diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/armagetron.c | 42 |
1 files changed, 8 insertions, 34 deletions
diff --git a/src/lib/protocols/armagetron.c b/src/lib/protocols/armagetron.c index 4ec5d5ec1..60684c6be 100644 --- a/src/lib/protocols/armagetron.c +++ b/src/lib/protocols/armagetron.c @@ -42,56 +42,30 @@ static void ndpi_search_armagetron_udp(struct ndpi_detection_module_struct *ndpi NDPI_LOG_DBG(ndpi_struct, "search armagetron\n"); - if (packet->payload_packet_len > 10) { + if (packet->payload_packet_len >= 8) { /* login request */ if (get_u_int32_t(packet->payload, 0) == htonl(0x000b0000)) { const u_int16_t dataLength = ntohs(get_u_int16_t(packet->payload, 4)); - if (dataLength == 0 || dataLength * 2 + 8 != packet->payload_packet_len) - goto exclude; - if (get_u_int16_t(packet->payload, 6) == htons(0x0008) - && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { + if (dataLength * 2 + 8 == packet->payload_packet_len && + get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { NDPI_LOG_INFO(ndpi_struct, "found armagetron\n"); ndpi_int_armagetron_add_connection(ndpi_struct, flow); return; } } - /* sync_msg */ - if (packet->payload_packet_len == 16 && get_u_int16_t(packet->payload, 0) == htons(0x001c) - && get_u_int16_t(packet->payload, 2) != 0) { + /* big_server/big_request */ + if (get_u_int32_t(packet->payload, 0) == htonl(0x00330000) || + get_u_int32_t(packet->payload, 0) == htonl(0x00350000)) { const u_int16_t dataLength = ntohs(get_u_int16_t(packet->payload, 4)); - if (dataLength != 4) - goto exclude; - if (get_u_int32_t(packet->payload, 6) == htonl(0x00000500) && get_u_int32_t(packet->payload, 6 + 4) == htonl(0x00010000) - && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { + if (dataLength * 2 + 8 == packet->payload_packet_len && + get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { NDPI_LOG_INFO(ndpi_struct, "found armagetron\n"); ndpi_int_armagetron_add_connection(ndpi_struct, flow); return; } } - - /* net_sync combination */ - if (packet->payload_packet_len > 50 && get_u_int16_t(packet->payload, 0) == htons(0x0018) - && get_u_int16_t(packet->payload, 2) != 0) { - u_int16_t val; - const u_int16_t dataLength = ntohs(get_u_int16_t(packet->payload, 4)); - if (dataLength == 0 || dataLength * 2 + 8 > packet->payload_packet_len) - goto exclude; - val = get_u_int16_t(packet->payload, 6 + 2); - if (val == get_u_int16_t(packet->payload, 6 + 6)) { - val = ntohs(get_u_int16_t(packet->payload, 6 + 8)); - if ((6 + 10 + val + 4) < packet->payload_packet_len - && (get_u_int32_t(packet->payload, 6 + 10 + val) == htonl(0x00010000) - || get_u_int32_t(packet->payload, 6 + 10 + val) == htonl(0x00000001)) - && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { - NDPI_LOG_INFO(ndpi_struct, "found armagetron\n"); - ndpi_int_armagetron_add_connection(ndpi_struct, flow); - return; - } - } - } } - exclude: NDPI_EXCLUDE_PROTO(ndpi_struct, flow); } |