XBox, Diameter: fix dissectors initialization (#1405)

These dissectors have *never* been triggered because their registration
functions use the wrong parameter/bitmask.
Diameter code is buggy since the origianl commit (1d108234), while
XBox code since 5266c726.

Fix some false positives in Xbox code.

2 files changed, 20 insertions, 27 deletions

diff --git a/src/lib/protocols/diameter.c b/src/lib/protocols/diameter.c
index 7d63653ee..ee6c7ec6a 100644
--- a/src/lib/protocols/diameter.c
+++ b/src/lib/protocols/diameter.c
@@ -62,16 +62,12 @@ struct diameter_header_t
 
 
 // Check packet
-int is_diameter(struct ndpi_packet_struct *packet, int size_payload)
+int is_diameter(struct ndpi_packet_struct *packet)
 {
-  // check param
-  if(!packet || size_payload == 0) return -1;
+  struct diameter_header_t *diameter = (struct diameter_header_t *)packet->payload;
 
-  // cast to diameter header
-  struct diameter_header_t *diameter = (struct diameter_header_t *) packet;
-
-  // check if the packet is diameter
-  if(diameter->version == 0x01 &&
+  if(packet->payload_packet_len >= sizeof(struct diameter_header_t) &&
+     diameter->version == 0x01 &&
      (diameter->flags == DIAMETER_REQUEST ||
       diameter->flags == DIAMETER_PROXYABLE ||
       diameter->flags == DIAMETER_ERROR ||
@@ -83,10 +79,10 @@ int is_diameter(struct ndpi_packet_struct *packet, int size_payload)
 	com_code == CC || com_code == CE ||
 	com_code == DW || com_code == DP ||
 	com_code == RA || com_code == ST)
-       return 0; // OK
+       return 0;
   }
-  // wrong packet
-  return -2;
+
+  return -1;
 }
 
 
@@ -95,24 +91,16 @@ void ndpi_search_diameter(struct ndpi_detection_module_struct *ndpi_struct,
 {
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
 
-  // Diameter is on TCP
   if(packet->tcp) {
-
-    /* Check if it's diameter */
-    int ret = is_diameter(packet, packet->payload_packet_len);
-    if(ret != 0) {
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-      return;
-    }
-    else {
+    int ret = is_diameter(packet);
+    if(ret == 0) {
       NDPI_LOG_INFO(ndpi_struct, "found Diameter\n");
       ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIAMETER, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+      return;
     }
   }
-  else { // UDP
-    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    return;
-  }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 }
 
 
@@ -121,7 +109,7 @@ void init_diameter_dissector(struct ndpi_detection_module_struct *ndpi_struct, u
 {
   ndpi_set_bitmask_protocol_detection("Diameter", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_DIAMETER, ndpi_search_diameter,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
 
   *id += 1;
diff --git a/src/lib/protocols/xbox.c b/src/lib/protocols/xbox.c
index 0878f933c..8b2ed2b84 100644
--- a/src/lib/protocols/xbox.c
+++ b/src/lib/protocols/xbox.c
@@ -80,12 +80,17 @@ void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct n
       NDPI_LOG_DBG(ndpi_struct, "maybe xbox\n");
       flow->l4.udp.xbox_stage++;
       return;
-    } else if ((dport == 3075 || dport == 3076 || dport == 3077 || dport == 3078) ||
+    }
+/* Disable this code. These checks are quite weak and these ports are not mentioned at
+   https://support.xbox.com/en-US/help/hardware-network/connect-network/network-ports-used-xbox-live */
+#if 0
+    else if ((dport == 3075 || dport == 3076 || dport == 3077 || dport == 3078) ||
           (sport == 3075 || sport == 3076 || sport == 3077 || sport == 3078)) {
 	ndpi_int_xbox_add_connection(ndpi_struct, flow);
 	NDPI_LOG_INFO(ndpi_struct, "found xbox udp port connection detected\n");
 	return;
     }
+#endif
 
     /* exclude here all non matched udp traffic, exclude here tcp only if http has been excluded, because xbox could use http */
     if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) {
@@ -102,7 +107,7 @@ void init_xbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int
 				      NDPI_PROTOCOL_XBOX,
 				      ndpi_search_xbox,
 				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
-				      NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);
 
   *id += 1;