aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_private.h2
-rw-r--r--src/include/ndpi_protocol_ids.h2
-rw-r--r--src/include/ndpi_typedefs.h3
-rw-r--r--src/lib/inc_generated/ndpi_asn_blizzard.c.inc96
-rw-r--r--src/lib/inc_generated/ndpi_asn_starcraft.c.inc94
-rw-r--r--src/lib/ndpi_content_match.c.inc13
-rw-r--r--src/lib/ndpi_main.c16
-rw-r--r--src/lib/protocols/blizzard.c115
-rw-r--r--src/lib/protocols/starcraft.c159
9 files changed, 234 insertions, 266 deletions
diff --git a/src/include/ndpi_private.h b/src/include/ndpi_private.h
index 8b8106112..42d8f3fda 100644
--- a/src/include/ndpi_private.h
+++ b/src/include/ndpi_private.h
@@ -834,7 +834,7 @@ void init_sonos_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_in
void init_spotify_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_ssh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_tls_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
-void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
+void init_blizzard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
void init_syslog_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id);
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index adfb9850d..433a2129c 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -241,7 +241,7 @@ typedef enum {
NDPI_PROTOCOL_DEEZER = 210,
NDPI_PROTOCOL_INSTAGRAM = 211,
NDPI_PROTOCOL_MICROSOFT = 212,
- NDPI_PROTOCOL_STARCRAFT = 213,
+ NDPI_PROTOCOL_BLIZZARD = 213,
NDPI_PROTOCOL_TEREDO = 214,
NDPI_PROTOCOL_HOTSPOT_SHIELD = 215,
NDPI_PROTOCOL_IMO = 216,
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 4eb003567..c5958e969 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -1636,9 +1636,6 @@ struct ndpi_flow_struct {
/* NDPI_PROTOCOL_ZATTOO */
u_int8_t zattoo_stage:3;
- /* NDPI_PROTOCOL_STARCRAFT */
- u_int8_t starcraft_udp_stage : 3; // 0-7
-
/* NDPI_PROTOCOL_OOKLA */
u_int8_t ookla_stage : 1;
diff --git a/src/lib/inc_generated/ndpi_asn_blizzard.c.inc b/src/lib/inc_generated/ndpi_asn_blizzard.c.inc
new file mode 100644
index 000000000..e5f9ad203
--- /dev/null
+++ b/src/lib/inc_generated/ndpi_asn_blizzard.c.inc
@@ -0,0 +1,96 @@
+/*
+ *
+ * This file is generated automatically and part of nDPI
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+/* ****************************************************** */
+
+
+static ndpi_network ndpi_protocol_blizzard_protocol_list[] = {
+ { 0x052AA000 /* 5.42.160.0/20 */, 20, NDPI_PROTOCOL_BLIZZARD },
+ { 0x052AB200 /* 5.42.178.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18691200 /* 24.105.18.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18691900 /* 24.105.25.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18691C00 /* 24.105.28.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18692000 /* 24.105.32.0/20 */, 20, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18693200 /* 24.105.50.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18693400 /* 24.105.52.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18693800 /* 24.105.56.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18693B00 /* 24.105.59.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x18693C00 /* 24.105.60.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F40000 /* 37.244.0.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F40200 /* 37.244.2.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F40400 /* 37.244.4.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F40800 /* 37.244.8.0/21 */, 21, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F41000 /* 37.244.16.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F41300 /* 37.244.19.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F41400 /* 37.244.20.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F41700 /* 37.244.23.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F41800 /* 37.244.24.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F41B00 /* 37.244.27.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F41C00 /* 37.244.28.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F42000 /* 37.244.32.0/20 */, 20, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F43000 /* 37.244.48.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F43200 /* 37.244.50.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F43400 /* 37.244.52.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0x25F43800 /* 37.244.56.0/21 */, 21, NDPI_PROTOCOL_BLIZZARD },
+ { 0x3B992800 /* 59.153.40.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x40E00000 /* 64.224.0.0/21 */, 21, NDPI_PROTOCOL_BLIZZARD },
+ { 0x40E01800 /* 64.224.24.0/21 */, 21, NDPI_PROTOCOL_BLIZZARD },
+ { 0x4228B000 /* 66.40.176.0/21 */, 21, NDPI_PROTOCOL_BLIZZARD },
+ { 0x4228B800 /* 66.40.184.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0x4228BE00 /* 66.40.190.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x67047200 /* 103.4.114.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x67C62000 /* 103.198.32.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x6E2DD000 /* 110.45.208.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x75340600 /* 117.52.6.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x75341A00 /* 117.52.26.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x75341C00 /* 117.52.28.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x75342100 /* 117.52.33.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x75342200 /* 117.52.34.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x75342400 /* 117.52.36.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x79FE8900 /* 121.254.137.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x79FECE00 /* 121.254.206.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x79FEDA00 /* 121.254.218.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x89DD4000 /* 137.221.64.0/19 */, 19, NDPI_PROTOCOL_BLIZZARD },
+ { 0x89DD6000 /* 137.221.96.0/20 */, 20, NDPI_PROTOCOL_BLIZZARD },
+ { 0x89DD7000 /* 137.221.112.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x96740900 /* 150.116.9.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x9E73C000 /* 158.115.192.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0x9E73C400 /* 158.115.196.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0x9E73C700 /* 158.115.199.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0x9E73C800 /* 158.115.200.0/21 */, 21, NDPI_PROTOCOL_BLIZZARD },
+ { 0x9E73D800 /* 158.115.216.0/21 */, 21, NDPI_PROTOCOL_BLIZZARD },
+ { 0xB6A21F00 /* 182.162.31.0/24 */, 24, NDPI_PROTOCOL_BLIZZARD },
+ { 0xB93C7000 /* 185.60.112.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0xC64A2000 /* 198.74.32.0/22 */, 22, NDPI_PROTOCOL_BLIZZARD },
+ { 0xC64A2400 /* 198.74.36.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ { 0xCA094200 /* 202.9.66.0/23 */, 23, NDPI_PROTOCOL_BLIZZARD },
+ /* End */
+ { 0x0, 0, 0 }
+};
+
+static ndpi_network6 ndpi_protocol_blizzard_protocol_list_6[] = {
+ { "2a04:e800:5010::", 47, NDPI_PROTOCOL_BLIZZARD },
+ { "2a04:e800:5016::", 48, NDPI_PROTOCOL_BLIZZARD },
+ { "2a04:e800:5020::", 48, NDPI_PROTOCOL_BLIZZARD },
+ { "2a04:e800:5040::", 48, NDPI_PROTOCOL_BLIZZARD },
+ { "2a04:e800:5407::", 48, NDPI_PROTOCOL_BLIZZARD },
+ { "2a04:e802::", 32, NDPI_PROTOCOL_BLIZZARD },
+ /* End */
+ { NULL, 0, 0 }
+};
diff --git a/src/lib/inc_generated/ndpi_asn_starcraft.c.inc b/src/lib/inc_generated/ndpi_asn_starcraft.c.inc
deleted file mode 100644
index e8b49c000..000000000
--- a/src/lib/inc_generated/ndpi_asn_starcraft.c.inc
+++ /dev/null
@@ -1,94 +0,0 @@
-/*
- *
- * This file is generated automatically and part of nDPI
- *
- * nDPI is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Lesser General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
- *
- * nDPI is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
- *
- */
-
-/* ****************************************************** */
-
-
-static ndpi_network ndpi_protocol_starcraft_protocol_list[] = {
- { 0x052AA000 /* 5.42.160.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT },
- { 0x052AB200 /* 5.42.178.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x18691200 /* 24.105.18.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x18691D00 /* 24.105.29.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x18691E00 /* 24.105.30.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x18692000 /* 24.105.32.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT },
- { 0x18693200 /* 24.105.50.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x18693400 /* 24.105.52.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0x18693800 /* 24.105.56.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x18693C00 /* 24.105.60.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F40000 /* 37.244.0.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F40200 /* 37.244.2.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F40400 /* 37.244.4.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F40800 /* 37.244.8.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F41000 /* 37.244.16.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F41300 /* 37.244.19.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F41400 /* 37.244.20.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F41700 /* 37.244.23.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F41800 /* 37.244.24.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F41B00 /* 37.244.27.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F41C00 /* 37.244.28.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F42000 /* 37.244.32.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F43000 /* 37.244.48.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F43400 /* 37.244.52.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0x25F43800 /* 37.244.56.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT },
- { 0x3B992800 /* 59.153.40.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x40E00000 /* 64.224.0.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT },
- { 0x40E01800 /* 64.224.24.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT },
- { 0x4228B000 /* 66.40.176.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT },
- { 0x4228B800 /* 66.40.184.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0x4228BE00 /* 66.40.190.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x67047200 /* 103.4.114.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x67C62000 /* 103.198.32.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x6E2DD000 /* 110.45.208.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x75340600 /* 117.52.6.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x75341A00 /* 117.52.26.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x75341C00 /* 117.52.28.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x75342100 /* 117.52.33.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x75342200 /* 117.52.34.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x75342400 /* 117.52.36.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x79FE8900 /* 121.254.137.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x79FECE00 /* 121.254.206.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x79FEDA00 /* 121.254.218.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x89DD4000 /* 137.221.64.0/19 */, 19, NDPI_PROTOCOL_STARCRAFT },
- { 0x89DD6000 /* 137.221.96.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT },
- { 0x89DD7000 /* 137.221.112.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x96740900 /* 150.116.9.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x9E73C000 /* 158.115.192.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0x9E73C400 /* 158.115.196.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0x9E73C700 /* 158.115.199.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0x9E73C800 /* 158.115.200.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT },
- { 0x9E73D800 /* 158.115.216.0/21 */, 21, NDPI_PROTOCOL_STARCRAFT },
- { 0xB6A21F00 /* 182.162.31.0/24 */, 24, NDPI_PROTOCOL_STARCRAFT },
- { 0xB93C7000 /* 185.60.112.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0xC64A2000 /* 198.74.32.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT },
- { 0xC64A2400 /* 198.74.36.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- { 0xCA094200 /* 202.9.66.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT },
- /* End */
- { 0x0, 0, 0 }
-};
-
-static ndpi_network6 ndpi_protocol_starcraft_protocol_list_6[] = {
- { "2a04:e800:5010::", 47, NDPI_PROTOCOL_STARCRAFT },
- { "2a04:e800:5016::", 48, NDPI_PROTOCOL_STARCRAFT },
- { "2a04:e800:5020::", 48, NDPI_PROTOCOL_STARCRAFT },
- { "2a04:e800:5040::", 48, NDPI_PROTOCOL_STARCRAFT },
- { "2a04:e800:5407::", 48, NDPI_PROTOCOL_STARCRAFT },
- { "2a04:e802::", 32, NDPI_PROTOCOL_STARCRAFT },
- /* End */
- { NULL, 0, 0 }
-};
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 9595622d8..e8efc8d70 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -484,6 +484,19 @@ static ndpi_protocol_match host_match[] =
{ "e1800.d.akamaiedge.net", "Playstation", NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
{ "e1879.e7.akamaiedge.net", "Playstation", NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "battle.net", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "blizzard.com", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "bnetaccount.akamaized.net", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "blz-contentstack-images.akamaized.net", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "blz-contentstack-assets.akamaized.net", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "blzprofile.akamaized.net", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "bnetstorefront.akamaized.net", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "bnetcmsus-a.akamaihd.net", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "blizzard-api.arkoselabs.com", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "starcraft2.com", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "blzstatic.com", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+ { "images.blz-contentstack.com", "Blizzard", NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
+
{ "cnn.com", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DEFAULT_LEVEL },
{ "cnn.net", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DEFAULT_LEVEL },
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 6a715dd16..2b3ef6e44 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -100,7 +100,7 @@
#include "inc_generated/ndpi_asn_tencent.c.inc"
#include "inc_generated/ndpi_asn_opendns.c.inc"
#include "inc_generated/ndpi_asn_dropbox.c.inc"
-#include "inc_generated/ndpi_asn_starcraft.c.inc"
+#include "inc_generated/ndpi_asn_blizzard.c.inc"
#include "inc_generated/ndpi_asn_ubuntuone.c.inc"
#include "inc_generated/ndpi_asn_twitch.c.inc"
#include "inc_generated/ndpi_asn_hotspotshield.c.inc"
@@ -1788,8 +1788,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"VHUA", NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_QOE_CATEGORY_VOIP_CALLS,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 58267, 0, 0, 0, 0)); /* UDP */
- ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_STARCRAFT,
- "Starcraft", NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_QOE_CATEGORY_ONLINE_GAMING,
+ ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_BLIZZARD,
+ "Blizzard", NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_QOE_CATEGORY_ONLINE_GAMING,
ndpi_build_default_ports(ports_a, 1119, 0, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 1119, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_UBNTAC2,
@@ -3829,9 +3829,9 @@ int ndpi_finalize_initialization(struct ndpi_detection_module_struct *ndpi_str)
ndpi_init_ptree_ipv4(ndpi_str->protocols->v4, ndpi_protocol_dropbox_protocol_list);
ndpi_init_ptree_ipv6(ndpi_str, ndpi_str->protocols->v6, ndpi_protocol_dropbox_protocol_list_6);
}
- if(is_ip_list_enabled(ndpi_str, NDPI_PROTOCOL_STARCRAFT)) {
- ndpi_init_ptree_ipv4(ndpi_str->protocols->v4, ndpi_protocol_starcraft_protocol_list);
- ndpi_init_ptree_ipv6(ndpi_str, ndpi_str->protocols->v6, ndpi_protocol_starcraft_protocol_list_6);
+ if(is_ip_list_enabled(ndpi_str, NDPI_PROTOCOL_BLIZZARD)) {
+ ndpi_init_ptree_ipv4(ndpi_str->protocols->v4, ndpi_protocol_blizzard_protocol_list);
+ ndpi_init_ptree_ipv6(ndpi_str, ndpi_str->protocols->v6, ndpi_protocol_blizzard_protocol_list_6);
}
if(is_ip_list_enabled(ndpi_str, NDPI_PROTOCOL_UBUNTUONE)) {
ndpi_init_ptree_ipv4(ndpi_str->protocols->v4, ndpi_protocol_ubuntuone_protocol_list);
@@ -5637,8 +5637,8 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) {
/* HTTP */
init_http_dissector(ndpi_str, &a);
- /* STARCRAFT */
- init_starcraft_dissector(ndpi_str, &a);
+ /* BLIZZARD */
+ init_blizzard_dissector(ndpi_str, &a);
/* TLS+DTLS */
init_tls_dissector(ndpi_str, &a);
diff --git a/src/lib/protocols/blizzard.c b/src/lib/protocols/blizzard.c
new file mode 100644
index 000000000..8bb6ec305
--- /dev/null
+++ b/src/lib/protocols/blizzard.c
@@ -0,0 +1,115 @@
+/*
+* blizzard.c
+*
+* Copyright (C) 2015 - Matteo Bracci <matteobracci1@gmail.com>
+* Copyright (C) 2015-22 - ntop.org
+*
+* nDPI is free software: you can redistribute it and/or modify
+* it under the terms of the GNU Lesser General Public License as published by
+* the Free Software Foundation, either version 3 of the License, or
+* (at your option) any later version.
+*
+* nDPI is distributed in the hope that it will be useful,
+* but WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+* GNU Lesser General Public License for more details.
+*
+* You should have received a copy of the GNU Lesser General Public License
+* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+*
+*/
+
+#include "ndpi_protocol_ids.h"
+
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_BLIZZARD
+
+#include "ndpi_api.h"
+#include "ndpi_private.h"
+
+
+static void search_blizzard_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ struct ndpi_packet_struct* packet = &ndpi_struct->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search Blizzard\n");
+
+ /* Generic Battle.net traffic */
+ if(flow->guessed_protocol_id_by_ip == NDPI_PROTOCOL_BLIZZARD &&
+ flow->s_port == htons(1119)) {
+ /* Looking for the first pkt sent by the client.
+ Sometimes the server sent a packet earlier */
+ if(current_pkt_from_client_to_server(ndpi_struct, flow)) {
+ if(ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "\x41\x00\x00\x0a\x66\x52\xed\xc6")) {
+ NDPI_LOG_INFO(ndpi_struct, "Found Blizzard\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+ return;
+ }
+ } else if(flow->packet_direction_counter[packet->packet_direction] == 1) {
+ return;
+ }
+ }
+
+ /* Pattern found on Hearthstone */
+ if(packet->payload_packet_len >= 8 &&
+ le32toh(*(uint32_t *)&packet->payload[4]) == (u_int32_t)(packet->payload_packet_len - 8)) {
+ NDPI_LOG_INFO(ndpi_struct, "Found Blizzard\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+ return;
+ }
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+static void search_blizzard_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ struct ndpi_packet_struct* packet = &ndpi_struct->packet;
+
+ NDPI_LOG_DBG(ndpi_struct, "search Blizzard\n");
+
+ /* Patterns found on Warcraft Rumble */
+
+ /* The last bytes are some kind of sequence number, always starting from 1 */
+ if(/* First pkt send by the client */
+ (packet->payload_packet_len == 18 &&
+ le32toh(*(uint32_t *)&packet->payload[14]) == 1) ||
+ /* First pkt send by the server */
+ (packet->payload_packet_len == 15 &&
+ packet->payload[14] == 1)) {
+ NDPI_LOG_INFO(ndpi_struct, "Found Blizzard\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+ return;
+ }
+ /* First pkt send by the client */
+ if(packet->payload_packet_len == 23 &&
+ ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "\xff\xff\xff\xff\xa3\x1f\xb6\x1e\x00\x00\x40\x01\x00\x00\x00\x00\x00\x00\x00\x04\x03\x02\x01")) {
+ NDPI_LOG_INFO(ndpi_struct, "Found Blizzard\n");
+ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BLIZZARD, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
+ return;
+ }
+
+ /* TODO: other patterns */
+
+ /* TODO: should we remove WoW dissector, update it and move the new code here? */
+
+ NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+}
+
+static void ndpi_search_blizzard(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
+{
+ if(flow->l4_proto == IPPROTO_TCP)
+ search_blizzard_tcp(ndpi_struct, flow);
+ else
+ search_blizzard_udp(ndpi_struct, flow);
+}
+
+void init_blizzard_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
+{
+ ndpi_set_bitmask_protocol_detection("Blizzard", ndpi_struct, *id,
+ NDPI_PROTOCOL_BLIZZARD, ndpi_search_blizzard,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+ ADD_TO_DETECTION_BITMASK);
+
+ *id += 1;
+}
+
diff --git a/src/lib/protocols/starcraft.c b/src/lib/protocols/starcraft.c
deleted file mode 100644
index 9e87ea2c8..000000000
--- a/src/lib/protocols/starcraft.c
+++ /dev/null
@@ -1,159 +0,0 @@
-/*
-* starcraft.c
-*
-* Copyright (C) 2015 - Matteo Bracci <matteobracci1@gmail.com>
-* Copyright (C) 2015-22 - ntop.org
-*
-* nDPI is free software: you can redistribute it and/or modify
-* it under the terms of the GNU Lesser General Public License as published by
-* the Free Software Foundation, either version 3 of the License, or
-* (at your option) any later version.
-*
-* nDPI is distributed in the hope that it will be useful,
-* but WITHOUT ANY WARRANTY; without even the implied warranty of
-* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-* GNU Lesser General Public License for more details.
-*
-* You should have received a copy of the GNU Lesser General Public License
-* along with nDPI. If not, see <http://www.gnu.org/licenses/>.
-*
-*/
-
-#include "ndpi_protocol_ids.h"
-
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_STARCRAFT
-
-#include "ndpi_api.h"
-#include "ndpi_private.h"
-
-
-/* Sender or receiver are one of the known login portals? */
-static u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet)
-{
- if (packet->iph == NULL)
- return 0;
-
- u_int32_t source_ip = ntohl(packet->iph->saddr);
- u_int32_t dest_ip = ntohl(packet->iph->daddr);
- return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130
- || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130
- || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130
- || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76
- || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254
-}
-
-/*
- The main TCP flow starts with the user login and stays alive until the logout.
- Although hard to read, judging from what happens elsewhere this flow probably contains all the data
- transfer generated by the user interaction with the client, e.g. chatting or looking at someone's
- match history. The current way to detect this is plain dumb packet matching.
-*/
-static u_int8_t ndpi_check_starcraft_tcp(struct ndpi_detection_module_struct* ndpi_struct)
-{
- struct ndpi_packet_struct* packet = &ndpi_struct->packet;
-
- if (sc2_match_logon_ip(packet)
- && packet->tcp->dest == htons(1119) //bnetgame port
- && (ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")
- || ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66")))
- return 1;
- else
- return -1;
-}
-
-/*
- UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the
- real key point here is to make sure that it's actually Starcraft 2 that is using the port and not
- some other Blizzard software.
- The flow is taken if a pattern in the size of some subsequent packets is found.
-*/
-static u_int8_t ndpi_check_starcraft_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- struct ndpi_packet_struct* packet = &ndpi_struct->packet;
-
- /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */
- if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119))
- return -1;
-
- /* Then try to detect the size pattern */
- switch (flow->starcraft_udp_stage)
- {
- case 0:
- if (packet->payload_packet_len == 20)
- flow->starcraft_udp_stage = 1;
- break;
- case 1:
- if (packet->payload_packet_len == 20)
- flow->starcraft_udp_stage = 2;
- break;
- case 2:
- if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85)
- flow->starcraft_udp_stage = 3;
- break;
- case 3:
- if (packet->payload_packet_len == 20)
- flow->starcraft_udp_stage = 4;
- break;
- case 4:
- if (packet->payload_packet_len == 548)
- flow->starcraft_udp_stage = 5;
- break;
- case 5:
- if (packet->payload_packet_len == 548)
- flow->starcraft_udp_stage = 6;
- break;
- case 6:
- if (packet->payload_packet_len == 548)
- flow->starcraft_udp_stage = 7;
- break;
- case 7:
- if (packet->payload_packet_len == 484)
- return 1;
- break;
- }
-
- return(0);
-}
-
-static void ndpi_search_starcraft(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow)
-{
- struct ndpi_packet_struct* packet = &ndpi_struct->packet;
-
- NDPI_LOG_DBG(ndpi_struct, "search Starcraft\n");
- if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT) {
- int8_t result = 0;
-
- if (packet->udp != NULL) {
- result = ndpi_check_starcraft_udp(ndpi_struct, flow);
- if (result == 1) {
- NDPI_LOG_INFO(ndpi_struct, "Found Starcraft 2 [Game, UDP]\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
- return;
- }
- }
- else if (packet->tcp != NULL) {
- result = ndpi_check_starcraft_tcp(ndpi_struct);
- if (result == 1) {
- NDPI_LOG_INFO(ndpi_struct, "Found Starcraft 2 [Client, TCP]\n");
- ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
- return;
- }
- }
-
- if (result == -1) {
- NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
- }
- }
-}
-
-void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id)
-{
- ndpi_set_bitmask_protocol_detection("Starcraft", ndpi_struct, *id,
- NDPI_PROTOCOL_STARCRAFT, ndpi_search_starcraft,
- NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
- SAVE_DETECTION_BITMASK_AS_UNKNOWN,
- ADD_TO_DETECTION_BITMASK);
-
- *id += 1;
-}
-
Powered by cgit, Themed by Ted Yin.