Xbox and PS4 static port classification.

Signed-off-by: Ravi Kerur <ravi.kerur@viasat.com>

4 files changed, 36 insertions, 7 deletions

diff --git a/example/protos.txt b/example/protos.txt
index b3f24ddb5..a840c8545 100644
--- a/example/protos.txt
+++ b/example/protos.txt
@@ -14,11 +14,15 @@ host:"googlesyndication.com"@Google
 host:"venere.com"@Venere
 host:"kataweb.it",host:"repubblica.it"@Repubblica
 host:"ntop"@ntop
+host:"atv-ext.amazon.com",host:"*.api.amazon.com",host:"*.api.amazonvideo.com"@AmazonVideo
+host:"*.amazonaws.com"@AmazonVideo
+host:"*.netflix.com"@Netflix
+host:"*.lvlt.dash.us.aiv-cdn.net.c.footprint.net"@AmazonVideo
+host:"api-global.netflix.com"@Netflix
 #  IP based Subprotocols
 #  Format:
 #  ip:<value>,ip:<value>,.....@<subproto>
 
 ip:213.75.170.11@CustomProtocol
-
-
-
+ip:8.248.73.247@AmazonPrime
+ip:54.80.47.130@AmazonPrime
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index a2ad5aa8b..484725f99 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -8328,7 +8328,22 @@ ndpi_protocol_match host_match[] = {
   { "itunes-apple.com", NULL, "itunes-apple" TLD,                     "AppleStore",       NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE },
   { "itunes.apple.com", NULL, "itunes\\.apple" TLD,                   "AppleiTunes",      NDPI_PROTOCOL_APPLE_ITUNES, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN },
   { "tlnk.io", NULL, "tlnk" TLD,         	                      "AppleiTunes",      NDPI_PROTOCOL_APPLE_ITUNES, NDPI_PROTOCOL_CATEGORY_STREAMING, NDPI_PROTOCOL_FUN },
-
+  { ".wbagora.com", NULL, "wbagora" TLD,                              "Playstation",      NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_UNRATED },
+  { ".wbplay.com", NULL, "wbplay" TLD,                                "Playstation",      NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_UNRATED },
+  { ".xbox.com", NULL, "xbox" TLD,                                    "Xbox",             NDPI_PROTOCOL_XBOX, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
+  { ".xboxlive.com", NULL, "xboxlive" TLD,                            "Xbox",             NDPI_PROTOCOL_XBOX, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
+  { ".xboxlive.com.akadns.net", NULL, "xboxlive" TLD,                 "Xbox",             NDPI_PROTOCOL_XBOX, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
+  { ".xboxlive.com.c.footprint.net", NULL, "xboxlive" TLD,            "Xbox",             NDPI_PROTOCOL_XBOX, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
+  { ".edgecastcdn.net", NULL, "egdecastcdn" TLD,                      "Unknown",          NDPI_PROTOCOL_GENERIC, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_SAFE },
+  { ".hwcdn.net", NULL, "hwcdn" TLD,                                  "Unknown",          NDPI_PROTOCOL_GENERIC, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_SAFE },
+  { ".llnwd.net", NULL, "llnwd" TLD,                                  "Unknown",          NDPI_PROTOCOL_GENERIC, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_SAFE },
+  { ".llns.net", NULL, "llns" TLD,                                    "Unknown",          NDPI_PROTOCOL_GENERIC, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_SAFE },
+  { ".fastly.net", NULL, "fastly" TLD,                                "Unknown",          NDPI_PROTOCOL_GENERIC, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_SAFE },
+  { ".akamaiedge.net", NULL, "akamaiedge" TLD,                        "Unknown",          NDPI_PROTOCOL_GENERIC, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_SAFE },
+  { "e13555.b.akamaiedge.net", NULL, "e13555\\.b\\.akamaiedge" TLD,   "Playstation",      NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
+  { "e1800.d.akamaiedge.net", NULL, "e1800\\.d\\.akamaiedge" TLD,     "Playstation",      NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
+  { "e1879.e7.akamaiedge.net", NULL, "e1879\\.e7\\.akamaiedge" TLD,   "Playstation",      NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
+  { ".vultr.com", NULL, "vultr" TLD,                                  "Unknown",          NDPI_PROTOCOL_GENERIC, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE },
 
   { ".cnn.c", NULL, "\\.cnn" TLD,           "CNN",              NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
   { ".cnn.net", NULL, NULL,                 "CNN",              NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE },
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index b60367485..02ae4fffc 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1019,8 +1019,13 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
     ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_XBOX,
 			    0 /* can_have_a_subprotocol */, no_master,
 			    no_master, "Xbox", NDPI_PROTOCOL_CATEGORY_GAME,
-			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
-			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+			    ndpi_build_default_ports(ports_a, 3074, 3076, 0, 0, 0)         /* TCP */,
+			    ndpi_build_default_ports(ports_b, 3074, 3076, 500, 3544, 4500) /* UDP */);
+    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_PLAYSTATION,
+                            0 /* can_have_a_subprotocol */, no_master,
+                            no_master, "Playstation", NDPI_PROTOCOL_CATEGORY_GAME,
+                            ndpi_build_default_ports(ports_a, 1935, 3478, 3479, 3480, 0) /* TCP */,
+                            ndpi_build_default_ports(ports_b, 3478, 3479, 0, 0, 0)       /* UDP */);
     ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_QQ,
 			    0 /* can_have_a_subprotocol */, no_master,
 			    no_master, "QQ", NDPI_PROTOCOL_CATEGORY_CHAT,
diff --git a/src/lib/protocols/xbox.c b/src/lib/protocols/xbox.c
index 5d1f64d43..768bb7322 100644
--- a/src/lib/protocols/xbox.c
+++ b/src/lib/protocols/xbox.c
@@ -80,6 +80,11 @@ void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct n
       NDPI_LOG_DBG(ndpi_struct, "maybe xbox\n");
       flow->l4.udp.xbox_stage++;
       return;
+    } else if ((dport == 3075 || dport == 3076 || dport == 3077 || dport == 3078) ||
+          (sport == 3075 || sport == 3076 || sport == 3077 || sport == 3078)) {
+	ndpi_int_xbox_add_connection(ndpi_struct, flow);
+	NDPI_LOG_INFO(ndpi_struct, "found xbox udp port connection detected\n");
+	return;
     }
 
     /* exclude here all non matched udp traffic, exclude here tcp only if http has been excluded, because xbox could use http */
@@ -96,7 +101,7 @@ void init_xbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
   ndpi_set_bitmask_protocol_detection("Xbox", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_XBOX,
 				      ndpi_search_xbox,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
 				      NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);