From e7f1946ae72121c0f0c03cdbf12248464239c73c Mon Sep 17 00:00:00 2001 From: Vladimir Gavrilov <105977161+0xA50C1A1@users.noreply.github.com> Date: Tue, 5 Mar 2024 13:00:52 +0300 Subject: Add NetEase Games detection support (#2335) --- src/include/ndpi_private.h | 2 +- src/include/ndpi_protocol_ids.h | 2 +- src/lib/ndpi_content_match.c.inc | 4 +- src/lib/ndpi_main.c | 8 ++-- src/lib/protocols/naraka.c | 60 -------------------------- src/lib/protocols/netease_games.c | 90 +++++++++++++++++++++++++++++++++++++++ 6 files changed, 99 insertions(+), 67 deletions(-) delete mode 100644 src/lib/protocols/naraka.c create mode 100644 src/lib/protocols/netease_games.c (limited to 'src') diff --git a/src/include/ndpi_private.h b/src/include/ndpi_private.h index cd955741c..43f975626 100644 --- a/src/include/ndpi_private.h +++ b/src/include/ndpi_private.h @@ -910,7 +910,7 @@ void init_gaijin_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_i void init_c1222_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_dlep_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); void init_bfd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); -void init_naraka_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); +void init_netease_games_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id); #endif diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 8ea516a7e..102439351 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -430,7 +430,7 @@ typedef enum { NDPI_PROTOCOL_HUAWEI_CLOUD = 399, NDPI_PROTOCOL_DLEP = 400, NDPI_PROTOCOL_BFD = 401, - NDPI_PROTOCOL_NARAKA = 402, + NDPI_PROTOCOL_NETEASE_GAMES = 402, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 69e542884..ac4628ab3 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -1618,9 +1618,11 @@ static ndpi_protocol_match host_match[] = { "hicloud.com", "HuaweiCloud", NDPI_PROTOCOL_HUAWEI_CLOUD, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "dbankcloud.com", "HuaweiCloud", NDPI_PROTOCOL_HUAWEI_CLOUD, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "dbankcloud.cn", "HuaweiCloud", NDPI_PROTOCOL_HUAWEI_CLOUD, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, - { "dbankcdn.com", "HuaweiCloud", NDPI_PROTOCOL_HUAWEI_CLOUD, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "dbankcdn.com", "HuaweiCloud", NDPI_PROTOCOL_HUAWEI_CLOUD, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "myhuaweicloud.com", "HuaweiCloud", NDPI_PROTOCOL_HUAWEI_CLOUD, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "easebar.com", "NetEaseGames", NDPI_PROTOCOL_NETEASE_GAMES, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, + #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_content_match_host_match.c.inc" #endif diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index e0a330768..28301b414 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -2250,8 +2250,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "BFD", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 3784, 3785, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_NARAKA, - "NarakaBladepoint", NDPI_PROTOCOL_CATEGORY_GAME, + ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_NETEASE_GAMES, + "NetEaseGames", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); @@ -6082,8 +6082,8 @@ static int ndpi_callback_init(struct ndpi_detection_module_struct *ndpi_str) { /* Bidirectional Forwarding Detection */ init_bfd_dissector(ndpi_str, &a); - /* Naraka: Bladepoint */ - init_naraka_dissector(ndpi_str, &a); + /* NetEase Games */ + init_netease_games_dissector(ndpi_str, &a); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main_init.c" diff --git a/src/lib/protocols/naraka.c b/src/lib/protocols/naraka.c deleted file mode 100644 index 97479e6d0..000000000 --- a/src/lib/protocols/naraka.c +++ /dev/null @@ -1,60 +0,0 @@ -/* - * naraka.c - * - * Copyright (C) 2024 - ntop.org - * Copyright (C) 2024 - V.G - * - * This file is part of nDPI, an open source deep packet inspection - * library based on the OpenDPI and PACE technology by ipoque GmbH - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see . - * - */ - -#include "ndpi_protocol_ids.h" - -#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_NARAKA - -#include "ndpi_api.h" -#include "ndpi_private.h" - -static void ndpi_search_naraka(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow) -{ - struct ndpi_packet_struct const * const packet = &ndpi_struct->packet; - - if (packet->payload_packet_len > 30 && - le32toh(get_u_int32_t(packet->payload, 0)) == 0x0C080807) - { - NDPI_LOG_INFO(ndpi_struct, "found Naraka Bladepoint\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NARAKA, - NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); - return; - } - - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); -} - -void init_naraka_dissector(struct ndpi_detection_module_struct *ndpi_struct, - u_int32_t *id) -{ - ndpi_set_bitmask_protocol_detection("NarakaBladepoint", ndpi_struct, *id, - NDPI_PROTOCOL_NARAKA, - ndpi_search_naraka, - NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, - SAVE_DETECTION_BITMASK_AS_UNKNOWN, - ADD_TO_DETECTION_BITMASK); - - *id += 1; -} diff --git a/src/lib/protocols/netease_games.c b/src/lib/protocols/netease_games.c new file mode 100644 index 000000000..4c974e62f --- /dev/null +++ b/src/lib/protocols/netease_games.c @@ -0,0 +1,90 @@ +/* + * netease_games.c + * + * Copyright (C) 2024 - ntop.org + * Copyright (C) 2024 - V.G + * + * This file is part of nDPI, an open source deep packet inspection + * library based on the OpenDPI and PACE technology by ipoque GmbH + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see . + * + */ + +#include "ndpi_protocol_ids.h" + +#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_NETEASE_GAMES + +#include "ndpi_api.h" +#include "ndpi_private.h" + +static void ndpi_int_netease_add_connection(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + NDPI_LOG_INFO(ndpi_struct, "found NetEase Games\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NETEASE_GAMES, + NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); +} + +static void ndpi_search_netease(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow) +{ + struct ndpi_packet_struct const * const packet = &ndpi_struct->packet; + + /* I've seen this pattern in traffic of few games from + * NetEase (Lost Light, Badlanders, Naraka: Bladepoint) */ + + if (packet->payload_packet_len == 12 && + current_pkt_from_client_to_server(ndpi_struct, flow) && + packet->payload[0] == 0x01 && + le16toh(get_u_int16_t(packet->payload, 2)) == 0x1D0 && + le32toh(get_u_int32_t(packet->payload, 8)) == 0x1010100) + { + ndpi_int_netease_add_connection(ndpi_struct, flow); + return; + } + + /* Lost Light */ + if (packet->payload_packet_len >= 30 && + ntohl(get_u_int32_t(packet->payload, 0)) == 0xB3AF8DE8) + { + ndpi_int_netease_add_connection(ndpi_struct, flow); + return; + } + + /* Naraka: Bladepoint */ + if (packet->payload_packet_len > 30 && + le32toh(get_u_int32_t(packet->payload, 0)) == 0x0C080807) + { + ndpi_int_netease_add_connection(ndpi_struct, flow); + return; + } + + /* TODO: add more NetEase Games signatures */ + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); +} + +void init_netease_games_dissector(struct ndpi_detection_module_struct *ndpi_struct, + u_int32_t *id) +{ + ndpi_set_bitmask_protocol_detection("NetEaseGames", ndpi_struct, *id, + NDPI_PROTOCOL_NETEASE_GAMES, + ndpi_search_netease, + NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, + SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + + *id += 1; +} -- cgit v1.2.3