225ba04a 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -221,6 +221,7 @@ void init_z3950_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in
 void init_avast_securedns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_cassandra_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_ethernet_ip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_toca_boca_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 
 /* ndpi_main.c */
 extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index b0b98d4a4..2bd3c0a5a 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1563,10 +1563,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			  "LLMNR", NDPI_PROTOCOL_CATEGORY_NETWORK,
 			  ndpi_build_default_ports(ports_a, 5355, 0, 0, 0, 0) /* TCP */,
 			  ndpi_build_default_ports(ports_b, 5355, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */
-  ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FREE_155,
-			  "FREE155", NDPI_PROTOCOL_CATEGORY_NETWORK,
+  ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_TOCA_BOCA,
+			  "TocaBoca", NDPI_PROTOCOL_CATEGORY_GAME,
 			  ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			  ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+			  ndpi_build_default_ports(ports_b, 5055, 0, 0, 0, 0) /* UDP */);
   ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_H323,
 			  "H323", NDPI_PROTOCOL_CATEGORY_VOIP,
 			  ndpi_build_default_ports(ports_a, 1719, 1720, 0, 0, 0) /* TCP */,
@@ -4308,6 +4308,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
   /* WSD */
   init_wsd_dissector(ndpi_str, &a, detection_bitmask);
 
+  /* TocaBoca */
+  init_toca_boca_dissector(ndpi_str, &a, detection_bitmask);
+
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main_init.c"
 #endif
diff --git a/src/lib/protocols/tocaboca.c b/src/lib/protocols/tocaboca.c
new file mode 100644
index 000000000..378f1b753
--- /dev/null
+++ b/src/lib/protocols/tocaboca.c
@@ -0,0 +1,90 @@
+/*
+ * tocaboca.c
+ *
+ * Copyright (C) 2011-22 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_TOCA_BOCA
+
+#include "ndpi_api.h"
+
+static void ndpi_int_toca_boca_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
+                                              struct ndpi_flow_struct * const flow)
+{
+  NDPI_LOG_INFO(ndpi_struct, "found TocaBoca\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow,
+                             NDPI_PROTOCOL_TOCA_BOCA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+}
+
+void ndpi_search_toca_boca(struct ndpi_detection_module_struct *ndpi_struct,
+                           struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &ndpi_struct->packet;
+  u_int32_t payload_len = packet->payload_packet_len;
+
+  NDPI_LOG_DBG(ndpi_struct, "search TocaBoca\n");
+
+  if (packet->udp != NULL)
+  {
+    if (payload_len >= 13
+        && get_u_int32_t(packet->payload, 0) == 0x7d7d7d7d
+        && get_u_int32_t(packet->payload, 4) == 0x7d7d7d7d)
+    {
+      ndpi_int_toca_boca_add_connection(ndpi_struct, flow);
+      return;
+    }
+
+    if (flow->packet_counter == 1
+        && payload_len >= 24
+        && ntohl(get_u_int32_t(packet->payload, 0)) == 0xffff0001
+        && ntohl(get_u_int32_t(packet->payload, 12)) == 0x02ff0104)
+    {
+      ndpi_int_toca_boca_add_connection(ndpi_struct, flow);
+      return;
+    }
+
+    if (payload_len >= 32
+        && (ntohs(get_u_int16_t(packet->payload, 2)) == 0x0001
+            || ntohs(get_u_int16_t(packet->payload, 2)) == 0x0002
+            || ntohs(get_u_int16_t(packet->payload, 2)) == 0x0003)
+        && (ntohl(get_u_int32_t(packet->payload, 12)) == 0x01ff0000
+            || ntohl(get_u_int32_t(packet->payload, 12)) == 0x01000000)
+        && ntohl(get_u_int32_t(packet->payload, 16)) == 0x00000014)
+    {
+      ndpi_int_toca_boca_add_connection(ndpi_struct, flow);
+      return;
+    }
+  }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_toca_boca_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+                              u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("TocaBoca", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_TOCA_BOCA,
+				      ndpi_search_toca_boca,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}
+
diff --git a/tests/pcap/toca-boca.pcap b/tests/pcap/toca-boca.pcap
new file mode 100644
index 000000000..4d0dce619
--- /dev/null
+++ b/tests/pcap/toca-boca.pcap
diff --git a/tests/result/toca-boca.pcap.out b/tests/result/toca-boca.pcap.out
new file mode 100644
index 000000000..ad6e9cc36
--- /dev/null
+++ b/tests/result/toca-boca.pcap.out
@@ -0,0 +1,29 @@
+Guessed flow protos:	4
+
+DPI Packets (UDP):	21	(1.00 pkts/flow)
+Confidence Match by port    : 4 (flows)
+Confidence DPI              : 17 (flows)
+
+TocaBoca	77	15576	21
+
+	1	UDP 192.168.2.100:55544 <-> 92.38.154.49:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][8 pkts/1266 bytes <-> 7 pkts/1556 bytes][Goodput ratio: 73/81][1.22 sec][bytes ratio: -0.103 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 5/11 35/31 48/47 14/15][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 158/222 458/522 120/185][PLAIN TEXT (HlvlwYJ)][Plen Bins: 13,27,27,0,13,0,0,0,0,0,0,0,0,6,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	2	UDP 192.168.2.100:50173 <-> 91.199.81.225:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][7 pkts/1134 bytes <-> 8 pkts/1327 bytes][Goodput ratio: 74/75][2.41 sec][bytes ratio: -0.078 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 46/31 256/383 982/1078 363/465][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 162/166 458/428 127/122][PLAIN TEXT (AstGDGW)][Plen Bins: 13,41,13,0,13,0,0,6,0,0,0,0,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	3	UDP 192.168.2.100:44818 <-> 91.199.81.123:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][8 pkts/1177 bytes <-> 7 pkts/1167 bytes][Goodput ratio: 71/75][2.29 sec][bytes ratio: 0.004 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 51/15 360/435 985/1007 340/380][Pkt Len c2s/s2c min/avg/max/stddev: 74/74 147/167 478/515 129/147][PLAIN TEXT (82620531)][Plen Bins: 0,61,13,0,13,0,0,0,0,0,0,0,0,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	4	UDP 192.168.2.100:35671 <-> 91.199.81.123:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][8 pkts/1172 bytes <-> 7 pkts/1128 bytes][Goodput ratio: 71/74][2.28 sec][bytes ratio: 0.019 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 62/5 369/232 1011/994 346/382][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 146/161 478/515 132/150][PLAIN TEXT (82620531)][Plen Bins: 13,47,13,0,13,0,0,0,0,0,0,0,0,6,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	5	UDP 91.199.81.122:5055 -> 192.168.2.100:56920 [proto: 155/TocaBoca][ClearText][Confidence: Match by port][cat: Game/8][1 pkts/1242 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][PLAIN TEXT (256582283)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0]
+	6	UDP 91.199.81.225:5055 -> 192.168.2.100:43151 [proto: 155/TocaBoca][ClearText][Confidence: Match by port][cat: Game/8][1 pkts/1242 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][PLAIN TEXT (Game8683)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0]
+	7	UDP 91.199.81.225:5055 -> 192.168.2.100:50337 [proto: 155/TocaBoca][ClearText][Confidence: Match by port][cat: Game/8][1 pkts/1242 bytes -> 0 pkts/0 bytes][Goodput ratio: 97/0][< 1 sec][PLAIN TEXT ( busco amigos soy policia franc)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0]
+	8	UDP 91.199.81.123:5055 -> 192.168.2.100:37167 [proto: 155/TocaBoca][ClearText][Confidence: Match by port][cat: Game/8][1 pkts/495 bytes -> 0 pkts/0 bytes][Goodput ratio: 91/0][< 1 sec][PLAIN TEXT (65NC02dcs)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	9	UDP 192.168.2.100:37218 -> 91.199.81.123:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/201 bytes -> 0 pkts/0 bytes][Goodput ratio: 79/0][< 1 sec][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	10	UDP 91.199.81.123:5055 -> 192.168.2.100:33311 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/192 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][< 1 sec][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	11	UDP 91.199.81.123:5055 -> 192.168.2.100:40290 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/192 bytes -> 0 pkts/0 bytes][Goodput ratio: 78/0][< 1 sec][Plen Bins: 0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	12	UDP 192.168.2.100:54983 -> 91.199.81.123:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/127 bytes -> 0 pkts/0 bytes][Goodput ratio: 66/0][< 1 sec][PLAIN TEXT (82620531)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	13	UDP 92.38.154.49:5055 -> 192.168.2.100:32867 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/118 bytes -> 0 pkts/0 bytes][Goodput ratio: 64/0][< 1 sec][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	14	UDP 192.168.2.100:42022 -> 92.38.154.49:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/98 bytes -> 0 pkts/0 bytes][Goodput ratio: 57/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	15	UDP 91.199.81.123:5055 -> 192.168.2.100:60837 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/89 bytes -> 0 pkts/0 bytes][Goodput ratio: 52/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	16	UDP 91.199.81.122:5055 -> 192.168.2.100:34503 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/74 bytes -> 0 pkts/0 bytes][Goodput ratio: 43/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	17	UDP 192.168.2.100:33024 -> 91.199.81.123:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/74 bytes -> 0 pkts/0 bytes][Goodput ratio: 43/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	18	UDP 192.168.2.100:50600 -> 91.199.81.123:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/74 bytes -> 0 pkts/0 bytes][Goodput ratio: 43/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	19	UDP 192.168.2.100:56864 -> 91.199.81.123:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/74 bytes -> 0 pkts/0 bytes][Goodput ratio: 43/0][< 1 sec][Plen Bins: 0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	20	UDP 91.199.81.130:5055 -> 192.168.2.100:43064 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/60 bytes -> 0 pkts/0 bytes][Goodput ratio: 21/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	21	UDP 192.168.2.100:45096 -> 91.199.81.208:5055 [proto: 155/TocaBoca][ClearText][Confidence: DPI][cat: Game/8][1 pkts/55 bytes -> 0 pkts/0 bytes][Goodput ratio: 23/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]