Add Discord dissector. (#1694)

* fixed RiotGames false positive

Signed-off-by: lns <matzeton@googlemail.com>

7 files changed, 203 insertions, 7 deletions

diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 1402e4022..7087b0231 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -236,6 +236,7 @@ void init_alicloud_dissector(struct ndpi_detection_module_struct *ndpi_struct, u
 void init_avast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_softether_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_activision_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_discord_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 
 /* ndpi_main.c */
 extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 5583590b7..efea443d6 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -1422,6 +1422,10 @@ struct ndpi_flow_struct {
     } collectd;
 
     struct {
+      char client_ip[16];
+    } discord;
+
+    struct {
       char version[32];
     } ubntac2;
 
diff --git a/src/lib/inc_generated/ndpi_asn_discord.c.inc b/src/lib/inc_generated/ndpi_asn_discord.c.inc
new file mode 100644
index 000000000..bd7f6df32
--- /dev/null
+++ b/src/lib/inc_generated/ndpi_asn_discord.c.inc
@@ -0,0 +1,96 @@
+/*
+ *
+ * This file is generated automatically and part of nDPI
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* ****************************************************** */
+
+
+static ndpi_network ndpi_protocol_discord_protocol_list[] = {
+ { 0x05C80000 /* 5.200.0.0/19 */, 19, NDPI_PROTOCOL_DISCORD },
+ { 0x1FCC8000 /* 31.204.128.0/19 */, 19, NDPI_PROTOCOL_DISCORD },
+ { 0x2BEF8800 /* 43.239.136.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x2D53C800 /* 45.83.200.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x2D7C8400 /* 45.124.132.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x4216C400 /* 66.22.196.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x4216C800 /* 66.22.200.0/21 */, 21, NDPI_PROTOCOL_DISCORD },
+ { 0x4216D000 /* 66.22.208.0/20 */, 20, NDPI_PROTOCOL_DISCORD },
+ { 0x4216E000 /* 66.22.224.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x4216E600 /* 66.22.230.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0x4216E800 /* 66.22.232.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x4216EC00 /* 66.22.236.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0x4216EE00 /* 66.22.238.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x4216F000 /* 66.22.240.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0x4216F200 /* 66.22.242.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x4216F400 /* 66.22.244.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x4216F800 /* 66.22.248.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x45A8EA00 /* 69.168.234.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x559F7200 /* 85.159.114.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x5968A000 /* 89.104.160.0/21 */, 21, NDPI_PROTOCOL_DISCORD },
+ { 0x5BC3EA00 /* 91.195.234.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0x5BC69800 /* 91.198.152.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x5BD8CF00 /* 91.216.207.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x677DD800 /* 103.125.216.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x677DDB00 /* 103.125.219.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0x679F7A00 /* 103.159.122.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0x67C2A400 /* 103.194.164.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x68995400 /* 104.153.84.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0x6DC8C000 /* 109.200.192.0/19 */, 19, NDPI_PROTOCOL_DISCORD },
+ { 0x8A808800 /* 138.128.136.0/21 */, 21, NDPI_PROTOCOL_DISCORD },
+ { 0x92F74C00 /* 146.247.76.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xA2F43400 /* 162.244.52.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xA2F5CC00 /* 162.245.204.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB2F89B00 /* 178.248.155.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xB9298C00 /* 185.41.140.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9326800 /* 185.50.104.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9340C00 /* 185.52.12.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9462F00 /* 185.70.47.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xB94DD000 /* 185.77.208.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9729C00 /* 185.114.156.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9782300 /* 185.120.35.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xB9A23800 /* 185.162.56.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9A53000 /* 185.165.48.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xB9ABF000 /* 185.171.240.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9AC8400 /* 185.172.132.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9B3C800 /* 185.179.200.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9B9D400 /* 185.185.212.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9BDB400 /* 185.189.180.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9BFF000 /* 185.191.240.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9C51800 /* 185.197.24.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9C91100 /* 185.201.17.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xB9DAA400 /* 185.218.164.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0xB9DAA600 /* 185.218.166.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xB9E28A00 /* 185.226.138.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xB9E52000 /* 185.229.32.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xB9F1D100 /* 185.241.209.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xBC7A4000 /* 188.122.64.0/19 */, 19, NDPI_PROTOCOL_DISCORD },
+ { 0xC12BDA00 /* 193.43.218.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0xC12E5000 /* 193.46.80.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xC23D3B00 /* 194.61.59.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xC71BD400 /* 199.27.212.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ { 0xCB841800 /* 203.132.24.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xD412E600 /* 212.18.230.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xD468C800 /* 212.104.200.0/23 */, 23, NDPI_PROTOCOL_DISCORD },
+ { 0xD468CA00 /* 212.104.202.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xD468CD00 /* 212.104.205.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xD5A34000 /* 213.163.64.0/19 */, 19, NDPI_PROTOCOL_DISCORD },
+ { 0xD5B3C000 /* 213.179.192.0/19 */, 19, NDPI_PROTOCOL_DISCORD },
+ { 0xD5BE1600 /* 213.190.22.0/24 */, 24, NDPI_PROTOCOL_DISCORD },
+ { 0xDC9ED800 /* 220.158.216.0/22 */, 22, NDPI_PROTOCOL_DISCORD },
+ /* End */
+ { 0x0, 0, 0 }
+};
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 2911ad752..7929b3b88 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -88,6 +88,7 @@
 #include "inc_generated/ndpi_asn_threema.c.inc"
 #include "inc_generated/ndpi_asn_alibaba.c.inc"
 #include "inc_generated/ndpi_asn_avast.c.inc"
+#include "inc_generated/ndpi_asn_discord.c.inc"
 
 /* Third party libraries */
 #include "third_party/include/ndpi_patricia.h"
@@ -2652,6 +2653,7 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs
       ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_threema_protocol_list);
       ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_alibaba_protocol_list);
       ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_avast_protocol_list);
+      ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_discord_protocol_list);
     }
   }
 
@@ -4542,6 +4544,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
   /* Activision */
   init_activision_dissector(ndpi_str, &a, detection_bitmask);
 
+  /* Discord */
+  init_discord_dissector(ndpi_str, &a, detection_bitmask);
+
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main_init.c"
 #endif
diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
index d33d6477e..2653a8f83 100644
--- a/src/lib/ndpi_utils.c
+++ b/src/lib/ndpi_utils.c
@@ -1499,6 +1499,14 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
     ndpi_serialize_end_of_block(serializer);
     break;
 
+  case NDPI_PROTOCOL_DISCORD:
+    if (l7_protocol.master_protocol != NDPI_PROTOCOL_TLS) {
+      ndpi_serialize_start_of_block(serializer, "discord");
+      ndpi_serialize_string_string(serializer, "client_ip", flow->protos.discord.client_ip);
+      ndpi_serialize_end_of_block(serializer);
+    }
+    break;
+
   case NDPI_PROTOCOL_SSH:
     ndpi_serialize_start_of_block(serializer, "ssh");
     ndpi_serialize_string_string(serializer,  "client_signature", flow->protos.ssh.client_signature);
diff --git a/src/lib/protocols/discord.c b/src/lib/protocols/discord.c
new file mode 100644
index 000000000..59355b00a
--- /dev/null
+++ b/src/lib/protocols/discord.c
@@ -0,0 +1,89 @@
+/*
+ * discord.c
+ *
+ * Copyright (C) 2022 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DISCORD
+
+#include "ndpi_api.h"
+
+static void ndpi_int_discord_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
+                                             struct ndpi_flow_struct * const flow)
+{
+  NDPI_LOG_INFO(ndpi_struct, "found discord\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow,
+                             NDPI_PROTOCOL_DISCORD,
+                             NDPI_PROTOCOL_UNKNOWN,
+                             NDPI_CONFIDENCE_DPI);
+}
+
+void ndpi_search_discord(struct ndpi_detection_module_struct *ndpi_struct,
+                         struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct const * const packet = &ndpi_struct->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "search discord\n");
+
+  if (packet->payload_packet_len == 8 &&
+      ntohl(get_u_int32_t(packet->payload, 0)) == 0x1337cafe)
+  {
+    ndpi_int_discord_add_connection(ndpi_struct, flow);
+    return;
+  }
+
+  if (packet->payload_packet_len == 74 &&
+      ntohs(get_u_int16_t(packet->payload, 6)) == 0xace3)
+  {
+    if (flow->packet_counter == 1 &&
+        ntohl(get_u_int32_t(packet->payload, 0)) == 0x00010046)
+    {
+      /* Wait for the next packet, hopefully beeing able to dissect the client IP. */
+      return;
+    }
+
+    if (flow->packet_counter == 2 &&
+        ntohl(get_u_int32_t(packet->payload, 0)) == 0x00020046)
+    {
+      /* Dissect client IP. */
+      size_t len = sizeof(flow->protos.discord.client_ip) - 1;
+      strncpy(flow->protos.discord.client_ip, (char const *)&packet->payload[8], len);
+      flow->protos.discord.client_ip[len] = '\0';
+      ndpi_int_discord_add_connection(ndpi_struct, flow);
+      return;
+    }
+  }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+void init_discord_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+                            u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+  ndpi_set_bitmask_protocol_detection("Discord", ndpi_struct, detection_bitmask, *id,
+    NDPI_PROTOCOL_DISCORD,
+    ndpi_search_discord,
+    NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+    SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+    ADD_TO_DETECTION_BITMASK
+  );
+
+  *id += 1;
+}
diff --git a/src/lib/protocols/riotgames.c b/src/lib/protocols/riotgames.c
index 40dddd7b6..d73af8276 100644
--- a/src/lib/protocols/riotgames.c
+++ b/src/lib/protocols/riotgames.c
@@ -42,13 +42,6 @@ void ndpi_search_riotgames(struct ndpi_detection_module_struct *ndpi_struct,
 
   NDPI_LOG_DBG(ndpi_struct, "searching RiotGames\n");
 
-  if (packet->payload_packet_len == 8 &&
-      ntohl(get_u_int32_t(packet->payload, 0)) == 0x1337cafe)
-  {
-    ndpi_int_riotgames_add_connection(ndpi_struct, flow);
-    return;
-  }
-
   if (packet->payload_packet_len > 8 &&
       ntohl(get_u_int32_t(packet->payload, packet->payload_packet_len - 8)) == 0xaaaaaaaa &&
       ntohl(get_u_int32_t(packet->payload, packet->payload_packet_len - 4)) == 0xbbbbbbbb)