diff options
Diffstat (limited to 'src/lib/protocols/starcraft2.c')
| -rw-r--r-- | src/lib/protocols/starcraft2.c | 157 |
1 files changed, 0 insertions, 157 deletions
diff --git a/src/lib/protocols/starcraft2.c b/src/lib/protocols/starcraft2.c deleted file mode 100644 index 6372c78ca..000000000 --- a/src/lib/protocols/starcraft2.c +++ /dev/null @@ -1,157 +0,0 @@ -/* -* starcraft2.c -* -* Copyright (C) 2009-2011 by ipoque GmbH -* Copyright (C) 2011-15 - ntop.org -* -* This file is part of nDPI, an open source deep packet inspection -* library based on the OpenDPI and PACE technology by ipoque GmbH -* -* nDPI is free software: you can redistribute it and/or modify -* it under the terms of the GNU Lesser General Public License as published by -* the Free Software Foundation, either version 3 of the License, or -* (at your option) any later version. -* -* nDPI is distributed in the hope that it will be useful, -* but WITHOUT ANY WARRANTY; without even the implied warranty of -* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -* GNU Lesser General Public License for more details. -* -* You should have received a copy of the GNU Lesser General Public License -* along with nDPI. If not, see <http://www.gnu.org/licenses/>. -* -*/ - - -#include "ndpi_protocols.h" -#ifdef NDPI_PROTOCOL_STARCRAFT2 - -/* Sender or receiver are one of the known login portals? */ -u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet) -{ - if (packet->iph == NULL) - return 0; - - u_int32_t source_ip = ntohl(packet->iph->saddr); - u_int32_t dest_ip = ntohl(packet->iph->daddr); - return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130 - || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130 - || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130 - || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76 - || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254 -} - -/* -The main TCP flow starts with the user login and stays alive until the logout. -Although hard to read, judging from what happens elsewhere this flow probably contains all the data -transfer generated by the user interaction with the client, e.g. chatting or looking at someone's -match history. The current way to detect this is plain dumb packet matching. -*/ -u_int8_t ndpi_check_starcraft2_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) -{ - if (sc2_match_logon_ip(&flow->packet) - && flow->packet.tcp->dest == htons(1119) //bnetgame port - && flow->packet.payload_packet_len >= 10 - && (match_first_bytes(flow->packet.payload, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66") - || match_first_bytes(flow->packet.payload, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66"))) - return 1; - else - return -1; -} - -/* -UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the -real key point here is to make sure that it's actually Starcraft 2 that is using the port and not -some other Blizzard software. -The flow is taken if a pattern in the size of some subsequent packets is found. -*/ -u_int8_t ndpi_check_starcraft2_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) -{ - struct ndpi_packet_struct* packet = &flow->packet; - - /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */ - if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119)) - return -1; - - /* Then try to detect the size pattern */ - switch (flow->starcraft2_udp_stage) - { - case 0: - if (packet->payload_packet_len == 20) - flow->starcraft2_udp_stage = 1; - break; - case 1: - if (packet->payload_packet_len == 20) - flow->starcraft2_udp_stage = 2; - break; - case 2: - if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85) - flow->starcraft2_udp_stage = 3; - break; - case 3: - if (packet->payload_packet_len == 20) - flow->starcraft2_udp_stage = 4; - break; - case 4: - if (packet->payload_packet_len == 548) - flow->starcraft2_udp_stage = 5; - break; - case 5: - if (packet->payload_packet_len == 548) - flow->starcraft2_udp_stage = 6; - break; - case 6: - if (packet->payload_packet_len == 548) - flow->starcraft2_udp_stage = 7; - break; - case 7: - if (packet->payload_packet_len == 484) - return 1; - break; - } -} - -void ndpi_search_starcraft2(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) -{ - NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 protocol detection...\n"); - if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT2) { - struct ndpi_packet_struct* packet = &flow->packet; - int8_t result = 0; - - if (packet->udp != NULL) { - result = ndpi_check_starcraft2_udp(ndpi_struct, flow); - if (result == 1) { - //printf("Found Starcraft 2 [Game, UDP]\n"); - NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n"); - } - } - else if (packet->tcp != NULL) { - result = ndpi_check_starcraft2_tcp(ndpi_struct, flow); - if (result == 1) { - //printf("Found Starcraft 2 [Client, TCP]\n"); - NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n"); - } - } - - if (result == 1) { - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT2, NDPI_PROTOCOL_UNKNOWN); - } - else if (result == -1) { - NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 excluded\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT2); - } - } -} - -void init_starcraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) -{ - ndpi_set_bitmask_protocol_detection("STARCRAFT2", ndpi_struct, detection_bitmask, *id, - NDPI_PROTOCOL_STARCRAFT2, ndpi_search_starcraft2, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} - -#endif |