Add support for Epic Games and GeForceNow/Nvidia (#1990)

8 files changed, 211 insertions, 0 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 2db04cc0c..ad59a945f 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -368,6 +368,9 @@ typedef enum {
   NDPI_PROTOCOL_FACEBOOK_REEL_STORY   = 337,
   NDPI_PROTOCOL_SRTP                  = 338,
   NDPI_PROTOCOL_GAMBLING              = 339,
+  NDPI_PROTOCOL_EPICGAMES             = 340,
+  NDPI_PROTOCOL_GEFORCENOW            = 341,
+  NDPI_PROTOCOL_NVIDIA                = 342,
 
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index c9e247834..a1b98eeeb 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -241,6 +241,7 @@ void init_tailscale_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 void init_source_engine_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_bacnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 void init_oicq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
+void init_epicgames_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
 
 /* ndpi_main.c */
 extern u_int32_t ndpi_ip_port_hash_funct(u_int32_t ip, u_int16_t port);
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index efe90da72..491de0d79 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -822,6 +822,10 @@ struct ndpi_flow_udp_struct {
   /* NDPI_PROTOCOL_QUIC */
   u_int32_t quic_0rtt_found:1;
 
+  /* NDPI_PROTOCOL_EPICGAMES */
+  u_int32_t epicgames_stage:1;
+  u_int32_t epicgames_word;
+
   /* NDPI_PROTOCOL_SKYPE */
   u_int8_t skype_crc[4];
 
diff --git a/src/lib/inc_generated/ndpi_asn_epicgames.c.inc b/src/lib/inc_generated/ndpi_asn_epicgames.c.inc
new file mode 100644
index 000000000..c4f76d07a
--- /dev/null
+++ b/src/lib/inc_generated/ndpi_asn_epicgames.c.inc
@@ -0,0 +1,31 @@
+/*
+ *
+ * This file is generated automatically and part of nDPI
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* ****************************************************** */
+
+
+static ndpi_network ndpi_protocol_epicgames_protocol_list[] = {
+ { 0x944E7000 /* 148.78.112.0/23 */, 23, NDPI_PROTOCOL_EPICGAMES },
+ { 0x944E7200 /* 148.78.114.0/24 */, 24, NDPI_PROTOCOL_EPICGAMES },
+ { 0x944E7900 /* 148.78.121.0/24 */, 24, NDPI_PROTOCOL_EPICGAMES },
+ { 0x944E7A00 /* 148.78.122.0/24 */, 24, NDPI_PROTOCOL_EPICGAMES },
+ { 0xC7FF2800 /* 199.255.40.0/22 */, 22, NDPI_PROTOCOL_EPICGAMES },
+ /* End */
+ { 0x0, 0, 0 }
+};
diff --git a/src/lib/inc_generated/ndpi_asn_nvidia.c.inc b/src/lib/inc_generated/ndpi_asn_nvidia.c.inc
new file mode 100644
index 000000000..417773eb4
--- /dev/null
+++ b/src/lib/inc_generated/ndpi_asn_nvidia.c.inc
@@ -0,0 +1,59 @@
+/*
+ *
+ * This file is generated automatically and part of nDPI
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* ****************************************************** */
+
+
+static ndpi_network ndpi_protocol_nvidia_protocol_list[] = {
+ { 0x081A9200 /* 8.26.146.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x081CE500 /* 8.28.229.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x08247000 /* 8.36.112.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x08247800 /* 8.36.120.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x082C3300 /* 8.44.51.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x082C3400 /* 8.44.52.0/22 */, 22, NDPI_PROTOCOL_NVIDIA },
+ { 0x082F4300 /* 8.47.67.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x18330000 /* 24.51.0.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x18330200 /* 24.51.2.0/23 */, 23, NDPI_PROTOCOL_NVIDIA },
+ { 0x18330400 /* 24.51.4.0/22 */, 22, NDPI_PROTOCOL_NVIDIA },
+ { 0x18330800 /* 24.51.8.0/21 */, 21, NDPI_PROTOCOL_NVIDIA },
+ { 0x18331000 /* 24.51.16.0/20 */, 20, NDPI_PROTOCOL_NVIDIA },
+ { 0x25BA6F00 /* 37.186.111.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x42168000 /* 66.22.128.0/21 */, 21, NDPI_PROTOCOL_NVIDIA },
+ { 0x42168800 /* 66.22.136.0/22 */, 22, NDPI_PROTOCOL_NVIDIA },
+ { 0x42168C00 /* 66.22.140.0/23 */, 23, NDPI_PROTOCOL_NVIDIA },
+ { 0x48194000 /* 72.25.64.0/23 */, 23, NDPI_PROTOCOL_NVIDIA },
+ { 0x48194200 /* 72.25.66.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x48194400 /* 72.25.68.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x4D6FF900 /* 77.111.249.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x4D6FFB00 /* 77.111.251.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x5054A000 /* 80.84.160.0/20 */, 20, NDPI_PROTOCOL_NVIDIA },
+ { 0x551D0E00 /* 85.29.14.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x551D1200 /* 85.29.18.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x59F8ED00 /* 89.248.237.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x6706D300 /* 103.6.211.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x70D98000 /* 112.217.128.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0x79C82D00 /* 121.200.45.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0xB9884400 /* 185.136.68.0/22 */, 22, NDPI_PROTOCOL_NVIDIA },
+ { 0xC1F63300 /* 193.246.51.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0xD8E47000 /* 216.228.112.0/20 */, 20, NDPI_PROTOCOL_NVIDIA },
+ { 0xD9C7D100 /* 217.199.209.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ { 0xD9C7DE00 /* 217.199.222.0/24 */, 24, NDPI_PROTOCOL_NVIDIA },
+ /* End */
+ { 0x0, 0, 0 }
+};
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index e08167a31..ed4bd5ab8 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -1369,6 +1369,25 @@ static ndpi_protocol_match host_match[] =
    { "pvp.net",                          "RiotGames", NDPI_PROTOCOL_RIOTGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
    { "riotcdn.net",                      "RiotGames", NDPI_PROTOCOL_RIOTGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
 
+   { "epicgames.com",                    "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "unrealengine.com",                 "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "fortnite.com",                     "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "fortnite-vod.akamaized.net",       "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "epicgames.net",                    "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "epicgames.dev",                    "EpicGames", NDPI_PROTOCOL_EPICGAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+
+   { "nvidiagrid.net",                   "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "gfe.nvidia.com",                   "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "geforcenow.com",                   "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "geforce.com",                      "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "kaizen.nvidia.com",                "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "dtrace.nvidia.com",                "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "nvgs.nvidia.com",                  "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "gx.nvidia.com",                    "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+   { "userstore.nvidia.com",             "GeForceNow", NDPI_PROTOCOL_GEFORCENOW, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL},
+
+   { "nvidia.com",                       "Nvidia", NDPI_PROTOCOL_NVIDIA, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DEFAULT_LEVEL},
+
    /*
       ADS/tracking/analytic
     */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 4792c4edf..5b340aba1 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -107,6 +107,8 @@
 #include "inc_generated/ndpi_asn_yandex_cloud.c.inc"
 #include "inc_generated/ndpi_asn_disney_plus.c.inc"
 #include "inc_generated/ndpi_asn_hulu.c.inc"
+#include "inc_generated/ndpi_asn_epicgames.c.inc"
+#include "inc_generated/ndpi_asn_nvidia.c.inc"
 
 /* Third party libraries */
 #include "third_party/include/ndpi_patricia.h"
@@ -2835,6 +2837,8 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs
       ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_yandex_cloud_protocol_list);
       ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_disneyplus_protocol_list);
       ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_hulu_protocol_list);
+      ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_epicgames_protocol_list);
+      ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_nvidia_protocol_list);
     }
 
     if(prefs & ndpi_track_flow_payload)
@@ -4942,6 +4946,9 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
   /* Heroes of the Storm */
   init_hots_dissector(ndpi_str, &a);
 
+  /* EpicGames */
+  init_epicgames_dissector(ndpi_str, &a);
+
 #ifdef CUSTOM_NDPI_PROTOCOLS
 #include "../../../nDPI-custom/custom_ndpi_main_init.c"
 #endif
diff --git a/src/lib/protocols/epicgames.c b/src/lib/protocols/epicgames.c
new file mode 100644
index 000000000..ea30783fd
--- /dev/null
+++ b/src/lib/protocols/epicgames.c
@@ -0,0 +1,87 @@
+/*
+ * epicgames.c
+ *
+ * Copyright (C) 2023 - ntop.org
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_EPICGAMES
+
+#include "ndpi_api.h"
+
+static void ndpi_int_epicgames_add_connection(struct ndpi_detection_module_struct * const ndpi_struct,
+                                              struct ndpi_flow_struct * const flow)
+{
+  NDPI_LOG_INFO(ndpi_struct, "found EpicGames\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow,
+                             NDPI_PROTOCOL_UNKNOWN,
+                             NDPI_PROTOCOL_EPICGAMES,
+                             NDPI_CONFIDENCE_DPI);
+}
+
+static void ndpi_search_epicgames(struct ndpi_detection_module_struct *ndpi_struct,
+                                  struct ndpi_flow_struct *flow)
+{
+  struct ndpi_packet_struct *packet = &ndpi_struct->packet;
+
+  NDPI_LOG_DBG(ndpi_struct, "searching EpicGames (stage %d dir %d)\n",
+               flow->l4.udp.epicgames_stage, packet->packet_direction);
+
+  if(flow->packet_counter == 1) {
+    if(packet->payload_packet_len >= 34 &&
+       ((ntohl(get_u_int32_t(packet->payload, 0)) & 0x08) == 0) &&
+       get_u_int64_t(packet->payload, 10) == 0 &&
+       get_u_int64_t(packet->payload, 18) == 0 &&
+       get_u_int64_t(packet->payload, 26) == 0) {
+      flow->l4.udp.epicgames_stage = 1 + packet->packet_direction;
+      flow->l4.udp.epicgames_word = ntohl(get_u_int32_t(packet->payload, 0));
+      return;
+    } else {
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+      return;
+    }
+  } else if(flow->l4.udp.epicgames_stage == 2 - packet->packet_direction) {
+    if(packet->payload_packet_len > 4 &&
+       (flow->l4.udp.epicgames_word | 0x08) == ntohl(get_u_int32_t(packet->payload, 0))) {
+      ndpi_int_epicgames_add_connection(ndpi_struct, flow);
+      return;
+    } else {
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+      return;
+    }
+  }
+
+  if(flow->packet_counter >= 4) {
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    return;
+  }
+}
+
+void init_epicgames_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+                              u_int32_t *id)
+{
+  ndpi_set_bitmask_protocol_detection("EpicGames", ndpi_struct, *id,
+                                      NDPI_PROTOCOL_EPICGAMES,
+                                      ndpi_search_epicgames,
+                                      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
+                                      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+                                      ADD_TO_DETECTION_BITMASK);
+
+  *id += 1;
+}