aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorLuca Deri <deri@ntop.org>2020-06-06 09:38:19 +0200
committerLuca Deri <deri@ntop.org>2020-06-06 09:38:19 +0200
commit605d548d4a5f2c298a6f98e5135d4ac63886d89a (patch)
tree31295abcfebed6ddf75c8cdbbb087226690c0de0 /src
parent0da76fdac6b8c0d90614a6db46a613a3f9f10dfc (diff)
removed obsolete yahoo plugin
Diffstat (limited to 'src')
-rw-r--r--src/lib/ndpi_main.c6
-rw-r--r--src/lib/protocols/yahoo.c412
2 files changed, 0 insertions, 418 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index fed3c9831..a116765bc 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1978,9 +1978,6 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs
ndpi_str->battlefield_timeout = NDPI_BATTLEFIELD_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second;
ndpi_str->thunder_timeout = NDPI_THUNDER_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second;
- ndpi_str->yahoo_detect_http_connections = NDPI_YAHOO_DETECT_HTTP_CONNECTIONS;
-
- ndpi_str->yahoo_lan_video_timeout = NDPI_YAHOO_LAN_VIDEO_TIMEOUT * ndpi_str->ticks_per_second;
ndpi_str->zattoo_connection_timeout = NDPI_ZATTOO_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second;
ndpi_str->jabber_stun_timeout = NDPI_JABBER_STUN_TIMEOUT * ndpi_str->ticks_per_second;
ndpi_str->jabber_file_transfer_timeout = NDPI_JABBER_FT_TIMEOUT * ndpi_str->ticks_per_second;
@@ -2834,9 +2831,6 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* NATS */
init_nats_dissector(ndpi_str, &a, detection_bitmask);
- /* YAHOO */
- init_yahoo_dissector(ndpi_str, &a, detection_bitmask);
-
/* OSCAR */
init_oscar_dissector(ndpi_str, &a, detection_bitmask);
diff --git a/src/lib/protocols/yahoo.c b/src/lib/protocols/yahoo.c
deleted file mode 100644
index d80e9caee..000000000
--- a/src/lib/protocols/yahoo.c
+++ /dev/null
@@ -1,412 +0,0 @@
-/*
- * yahoo.c
- *
- * Copyright (C) 2016-20 - ntop.org
- *
- * This file is part of nDPI, an open source deep packet inspection
- * library based on the OpenDPI and PACE technology by ipoque GmbH
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
- *
- */
-#include "ndpi_protocol_ids.h"
-
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_YAHOO
-
-#include "ndpi_api.h"
-
-struct ndpi_yahoo_header {
- u_int8_t YMSG_str[4];
- u_int16_t version;
- u_int16_t nothing0;
- u_int16_t len;
- u_int16_t service;
- u_int32_t status;
- u_int32_t session_id;
-};
-
-/* This function checks the pattern '<Ymsg Command=' in line 8 of parsed lines or
- * in the payload*/
-static u_int8_t ndpi_check_for_YmsgCommand(u_int16_t len, const u_int8_t * ptr)
-{
- u_int16_t i;
-
- for (i = 0; i < len - 12; i++) {
- if (ptr[i] == 'Y') {
- if (memcmp(&ptr[i + 1], "msg Command=", 12) == 0) {
- return 1;
- }
- }
- }
- return 0;
-}
-
-
-#if !defined(WIN32)
-static inline
-#elif defined(MINGW_GCC)
-__mingw_forceinline static
-#else
-__forceinline static
-#endif
-u_int8_t check_ymsg(const u_int8_t * payload, u_int16_t payload_packet_len)
-{
- if (payload_packet_len < sizeof(struct ndpi_yahoo_header)) {
- return 0;
- }
- const struct ndpi_yahoo_header *yahoo = (struct ndpi_yahoo_header *) payload;
-
- u_int16_t yahoo_len_parsed = 0;
- do {
- u_int16_t ylen = ntohs(yahoo->len);
-
- yahoo_len_parsed += 20 + ylen; /* possible overflow here: 20 + ylen = 0x10000 --> 0 --> infinite loop */
-
- if(ylen >= payload_packet_len || yahoo_len_parsed >= payload_packet_len)
- break;
-
- if (payload_packet_len < yahoo_len_parsed + sizeof(struct ndpi_yahoo_header)) {
- return 0;
- }
- yahoo = (struct ndpi_yahoo_header *) (payload + yahoo_len_parsed);
- }
- while(memcmp(yahoo->YMSG_str, "YMSG", 4) == 0);
-
- if(yahoo_len_parsed == payload_packet_len)
- return 1;
-
- return 0;
-}
-
-static void ndpi_search_yahoo_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- struct ndpi_packet_struct *packet = &flow->packet;
- struct ndpi_id_struct *src = flow->src;
- struct ndpi_id_struct *dst = flow->dst;
-
- const struct ndpi_yahoo_header *yahoo = (struct ndpi_yahoo_header *) packet->payload;
-
- if(packet->payload_packet_len > 0) {
- /* packet must be at least 20 bytes long */
- if(packet->payload_packet_len >= 20
- && memcmp(yahoo->YMSG_str, "YMSG", 4) == 0 && ((packet->payload_packet_len - 20) == ntohs(yahoo->len)
- || check_ymsg(packet->payload, packet->payload_packet_len))) {
-
- NDPI_LOG_DBG(ndpi_struct, "YAHOO FOUND\n");
- flow->yahoo_detection_finished = 2;
-
- if(ntohs(yahoo->service) == 24 || ntohs(yahoo->service) == 152 || ntohs(yahoo->service) == 74) {
- NDPI_LOG_DBG(ndpi_struct, "YAHOO conference or chat invite found");
-
- if(src != NULL)
- src->yahoo_conf_logged_in = 1;
- if(dst != NULL)
- dst->yahoo_conf_logged_in = 1;
- }
- if(ntohs(yahoo->service) == 27 || ntohs(yahoo->service) == 155 || ntohs(yahoo->service) == 160) {
- NDPI_LOG_DBG(ndpi_struct, "YAHOO conference or chat logoff found");
- if(src != NULL) {
- src->yahoo_conf_logged_in = 0;
- src->yahoo_voice_conf_logged_in = 0;
- }
- }
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
-
- } else if(flow->yahoo_detection_finished == 2 && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_YAHOO) {
- return;
- } else if(packet->payload_packet_len == 4 && memcmp(yahoo->YMSG_str, "YMSG", 4) == 0) {
- flow->l4.tcp.yahoo_sip_comm = 1;
- return;
- } else if(flow->l4.tcp.yahoo_sip_comm && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN
- && flow->packet_counter < 3) {
- return;
- }
-
- /* now test for http login, at least 100 a bytes packet */
- if(ndpi_struct->yahoo_detect_http_connections != 0 && packet->payload_packet_len > 100) {
- if(memcmp(packet->payload, "POST /relay?token=", 18) == 0
- || memcmp(packet->payload, "GET /relay?token=", 17) == 0
- || memcmp(packet->payload, "GET /?token=", 12) == 0
- || memcmp(packet->payload, "HEAD /relay?token=", 18) == 0) {
- if((src != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO)
- != 0) || (dst != NULL
- && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO)
- != 0)) {
- /* this is mostly a file transfer */
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- if(memcmp(packet->payload, "POST ", 5) == 0) {
- u_int16_t a;
- ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- if ((packet->user_agent_line.len >= 21)
- && (memcmp(packet->user_agent_line.ptr, "YahooMobileMessenger/", 21) == 0)) {
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO(Mobile)");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
-
- if (NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_YAHOO)
- && packet->parsed_lines > 5
- && memcmp(&packet->payload[5], "/Messenger.", 11) == 0
- && packet->line[1].len >= 17
- && memcmp(packet->line[1].ptr, "Connection: Close",
- 17) == 0 && packet->line[2].len >= 6
- && memcmp(packet->line[2].ptr, "Host: ", 6) == 0
- && packet->line[3].len >= 16
- && memcmp(packet->line[3].ptr, "Content-Length: ",
- 16) == 0 && packet->line[4].len >= 23
- && memcmp(packet->line[4].ptr, "User-Agent: Mozilla/5.0",
- 23) == 0 && packet->line[5].len >= 23
- && memcmp(packet->line[5].ptr, "Cache-Control: no-cache", 23) == 0) {
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO HTTP POST P2P FILETRANSFER\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
-
- if (packet->host_line.ptr != NULL && packet->host_line.len >= 26 &&
- memcmp(packet->host_line.ptr, "filetransfer.msg.yahoo.com", 26) == 0) {
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO HTTP POST FILETRANSFER\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- /* now check every line */
- for (a = 0; a < packet->parsed_lines; a++) {
- if (packet->line[a].len >= 4 && memcmp(packet->line[a].ptr, "YMSG", 4) == 0) {
- NDPI_LOG_DBG(ndpi_struct,
- "YAHOO HTTP POST FOUND, line is: %.*s\n", packet->line[a].len, packet->line[a].ptr);
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- if (packet->parsed_lines > 8 && packet->line[8].len > 250 && packet->line[8].ptr != NULL) {
- if (memcmp(packet->line[8].ptr, "<Session ", 9) == 0) {
- if (ndpi_check_for_YmsgCommand(packet->line[8].len, packet->line[8].ptr)) {
- NDPI_LOG_INFO(ndpi_struct,
- "found YAHOO HTTP Proxy Yahoo Chat <Ymsg Command= pattern \n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- }
- }
- if(memcmp(packet->payload, "GET /Messenger.", 15) == 0) {
- if((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0)
- || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0)) {
-
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO HTTP GET /Messenger. match\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
-
- if((memcmp(packet->payload, "GET /", 5) == 0)) {
- ndpi_parse_packet_line_info(ndpi_struct, flow);
- if((packet->user_agent_line.ptr != NULL && packet->user_agent_line.len >= NDPI_STATICSTRING_LEN("YahooMobileMessenger/")
- && memcmp(packet->user_agent_line.ptr, "YahooMobileMessenger/", NDPI_STATICSTRING_LEN("YahooMobileMessenger/")) == 0)
- || (packet->user_agent_line.len >= 15 && (memcmp(packet->user_agent_line.ptr, "Y!%20Messenger/", 15) == 0))) {
-
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO(Mobile)");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- if(packet->host_line.ptr != NULL && packet->host_line.len >= NDPI_STATICSTRING_LEN("msg.yahoo.com") &&
- memcmp(&packet->host_line.ptr[packet->host_line.len - NDPI_STATICSTRING_LEN("msg.yahoo.com")], "msg.yahoo.com", NDPI_STATICSTRING_LEN("msg.yahoo.com")) == 0) {
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- }
- /* found another http login command for yahoo, it is like OSCAR */
- /* detect http connections */
- if (packet->payload_packet_len > 50 && (memcmp(packet->payload, "content-length: ", 16) == 0)) {
-
- ndpi_parse_packet_line_info(ndpi_struct, flow);
-
- if (packet->parsed_lines > 2 && packet->line[1].len == 0) {
-
- NDPI_LOG_DBG(ndpi_struct, "first line is empty\n");
- if (packet->line[2].len > 13 && memcmp(packet->line[2].ptr, "<Ymsg Command=", 14) == 0) {
-
- NDPI_LOG_INFO(ndpi_struct, "YAHOO web chat found\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- }
-
- if (packet->payload_packet_len > 38 && memcmp(packet->payload, "CONNECT scs.msg.yahoo.com:5050 HTTP/1.", 38) == 0) {
-
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO-HTTP\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
-
- if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0)
- || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0)) {
- if (packet->payload_packet_len == 6 && memcmp(packet->payload, "YAHOO!", 6) == 0) {
-
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- /* asymmetric detection for SNDIMG not done yet.
- * See ./Yahoo8.1-VideoCall-LAN.pcap and ./Yahoo-VideoCall-inPublicIP.pcap */
-
- if (packet->payload_packet_len == 8 && (memcmp(packet->payload, "<SNDIMG>", 8) == 0 || memcmp(packet->payload, "<REQIMG>", 8) == 0
- || memcmp(packet->payload, "<RVWCFG>", 8) == 0 || memcmp(packet->payload, "<RUPCFG>", 8) == 0)) {
-
- if(src != NULL) {
- if (memcmp(packet->payload, "<SNDIMG>", 8) == 0) {
- src->yahoo_video_lan_dir = 0;
- } else {
- src->yahoo_video_lan_dir = 1;
- }
- src->yahoo_video_lan_timer = packet->tick_timestamp;
- }
- if(dst != NULL) {
- if (memcmp(packet->payload, "<SNDIMG>", 8) == 0) {
- dst->yahoo_video_lan_dir = 0;
- } else {
- dst->yahoo_video_lan_dir = 1;
- }
- dst->yahoo_video_lan_timer = packet->tick_timestamp;
-
- }
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO subtype VIDEO");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- if(src != NULL && packet->tcp->dest == htons(5100)
- && ((u_int32_t) (packet->tick_timestamp - src->yahoo_video_lan_timer) < ndpi_struct->yahoo_lan_video_timeout)) {
-
- if (src->yahoo_video_lan_dir == 1) {
-
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO IMG MARKED");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- if (dst != NULL && packet->tcp->dest == htons(5100)
- && ((u_int32_t) (packet->tick_timestamp - dst->yahoo_video_lan_timer) < ndpi_struct->yahoo_lan_video_timeout)) {
- if (dst->yahoo_video_lan_dir == 0) {
-
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO IMG MARKED");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- }
- /* detect YAHOO over HTTP proxy */
- if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP)
- {
- if (flow->l4.tcp.yahoo_http_proxy_stage == 0) {
-
- NDPI_LOG_DBG2(ndpi_struct, "YAHOO maybe HTTP proxy packet 1 => need next packet\n");
- flow->l4.tcp.yahoo_http_proxy_stage = 1 + packet->packet_direction;
- return;
- }
- if (flow->l4.tcp.yahoo_http_proxy_stage == 1 + packet->packet_direction) {
- if ((packet->payload_packet_len > 250) && (memcmp(packet->payload, "<Session ", 9) == 0)) {
- if (ndpi_check_for_YmsgCommand(packet->payload_packet_len, packet->payload)) {
-
- NDPI_LOG_INFO(ndpi_struct, "found HTTP Proxy Yahoo Chat <Ymsg Command= pattern \n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- NDPI_LOG_DBG2(ndpi_struct, "YAHOO maybe HTTP proxy still initial direction => need next packet\n");
- return;
- }
- if (flow->l4.tcp.yahoo_http_proxy_stage == 2 - packet->packet_direction) {
-
- ndpi_parse_packet_line_info_any(ndpi_struct, flow);
-
- if (packet->parsed_lines >= 9) {
-
- if (packet->line[4].ptr != NULL && packet->line[4].len >= 9 &&
- packet->line[8].ptr != NULL && packet->line[8].len >= 6 &&
- memcmp(packet->line[4].ptr, "<Session ", 9) == 0 &&
- memcmp(packet->line[8].ptr, "<Ymsg ", 6) == 0) {
-
- NDPI_LOG_INFO(ndpi_struct, "found YAHOO over HTTP proxy");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN);
- return;
- }
- }
- }
- }
- }
-
- NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-}
-
-void ndpi_search_yahoo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
- struct ndpi_packet_struct *packet = &flow->packet;
-
- NDPI_LOG_DBG(ndpi_struct, "search yahoo\n");
-
- if(packet->payload_packet_len > 0 && flow->yahoo_detection_finished == 0) {
-
- /* search over TCP */
- if(packet->tcp != NULL && packet->tcp_retransmission == 0) {
-
- if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP
- || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_TLS) {
- /* search over TCP */
- ndpi_search_yahoo_tcp(ndpi_struct, flow);
- }
- }
- /* search over UDP */
- else if(packet->udp != NULL) {
- if ( flow->src == NULL ||
- NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) == 0) {
- NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
- }
- return;
- }
- }
-
- if(packet->payload_packet_len > 0 && flow->yahoo_detection_finished == 2) {
- if(packet->tcp != NULL && packet->tcp_retransmission == 0) {
- /* search over TCP */
- ndpi_search_yahoo_tcp(ndpi_struct, flow);
- return;
- }
- }
-}
-
-void init_yahoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
-
- ndpi_set_bitmask_protocol_detection("YAHOO", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_YAHOO,
- ndpi_search_yahoo,
- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
-
- *id += 1;
-}
-