Merge pull request #66 from c4stan/dev

Starcraft 2/Battle.net support

7 files changed, 174 insertions, 2 deletions

diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 6bac39160..e724f452d 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -199,6 +199,7 @@
 #define NDPI_PROTOCOL_TELEGRAM				        185 /* Gianluca Costa <g.costa@xplico.org> */
 #define NDPI_PROTOCOL_QUIC				        188 /* Andrea Buscarinu <andrea.buscarinu@gmail.com> - Michele Campus <michelecampus5@gmail.com> */
 #define NDPI_PROTOCOL_WHATSAPP_VOICE			        189
+#define NDPI_PROTOCOL_STARCRAFT2			        214 /* matteobracci1@gmail.com */
 
 
 #define NDPI_CONTENT_AVI				39
@@ -259,9 +260,10 @@
 #define NDPI_SERVICE_DEEZER                             210
 #define NDPI_SERVICE_INSTAGRAM                          211 /* Andrea Buscarinu <andrea.buscarinu@gmail.com> */
 #define NDPI_SERVICE_MICROSOFT                          212
+#define NDPI_SERVICE_BATTLENET                          213 /* matteobracci1@gmail.com */
 
 /* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL			NDPI_SERVICE_MICROSOFT
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL			NDPI_PROTOCOL_STARCRAFT2
 
 #define NDPI_MAX_SUPPORTED_PROTOCOLS                    (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
 #define NDPI_MAX_NUM_CUSTOM_PROTOCOLS                   (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index 4b898d6ec..904ae956e 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -194,6 +194,7 @@ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct n
 void ndpi_search_eaq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_kakaotalk_voice(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 void ndpi_search_mpegts(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
+void ndpi_search_starcraft2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
 
 
 /* --- INIT FUNCTIONS --- */
@@ -296,6 +297,7 @@ void init_soulseek_dissector(struct ndpi_detection_module_struct *ndpi_struct, u
 void init_spotify_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_ssh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_ssl_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_starcraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
 void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index bb8f84078..08ed60086 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -804,6 +804,9 @@ typedef struct ndpi_flow_struct {
   u_int32_t pplive_stage2:2;			// 0 - 2
   u_int32_t pplive_stage3:2;			// 0 - 2
 #endif
+#ifdef NDPI_PROTOCOL_STARCRAFT2
+  u_int32_t starcraft2_udp_stage : 3;	// 0-7
+#endif
 
   /* internal structures to save functions calls */
   struct ndpi_packet_struct packet;
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index a7442b8c9..03f133549 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -7401,7 +7401,8 @@ ndpi_protocol_match host_match[] = {
   { ".microsoft.com",                   "Microsoft",            NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE },
   { "update.microsoft.com",             "WindowsUpdate",        NDPI_SERVICE_WINDOWS_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
   { ".windowsupdate.com",               "WindowsUpdate",        NDPI_SERVICE_WINDOWS_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
-
+  { ".battle.net",                      "Battle.net",           NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN },
+	{ "bnetcmsus-a.akamaihd.net",         "Battle.net",           NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN },
   { NULL, 0 }
 };
 
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 0623433bb..feb613733 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1607,6 +1607,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
 			    no_master, "VHUA",
 			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
 			    ndpi_build_default_ports(ports_b, 58267, 0, 0, 0, 0) /* UDP */);
+    ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_STARCRAFT2,
+			    no_master, 
+			    no_master, "Starcraft 2",
+			    ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0),	/* TCP */
+			    ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0));	/* UDP */
     
     /* calling function for host and content matched protocols */
     init_string_based_protocols(ndpi_mod);
diff --git a/src/lib/protocols/starcraft2.c b/src/lib/protocols/starcraft2.c
new file mode 100644
index 000000000..6372c78ca
--- /dev/null
+++ b/src/lib/protocols/starcraft2.c
@@ -0,0 +1,157 @@
+/*
+* starcraft2.c
+*
+* Copyright (C) 2009-2011 by ipoque GmbH
+* Copyright (C) 2011-15 - ntop.org
+*
+* This file is part of nDPI, an open source deep packet inspection
+* library based on the OpenDPI and PACE technology by ipoque GmbH
+*
+* nDPI is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Lesser General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* nDPI is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+* GNU Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public License
+* along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+*
+*/
+
+
+#include "ndpi_protocols.h"
+#ifdef NDPI_PROTOCOL_STARCRAFT2
+
+/* Sender or receiver are one of the known login portals? */
+u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet)
+{
+	if (packet->iph == NULL)
+		return 0;
+
+	u_int32_t source_ip = ntohl(packet->iph->saddr);
+	u_int32_t dest_ip = ntohl(packet->iph->daddr);
+	return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32)		// EU 213.248.127.130
+		|| ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32)		// US 12.129.206.130
+		|| ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32)		// KR 121.254.200.130
+		|| ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32)		// SG 202.9.66.76
+		|| ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32));		// BETA 12.129.236.254
+}
+
+/*
+The main TCP flow starts with the user login and stays alive until the logout.
+Although hard to read, judging from what happens elsewhere this flow probably contains all the data
+transfer generated by the user interaction with the client, e.g. chatting or looking at someone's
+match history. The current way to detect this is plain dumb packet matching.
+*/
+u_int8_t ndpi_check_starcraft2_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+	if (sc2_match_logon_ip(&flow->packet)
+		&& flow->packet.tcp->dest == htons(1119)	//bnetgame port
+		&& flow->packet.payload_packet_len >= 10
+		&& (match_first_bytes(flow->packet.payload, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66") 
+			|| match_first_bytes(flow->packet.payload, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")))
+		return 1;
+	else
+		return -1;
+}
+
+/*
+UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the
+real key point here is to make sure that it's actually Starcraft 2 that is using the port and not
+some other Blizzard software.
+The flow is taken if a pattern in the size of some subsequent packets is found.
+*/
+u_int8_t ndpi_check_starcraft2_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+	struct ndpi_packet_struct* packet = &flow->packet;
+
+	/* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */
+	if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119))
+		return -1;
+
+	/* Then try to detect the size pattern */
+	switch (flow->starcraft2_udp_stage)
+	{
+	case 0:
+		if (packet->payload_packet_len == 20)
+			flow->starcraft2_udp_stage = 1;
+		break;
+	case 1:
+		if (packet->payload_packet_len == 20)
+			flow->starcraft2_udp_stage = 2;
+		break;
+	case 2:
+		if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85)
+			flow->starcraft2_udp_stage = 3;
+		break;
+	case 3:
+		if (packet->payload_packet_len == 20)
+			flow->starcraft2_udp_stage = 4;
+		break;
+	case 4:
+		if (packet->payload_packet_len == 548)
+			flow->starcraft2_udp_stage = 5;
+		break;
+	case 5:
+		if (packet->payload_packet_len == 548)
+			flow->starcraft2_udp_stage = 6;
+		break;
+	case 6:
+		if (packet->payload_packet_len == 548)
+			flow->starcraft2_udp_stage = 7;
+		break;
+	case 7:
+		if (packet->payload_packet_len == 484)
+			return 1;
+		break;
+	}
+}
+
+void ndpi_search_starcraft2(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+	NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 protocol detection...\n");
+	if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT2) {
+		struct ndpi_packet_struct* packet = &flow->packet;
+		int8_t result = 0;
+
+		if (packet->udp != NULL) {
+			result = ndpi_check_starcraft2_udp(ndpi_struct, flow);
+			if (result == 1) {
+				//printf("Found Starcraft 2 [Game, UDP]\n");
+				NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n");
+			}
+		}
+		else if (packet->tcp != NULL) {
+			result = ndpi_check_starcraft2_tcp(ndpi_struct, flow);
+			if (result == 1) {
+				//printf("Found Starcraft 2 [Client, TCP]\n");
+				NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n");
+			}
+		}
+
+		if (result == 1) {
+			ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT2, NDPI_PROTOCOL_UNKNOWN);
+		}
+		else if (result == -1) {
+			NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 excluded\n");
+			NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT2);
+		}
+	}
+}
+
+void init_starcraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+	ndpi_set_bitmask_protocol_detection("STARCRAFT2", ndpi_struct, detection_bitmask, *id,
+		NDPI_PROTOCOL_STARCRAFT2, ndpi_search_starcraft2,
+		NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+		SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+		ADD_TO_DETECTION_BITMASK);
+
+	*id += 1;
+}
+
+#endif
diff --git a/src/lib/protocols/world_of_warcraft.c b/src/lib/protocols/world_of_warcraft.c
index b9f4dee31..59d5c0a4d 100644
--- a/src/lib/protocols/world_of_warcraft.c
+++ b/src/lib/protocols/world_of_warcraft.c
@@ -61,6 +61,7 @@ void ndpi_search_worldofwarcraft(struct ndpi_detection_module_struct
   NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Search World of Warcraft.\n");
 
   if (packet->tcp != NULL) {
+  	/*
     if ((packet->payload_packet_len > NDPI_STATICSTRING_LEN("POST /") &&
 	 memcmp(packet->payload, "POST /", NDPI_STATICSTRING_LEN("POST /")) == 0) ||
 	(packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /") &&
@@ -76,6 +77,7 @@ void ndpi_search_worldofwarcraft(struct ndpi_detection_module_struct
 	return;
       }
     }
+    */
     if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /")
 	&& memcmp(packet->payload, "GET /", NDPI_STATICSTRING_LEN("GET /")) == 0) {
       ndpi_parse_packet_line_info(ndpi_struct, flow);