aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/protocols')
-rw-r--r--src/lib/protocols/skype.c16
-rw-r--r--src/lib/protocols/starcraft.c155
-rw-r--r--src/lib/protocols/starcraft2.c157
3 files changed, 165 insertions, 163 deletions
diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 270a85fba..7f201569c 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -68,13 +68,17 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
flow->l4.udp.skype_packet_id++;
if(flow->l4.udp.skype_packet_id < 5) {
+ u_int16_t dport = ntohs(packet->udp->dest);
+
/* skype-to-skype */
- if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d))
- || ((payload_len >= 16)
- && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */
- && (packet->payload[2] == 0x02))) {
- NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found skype.\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+ if(dport != 1119) /* It can be confused with battle.net */ {
+ if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d))
+ || ((payload_len >= 16)
+ && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */
+ && (packet->payload[2] == 0x02))) {
+ NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found skype.\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+ }
}
return;
diff --git a/src/lib/protocols/starcraft.c b/src/lib/protocols/starcraft.c
new file mode 100644
index 000000000..157bc6da0
--- /dev/null
+++ b/src/lib/protocols/starcraft.c
@@ -0,0 +1,155 @@
+/*
+* starcraft.c
+*
+* Copyright (C) 2015 - Matteo Bracci <matteobracci1@gmail.com>
+* Copyright (C) 2015 - ntop.org
+*
+* nDPI is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Lesser General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* nDPI is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+* GNU Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public License
+* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+*
+*/
+
+
+#include "ndpi_protocols.h"
+
+#ifdef NDPI_PROTOCOL_STARCRAFT
+
+/* Sender or receiver are one of the known login portals? */
+u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet)
+{
+ if (packet->iph == NULL)
+ return 0;
+
+ u_int32_t source_ip = ntohl(packet->iph->saddr);
+ u_int32_t dest_ip = ntohl(packet->iph->daddr);
+ return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130
+ || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130
+ || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130
+ || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76
+ || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254
+}
+
+/*
+ The main TCP flow starts with the user login and stays alive until the logout.
+ Although hard to read, judging from what happens elsewhere this flow probably contains all the data
+ transfer generated by the user interaction with the client, e.g. chatting or looking at someone's
+ match history. The current way to detect this is plain dumb packet matching.
+*/
+u_int8_t ndpi_check_starcraft_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ if (sc2_match_logon_ip(&flow->packet)
+ && flow->packet.tcp->dest == htons(1119) //bnetgame port
+ && flow->packet.payload_packet_len >= 10
+ && (match_first_bytes(flow->packet.payload, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")
+ || match_first_bytes(flow->packet.payload, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")))
+ return 1;
+ else
+ return -1;
+}
+
+/*
+ UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the
+ real key point here is to make sure that it's actually Starcraft 2 that is using the port and not
+ some other Blizzard software.
+ The flow is taken if a pattern in the size of some subsequent packets is found.
+*/
+u_int8_t ndpi_check_starcraft_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ struct ndpi_packet_struct* packet = &flow->packet;
+
+ /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */
+ if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119))
+ return -1;
+
+ /* Then try to detect the size pattern */
+ switch (flow->starcraft_udp_stage)
+ {
+ case 0:
+ if (packet->payload_packet_len == 20)
+ flow->starcraft_udp_stage = 1;
+ break;
+ case 1:
+ if (packet->payload_packet_len == 20)
+ flow->starcraft_udp_stage = 2;
+ break;
+ case 2:
+ if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85)
+ flow->starcraft_udp_stage = 3;
+ break;
+ case 3:
+ if (packet->payload_packet_len == 20)
+ flow->starcraft_udp_stage = 4;
+ break;
+ case 4:
+ if (packet->payload_packet_len == 548)
+ flow->starcraft_udp_stage = 5;
+ break;
+ case 5:
+ if (packet->payload_packet_len == 548)
+ flow->starcraft_udp_stage = 6;
+ break;
+ case 6:
+ if (packet->payload_packet_len == 548)
+ flow->starcraft_udp_stage = 7;
+ break;
+ case 7:
+ if (packet->payload_packet_len == 484)
+ return 1;
+ break;
+ }
+}
+
+void ndpi_search_starcraft(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft protocol detection...\n");
+ if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT) {
+ struct ndpi_packet_struct* packet = &flow->packet;
+ int8_t result = 0;
+
+ if (packet->udp != NULL) {
+ result = ndpi_check_starcraft_udp(ndpi_struct, flow);
+ if (result == 1) {
+ //printf("Found Starcraft 2 [Game, UDP]\n");
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n");
+ }
+ }
+ else if (packet->tcp != NULL) {
+ result = ndpi_check_starcraft_tcp(ndpi_struct, flow);
+ if (result == 1) {
+ //printf("Found Starcraft 2 [Client, TCP]\n");
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n");
+ }
+ }
+
+ if (result == 1) {
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT, NDPI_PROTOCOL_UNKNOWN);
+ }
+ else if (result == -1) {
+ NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft excluded\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT);
+ }
+ }
+}
+
+void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ ndpi_set_bitmask_protocol_detection("Starcraft", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_STARCRAFT, ndpi_search_starcraft,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
+#endif
diff --git a/src/lib/protocols/starcraft2.c b/src/lib/protocols/starcraft2.c
deleted file mode 100644
index 6372c78ca..000000000
--- a/src/lib/protocols/starcraft2.c
+++ /dev/null
@@ -1,157 +0,0 @@
-/*
-* starcraft2.c
-*
-* Copyright (C) 2009-2011 by ipoque GmbH
-* Copyright (C) 2011-15 - ntop.org
-*
-* This file is part of nDPI, an open source deep packet inspection
-* library based on the OpenDPI and PACE technology by ipoque GmbH
-*
-* nDPI is free software: you can redistribute it and/or modify
-* it under the terms of the GNU Lesser General Public License as published by
-* the Free Software Foundation, either version 3 of the License, or
-* (at your option) any later version.
-*
-* nDPI is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Lesser General Public License for more details.
-*
-* You should have received a copy of the GNU Lesser General Public License
-* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
-*
-*/
-
-
-#include "ndpi_protocols.h"
-#ifdef NDPI_PROTOCOL_STARCRAFT2
-
-/* Sender or receiver are one of the known login portals? */
-u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet)
-{
- if (packet->iph == NULL)
- return 0;
-
- u_int32_t source_ip = ntohl(packet->iph->saddr);
- u_int32_t dest_ip = ntohl(packet->iph->daddr);
- return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130
- || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130
- || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130
- || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76
- || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254
-}
-
-/*
-The main TCP flow starts with the user login and stays alive until the logout.
-Although hard to read, judging from what happens elsewhere this flow probably contains all the data
-transfer generated by the user interaction with the client, e.g. chatting or looking at someone's
-match history. The current way to detect this is plain dumb packet matching.
-*/
-u_int8_t ndpi_check_starcraft2_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- if (sc2_match_logon_ip(&flow->packet)
- && flow->packet.tcp->dest == htons(1119) //bnetgame port
- && flow->packet.payload_packet_len >= 10
- && (match_first_bytes(flow->packet.payload, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")
- || match_first_bytes(flow->packet.payload, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")))
- return 1;
- else
- return -1;
-}
-
-/*
-UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the
-real key point here is to make sure that it's actually Starcraft 2 that is using the port and not
-some other Blizzard software.
-The flow is taken if a pattern in the size of some subsequent packets is found.
-*/
-u_int8_t ndpi_check_starcraft2_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- struct ndpi_packet_struct* packet = &flow->packet;
-
- /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */
- if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119))
- return -1;
-
- /* Then try to detect the size pattern */
- switch (flow->starcraft2_udp_stage)
- {
- case 0:
- if (packet->payload_packet_len == 20)
- flow->starcraft2_udp_stage = 1;
- break;
- case 1:
- if (packet->payload_packet_len == 20)
- flow->starcraft2_udp_stage = 2;
- break;
- case 2:
- if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85)
- flow->starcraft2_udp_stage = 3;
- break;
- case 3:
- if (packet->payload_packet_len == 20)
- flow->starcraft2_udp_stage = 4;
- break;
- case 4:
- if (packet->payload_packet_len == 548)
- flow->starcraft2_udp_stage = 5;
- break;
- case 5:
- if (packet->payload_packet_len == 548)
- flow->starcraft2_udp_stage = 6;
- break;
- case 6:
- if (packet->payload_packet_len == 548)
- flow->starcraft2_udp_stage = 7;
- break;
- case 7:
- if (packet->payload_packet_len == 484)
- return 1;
- break;
- }
-}
-
-void ndpi_search_starcraft2(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 protocol detection...\n");
- if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT2) {
- struct ndpi_packet_struct* packet = &flow->packet;
- int8_t result = 0;
-
- if (packet->udp != NULL) {
- result = ndpi_check_starcraft2_udp(ndpi_struct, flow);
- if (result == 1) {
- //printf("Found Starcraft 2 [Game, UDP]\n");
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n");
- }
- }
- else if (packet->tcp != NULL) {
- result = ndpi_check_starcraft2_tcp(ndpi_struct, flow);
- if (result == 1) {
- //printf("Found Starcraft 2 [Client, TCP]\n");
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n");
- }
- }
-
- if (result == 1) {
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT2, NDPI_PROTOCOL_UNKNOWN);
- }
- else if (result == -1) {
- NDPI_LOG(NDPI_PROTOCOL_STARCRAFT2, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft2 excluded\n");
- NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT2);
- }
- }
-}
-
-void init_starcraft2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
- ndpi_set_bitmask_protocol_detection("STARCRAFT2", ndpi_struct, detection_bitmask, *id,
- NDPI_PROTOCOL_STARCRAFT2, ndpi_search_starcraft2,
- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
-
- *id += 1;
-}
-
-#endif
Powered by cgit, Themed by Ted Yin.