1 files changed, 5 insertions, 85 deletions

diff --git a/src/lib/protocols/mining.c b/src/lib/protocols/mining.c
index 02c765216..060d20b74 100644
--- a/src/lib/protocols/mining.c
+++ b/src/lib/protocols/mining.c
@@ -1,5 +1,5 @@
 /*
- * mining.c [Bitcoin, Ethereum, ZCash, Monero]
+ * mining.c [ZCash, Monero]
  *
  * Copyright (C) 2018-22 - ntop.org
  *
@@ -49,82 +49,14 @@ static void cacheMiningHostTwins(struct ndpi_detection_module_struct *ndpi_struc
 
 /* ************************************************************************** */
 
-static void ndpi_search_mining_udp(struct ndpi_detection_module_struct *ndpi_struct,
-				   struct ndpi_flow_struct *flow) {
-  struct ndpi_packet_struct *packet = &ndpi_struct->packet;
-  u_int16_t source = ntohs(packet->udp->source);
-  u_int16_t dest = ntohs(packet->udp->dest);
-
-  NDPI_LOG_DBG(ndpi_struct, "search MINING UDP\n");
-
-  // printf("==> %s()\n", __FUNCTION__);
-  /* 
-     Ethereum P2P Discovery Protocol
-     https://github.com/ConsenSys/ethereum-dissectors/blob/master/packet-ethereum-disc.c
-  */
-  if((packet->payload_packet_len > 98)
-     && (packet->payload_packet_len < 1280)
-     && ((source == 30303) || (dest == 30303))
-     && (packet->payload[97] <= 0x04 /* NODES */)
-     ) {
-    if((packet->iph) && ((ntohl(packet->iph->daddr) & 0xFF000000 /* 255.0.0.0 */) == 0xFF000000))
-      ;
-    else if(packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000)
-      ;
-    else {
-      ndpi_snprintf(flow->protos.mining.currency, sizeof(flow->protos.mining.currency), "%s", "ETH");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
-      cacheMiningHostTwins(ndpi_struct, flow);
-      return;
-    }
-  }
-  
-  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-}
-
-/* ************************************************************************** */
-
-static u_int8_t isEthPort(u_int16_t dport) {
-  return(((dport >= 30300) && (dport <= 30305)) ? 1 : 0);
-}
-
-/* ************************************************************************** */
-
-static void ndpi_search_mining_tcp(struct ndpi_detection_module_struct *ndpi_struct,
+static void ndpi_search_mining(struct ndpi_detection_module_struct *ndpi_struct,
 				   struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
 
-  NDPI_LOG_DBG(ndpi_struct, "search MINING TCP\n");
+  NDPI_LOG_DBG(ndpi_struct, "search MINING\n");
 
-  /* Check connection over TCP */
   if(packet->payload_packet_len > 10) {
-    if((packet->payload_packet_len > 300)
-       && (packet->payload_packet_len < 600)
-       && (packet->payload[2] == 0x04)) {
-      if(isEthPort(ntohs(packet->tcp->dest)) /* Ethereum port */) {
-       ndpi_snprintf(flow->protos.mining.currency, sizeof(flow->protos.mining.currency), "%s", "ETH");
-	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
-	cacheMiningHostTwins(ndpi_struct, flow);
-	return;
-      } 
-    } else if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
-	 && (
-	   ndpi_strnstr((const char *)packet->payload, "\"eth1.0\"", packet->payload_packet_len)
-	   || ndpi_strnstr((const char *)packet->payload, "\"worker\":", packet->payload_packet_len)
-	   /* || ndpi_strnstr((const char *)packet->payload, "\"id\":", packet->payload_packet_len) - Removed as too generic */
-	   )) {
-      /*
-	Ethereum
-	
-	{"worker": "eth1.0", "jsonrpc": "2.0", "params": ["0x0fccfff9e61a230ff380530c6827caf4759337c6.rig2", "x"], "id": 2, "method": "eth_submitLogin"}
-	{ "id": 2, "jsonrpc":"2.0","result":true}
-	{"worker": "", "jsonrpc": "2.0", "params": [], "id": 3, "method": "eth_getWork"}
-      */
-      ndpi_snprintf(flow->protos.mining.currency, sizeof(flow->protos.mining.currency), "%s", "ETH");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
-      cacheMiningHostTwins(ndpi_struct, flow);
-      return;
-    } else if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
+    if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
 	      && (ndpi_strnstr((const char *)packet->payload, "\"method\":", packet->payload_packet_len)
 		  || ndpi_strnstr((const char *)packet->payload, "\"blob\":", packet->payload_packet_len)
 		  /* || ndpi_strnstr((const char *)packet->payload, "\"id\":", packet->payload_packet_len) - Removed as too generic */
@@ -155,25 +87,13 @@ static void ndpi_search_mining_tcp(struct ndpi_detection_module_struct *ndpi_str
 
 /* ************************************************************************** */
 
-static void ndpi_search_mining(struct ndpi_detection_module_struct *ndpi_struct,
-			       struct ndpi_flow_struct *flow) {
-  struct ndpi_packet_struct *packet = &ndpi_struct->packet;
-
-  if(packet->tcp)
-    return ndpi_search_mining_tcp(ndpi_struct, flow);
-  return ndpi_search_mining_udp(ndpi_struct, flow);
-}
-
-
-/* ************************************************************************** */
-
 void init_mining_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 			   u_int32_t *id)
 {
   ndpi_set_bitmask_protocol_detection("Mining", ndpi_struct, *id,
 				      NDPI_PROTOCOL_MINING,
 				      ndpi_search_mining,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);