diff options
| -rw-r--r-- | src/include/ndpi_protocol_ids.h | 4 | ||||
| -rw-r--r-- | src/include/ndpi_protocols.h | 2 | ||||
| -rw-r--r-- | src/include/ndpi_typedefs.h | 3 | ||||
| -rw-r--r-- | src/lib/ndpi_content_match.c.inc | 3 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 5 | ||||
| -rw-r--r-- | src/lib/protocols/starcraft2.c | 157 | ||||
| -rw-r--r-- | src/lib/protocols/world_of_warcraft.c | 2 |
7 files changed, 174 insertions, 2 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 6bac39160..e724f452d 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -199,6 +199,7 @@ #define NDPI_PROTOCOL_TELEGRAM 185 /* Gianluca Costa <g.costa@xplico.org> */ #define NDPI_PROTOCOL_QUIC 188 /* Andrea Buscarinu <andrea.buscarinu@gmail.com> - Michele Campus <michelecampus5@gmail.com> */ #define NDPI_PROTOCOL_WHATSAPP_VOICE 189 +#define NDPI_PROTOCOL_STARCRAFT2 214 /* matteobracci1@gmail.com */ #define NDPI_CONTENT_AVI 39 @@ -259,9 +260,10 @@ #define NDPI_SERVICE_DEEZER 210 #define NDPI_SERVICE_INSTAGRAM 211 /* Andrea Buscarinu <andrea.buscarinu@gmail.com> */ #define NDPI_SERVICE_MICROSOFT 212 +#define NDPI_SERVICE_BATTLENET 213 /* matteobracci1@gmail.com */ /* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */ -#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_SERVICE_MICROSOFT +#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_STARCRAFT2 #define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1) #define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL) diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h index 4b898d6ec..904ae956e 100644 --- a/src/include/ndpi_protocols.h +++ b/src/include/ndpi_protocols.h @@ -194,6 +194,7 @@ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct n void ndpi_search_eaq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_kakaotalk_voice(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mpegts(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); +void ndpi_search_starcraft2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); /* --- INIT FUNCTIONS --- */ @@ -296,6 +297,7 @@ void init_soulseek_dissector(struct ndpi_detection_module_struct *ndpi_struct, u void init_spotify_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ssh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ssl_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); +void init_starcraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index bb8f84078..08ed60086 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -804,6 +804,9 @@ typedef struct ndpi_flow_struct { u_int32_t pplive_stage2:2; // 0 - 2 u_int32_t pplive_stage3:2; // 0 - 2 #endif +#ifdef NDPI_PROTOCOL_STARCRAFT2 + u_int32_t starcraft2_udp_stage : 3; // 0-7 +#endif /* internal structures to save functions calls */ struct ndpi_packet_struct packet; diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index a7442b8c9..03f133549 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -7401,7 +7401,8 @@ ndpi_protocol_match host_match[] = { { ".microsoft.com", "Microsoft", NDPI_SERVICE_MICROSOFT, NDPI_PROTOCOL_ACCEPTABLE }, { "update.microsoft.com", "WindowsUpdate", NDPI_SERVICE_WINDOWS_UPDATE, NDPI_PROTOCOL_ACCEPTABLE }, { ".windowsupdate.com", "WindowsUpdate", NDPI_SERVICE_WINDOWS_UPDATE, NDPI_PROTOCOL_ACCEPTABLE }, - + { ".battle.net", "Battle.net", NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN }, + { "bnetcmsus-a.akamaihd.net", "Battle.net", NDPI_SERVICE_BATTLENET, NDPI_PROTOCOL_FUN }, { NULL, 0 } }; diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 0623433bb..feb613733 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1607,6 +1607,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp no_master, "VHUA", ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 58267, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_STARCRAFT2, + no_master, + no_master, "Starcraft 2", + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ /* calling function for host and content matched protocols */ init_string_based_protocols(ndpi_mod); diff --git a/src/lib/protocols/starcraft2.c b/src/lib/protocols/starcraft2.c new file mode 100644 index 000000000..6372c78ca --- /dev/null +++ b/src/lib/protocols/starcraft2.c @@ -0,0 +1,157 @@ +/* +* starcraft2.c +* +* Copyright (C) 2009-2011 by ipoque GmbH +* Copyright (C) 2011-15 - ntop.org +* +* This file is part of nDPI, an open source deep packet inspection +* library based on the OpenDPI and PACE technology by ipoque GmbH +* +* nDPI is free software: you can redistribute it and/or modify +* it under the terms of the GNU Lesser General Public License as published by +* the Free Software Foundation, either version 3 of the License, or +* (at your option) any later version. +* +* nDPI is distributed in the hope that it will be useful, +* but WITHOUT ANY WARRANTY; without even the implied warranty of +* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +* GNU Lesser General Public License for more details. +* +* You should have received a copy of the GNU Lesser General Public License +* along with nDPI. If not, see <http://www.gnu.org/licenses/>. +* +*/ + + +#include "ndpi_protocols.h" +#ifdef NDPI_PROTOCOL_STARCRAFT2 + +/* Sender or receiver are one of the known login portals? */ +u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet) +{ + if (packet->iph == NULL) + return 0; + + u_int32_t source_ip = ntohl(packet->iph->saddr); + u_int32_t dest_ip = ntohl(packet->iph->daddr); + return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130 + || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130 + || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130 + || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76 + || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254 +} + +/* +The main TCP flow starts with the user login and stays alive until the logout. +Although hard to read, judging from what happens elsewhere this flow probably contains all the data +transfer generated by the user interaction with the client, e.g. chatting or looking at someone's +match history. The current way to detect this is plain dumb packet matching. +*/ +u_int8_t ndpi_check_starcraft2_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) +{ + if (sc2_match_logon_ip(&flow->packet) + && flow->packet.tcp->dest == htons(1119) //bnetgame port + && flow->packet.payload_packet_len >= 10 + && (match_first_bytes(flow->packet.payload, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66") + || match_first_bytes(flow->packet.payload, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66"))) + return 1; + else + return -1; +} + +/* +UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the +real key point here is to make sure that it's actually Starcraft 2 that is using the port and not +some other Blizzard software. +The flow is taken if a pattern in the size of some subsequent packets is found. +*/ +u_int8_t ndpi_check_starcraft2_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) +{ + struct ndpi_packet_struct* packet = &flow->packet; + + /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */ + if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119)) + return -1; + + /* Then try to detect the size pattern */ + switch (flow->starcraft2_udp_stage) + { + case 0: + if (packet->payload_packet_len == 20) + flow->starcraft2_udp_stage = 1; + break; + case 1: + if (packet->payload_packet_len == 20) + flow->starcraft2_udp_stage = 2; + break; + case 2: + if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85) + flow->starcraft2_udp_stage = 3; + break; + case 3: + if (packet->payload_packet_len == 20) + flow->starcraft2_udp_stage = 4; + break; + case 4: + if (packet->payload_packet_len == 548) + flow->starcraft2_udp_stage = 5; + break; + case 5: + if (packet->payload_packet_len == 548) + flow->starcraft2_udp_stage = 6; + break; + case 6: + if (packet->payload_packet_len == 548) + flow->starcraft2_udp_stage = 7; + break; + case 7: + if (packet->payload_packet_len == 484) + return 1; + break; + } +} + +void ndpi_search_starcraft2(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) +{ + NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 protocol detection...\n"); + if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT2) { + struct ndpi_packet_struct* packet = &flow->packet; + int8_t result = 0; + + if (packet->udp != NULL) { + result = ndpi_check_starcraft2_udp(ndpi_struct, flow); + if (result == 1) { + //printf("Found Starcraft 2 [Game, UDP]\n"); + NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n"); + } + } + else if (packet->tcp != NULL) { + result = ndpi_check_starcraft2_tcp(ndpi_struct, flow); + if (result == 1) { + //printf("Found Starcraft 2 [Client, TCP]\n"); + NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n"); + } + } + + if (result == 1) { + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT2, NDPI_PROTOCOL_UNKNOWN); + } + else if (result == -1) { + NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 excluded\n"); + NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT2); + } + } +} + +void init_starcraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) +{ + ndpi_set_bitmask_protocol_detection("STARCRAFT2", ndpi_struct, detection_bitmask, *id, + NDPI_PROTOCOL_STARCRAFT2, ndpi_search_starcraft2, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} + +#endif diff --git a/src/lib/protocols/world_of_warcraft.c b/src/lib/protocols/world_of_warcraft.c index b9f4dee31..59d5c0a4d 100644 --- a/src/lib/protocols/world_of_warcraft.c +++ b/src/lib/protocols/world_of_warcraft.c @@ -61,6 +61,7 @@ void ndpi_search_worldofwarcraft(struct ndpi_detection_module_struct NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Search World of Warcraft.\n"); if (packet->tcp != NULL) { + /* if ((packet->payload_packet_len > NDPI_STATICSTRING_LEN("POST /") && memcmp(packet->payload, "POST /", NDPI_STATICSTRING_LEN("POST /")) == 0) || (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /") && @@ -76,6 +77,7 @@ void ndpi_search_worldofwarcraft(struct ndpi_detection_module_struct return; } } + */ if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /") && memcmp(packet->payload, "GET /", NDPI_STATICSTRING_LEN("GET /")) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); |