/*
 * msn.c
 *
 * Copyright (C) 2009-2011 by ipoque GmbH
 * Copyright (C) 2011-18 - ntop.org
 *
 * This file is part of nDPI, an open source deep packet inspection
 * library based on the OpenDPI and PACE technology by ipoque GmbH
 *
 * nDPI is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * nDPI is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include "ndpi_protocol_ids.h"

#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_MSN

#include "ndpi_api.h"

#define MAX_PACKETS_FOR_MSN 100

static void ndpi_int_msn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MSN);
}

static u_int8_t ndpi_int_find_xmsn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
    struct ndpi_packet_struct *packet = &flow->packet;

    if(packet->parsed_lines > 3) {
        u_int16_t i;
        for(i = 2; i < packet->parsed_lines; i++) {
            if(packet->line[i].ptr != NULL && packet->line[i].len > NDPI_STATICSTRING_LEN("X-MSN") &&
                    memcmp(packet->line[i].ptr, "X-MSN", NDPI_STATICSTRING_LEN("X-MSN")) == 0) {
                return 1;
            }
        }
    }
    return 0;
}

/* search over TCP */
static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
    struct ndpi_packet_struct *packet = &flow->packet;

    struct ndpi_id_struct *src = flow->src;
    struct ndpi_id_struct *dst = flow->dst;

    u_int16_t plen;
    u_int16_t status = 0;

    if(packet->detected_protocol == NDPI_PROTOCOL_SSL) {

        NDPI_LOG_DBG2(ndpi_struct, "msn ssl ft test\n");

        if(flow->packet_counter < 10) {
            if(flow->packet_counter == 7 && packet->payload_packet_len > 300) {
                if(memcmp(packet->payload + 24, "MSNSLP", 6) == 0
                        || (get_u_int32_t(packet->payload, 0) == htonl(0x30000000)
                            && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
                    NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer, ifdef ssl\n");
                    ndpi_int_msn_add_connection(ndpi_struct, flow);
                    return;
                }
            }

            if(flow->packet_counter >= 5 && flow->packet_counter <= 10
                    && (get_u_int32_t(packet->payload, 0) == htonl(0x18000000)
                        && get_u_int32_t(packet->payload, 4) == 0x00000000)) {
                flow->l4.tcp.msn_ssl_ft++;
                NDPI_LOG_DBG2(ndpi_struct,
                        "increased msn ft ssl stage to: %u at packet nr: %u\n",
                        flow->l4.tcp.msn_ssl_ft,
                        flow->packet_counter);
                if (flow->l4.tcp.msn_ssl_ft == 2) {
                    NDPI_LOG_INFO(ndpi_struct,
                            "found MSN File Transfer, ifdef ssl 2.\n");
                    ndpi_int_msn_add_connection(ndpi_struct, flow);
                }

                return;
            }
        }
    }

    /* we detect the initial connection only ! */
    /* match: "VER " ..... "CVR" x 0x0d 0x0a
     * len should be small, lets say less than 100 bytes
     * x is now "0", but can be increased
     */
    /* now we have a look at the first packet only. */
    if(flow->packet_counter == 1
            || ((packet->detected_protocol == NDPI_PROTOCOL_SSL)
                && flow->packet_counter <= 3)
      ) {

        /* this part is working asymmetrically */
        if(packet->payload_packet_len > 32
                && (packet->payload[0] == 0x02 || packet->payload[0] == 0x00)
                && (ntohl(get_u_int32_t(packet->payload, 8)) == 0x2112a442
                    || ntohl(get_u_int32_t(packet->payload, 4)) == 0x2112a442)
                && ((ntohl(get_u_int32_t(packet->payload, 24)) == 0x000f0004
                        && ntohl(get_u_int32_t(packet->payload, 28)) == 0x72c64bc6)
                    || (ntohl(get_u_int32_t(packet->payload, 20)) == 0x000f0004
                        && ntohl(get_u_int32_t(packet->payload, 24)) == 0x72c64bc6))) {
            NDPI_LOG_INFO(ndpi_struct,
                    "found MSN in packets that also contain voice.messenger.live.com.\n");

            /* TODO this is an alternative pattern for video detection */
            /*          if (packet->payload_packet_len > 100 &&
                        get_u_int16_t(packet->payload, 86) == htons(0x05dc)) { */
            ndpi_int_msn_add_connection(ndpi_struct, flow);
            return;
        }

        /* this case works asymmetrically */
        if (packet->payload_packet_len > 10 && packet->payload_packet_len < 100) {
            if (get_u_int8_t(packet->payload, packet->payload_packet_len - 2) == 0x0d
                    && get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x0a) {
                /* The MSNP string is used in XBOX clients. */
                if (ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "VER ")) {

                    if (memcmp(&packet->payload[packet->payload_packet_len - 6], "CVR",
                                3) == 0 || memcmp(&packet->payload[packet->payload_packet_len - 8], "MSNP", 4) == 0) {
                        NDPI_LOG_INFO(ndpi_struct, "found MSN by pattern VER...CVR/MSNP ODOA\n");
                        ndpi_int_msn_add_connection(ndpi_struct, flow);
                        return;
                    }
                    if (ndpi_match_strprefix(&packet->payload[4], packet->payload_packet_len-4, "MSNFT")) {
                        NDPI_LOG_INFO(ndpi_struct, "found MSN FT by pattern VER MSNFT...0d0a\n");
                        ndpi_int_msn_add_connection(ndpi_struct, flow);
                        return;
                    }
                }
            }
        }

        if(
                packet->detected_protocol == NDPI_PROTOCOL_HTTP ||
                ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "GET ") ||
                ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "POST ")) {
            ndpi_parse_packet_line_info(ndpi_struct, flow);
            if (packet->user_agent_line.ptr != NULL &&
                    packet->user_agent_line.len > NDPI_STATICSTRING_LEN("Messenger/") &&
                    memcmp(packet->user_agent_line.ptr, "Messenger/", NDPI_STATICSTRING_LEN("Messenger/")) == 0) {
                NDPI_LOG_INFO(ndpi_struct, "found MSN Messenger/\n");
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                return;
            }
        }

        /* not seen this pattern in any trace */
        /* now test for http login, at least 100 a bytes packet */
        if(packet->payload_packet_len > 100) {
            if(
                    packet->detected_protocol == NDPI_PROTOCOL_HTTP ||
                    memcmp(packet->payload, "POST http://", 12) == 0) {
                /* scan packet if not already done... */
                ndpi_parse_packet_line_info(ndpi_struct, flow);

                if(packet->content_line.ptr != NULL &&
                        ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
                          memcmp(packet->content_line.ptr, "application/x-msn-messenger",
                              NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
                         (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
                          memcmp(packet->content_line.ptr, "text/x-msnmsgr",
                              NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {
                    NDPI_LOG_INFO(ndpi_struct, "found MSN POST application/x-msn-messenger\n");
                    ndpi_int_msn_add_connection(ndpi_struct, flow);
                    return;
                }
            }
        }
        /* now test for http login that uses a gateway, at least 400 a bytes packet */
        /* for this case the asymmetric detection is asym (1) */
        if(packet->payload_packet_len > 400) {
            if((
                        packet->detected_protocol == NDPI_PROTOCOL_HTTP ||
                        memcmp(packet->payload, "POST ", 5) == 0)) {
                u_int16_t c;
                if(memcmp(&packet->payload[5], "http://", 7) == 0) {
                    /*
                     * We are searching for a pattern "POST http://gateway.messenger.hotmail.com/gateway/gateway.dll" or
                     * "POST http://<some ip address here like 172.0.0.0>/gateway/gateway.dll"
                     * POST http:// is 12 byte so we are searching for 13 to 70 byte for this paten.
                     */
                    for(c = 13; c < 50; c++) {
                        if(memcmp(&packet->payload[c], "/", 1) == 0) {
                            if(memcmp(&packet->payload[c], "/gateway/gateway.dll", 20) == 0) {
                                NDPI_LOG_DBG2(ndpi_struct, "found  pattern http://.../gateway/gateway.ddl\n");
                                status = 1;
                                break;
                            }
                        }
                    }
                } else if((memcmp(&packet->payload[5], "/gateway/gateway.dll", 20) == 0)) {
                    NDPI_LOG_DBG2(ndpi_struct, "found  pattern http://.../gateway/gateway.ddl\n");
                    status = 1;
                }
            }
            if(status) {
                u_int16_t a;

                ndpi_parse_packet_line_info(ndpi_struct, flow);

                if(packet->content_line.ptr != NULL && ((packet->content_line.len == 23
                                && memcmp(packet->content_line.ptr, "text/xml; charset=utf-8", 23) == 0)
                            ||
                            (packet->content_line.len == 24
                             && memcmp(packet->content_line.ptr, "text/html; charset=utf-8", 24) == 0)
                            ||
                            (packet->content_line.len == 33
                             && memcmp(packet->content_line.ptr, "application/x-www-form-urlencoded", 33) == 0))) {

                    if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
                            || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {

                        NDPI_LOG_INFO(ndpi_struct, "found MSN with pattern text/xml; charset=utf-8\n");
                        ndpi_int_msn_add_connection(ndpi_struct, flow);
                        return;
                    }
                    for(a = 0; a < packet->parsed_lines; a++) {
                        if(packet->line[a].len >= 4 && (memcmp(packet->line[a].ptr, "CVR ", 4) == 0
                                    || memcmp(packet->line[a].ptr, "VER ", 4) == 0 ||
                                    memcmp(packet->line[a].ptr, "ANS ", 4) == 0)) {

                            NDPI_LOG_DBG2(ndpi_struct, "found MSN with pattern text/sml; charset0utf-8\n");
                            NDPI_LOG_INFO(ndpi_struct, "found MSN xml CVS / VER / ANS found\n");
                            ndpi_int_msn_add_connection(ndpi_struct, flow);
                            return;
                        }
                    }
                }
            }
        }
        /* asym (1) ; possibly occurs in symmetric cases also. */
        if(flow->packet_counter <= 10 &&
                (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2)
                && packet->payload_packet_len > 100) {
            /* not necessary to check the length, because this has been done : >400. */
            if(
                    packet->detected_protocol == NDPI_PROTOCOL_HTTP ||
                    ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.0 200 OK") ||
                    ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.1 200 OK")
              ) {

                ndpi_parse_packet_line_info(ndpi_struct, flow);

                if(packet->content_line.ptr != NULL &&
                        ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
                          memcmp(packet->content_line.ptr, "application/x-msn-messenger", NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
                         (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
                          memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {

                    NDPI_LOG_INFO(ndpi_struct,
                            "found MSN  application/x-msn-messenger.\n");
                    ndpi_int_msn_add_connection(ndpi_struct, flow);
                    return;
                }
                if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
                    NDPI_LOG_INFO(ndpi_struct, "found MSN X-MSN\n");
                    ndpi_int_msn_add_connection(ndpi_struct, flow);
                    return;
                }
            }
        }
        /* did not find any trace with this pattern */
        /* now block proxy connection */
        if(packet->payload_packet_len >= 42) {
            if(memcmp(packet->payload, "CONNECT messenger.hotmail.com:1863 HTTP/1.", 42) == 0) {
                NDPI_LOG_INFO(ndpi_struct, "found MSN  with pattern CONNECT messenger.hotmail.com:1863 HTTP/1.\n");
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                return;
            }
        }
        if (packet->payload_packet_len >= 18) {

            if (memcmp(packet->payload, "USR ", 4) == 0 || memcmp(packet->payload, "ANS ", 4) == 0) {
                /* now we must see a number */
                const u_int16_t endlen = packet->payload_packet_len - 12;
                plen = 4;
                while (1) {
                    if (packet->payload[plen] == ' ') {
                        break;
                    }
                    if (packet->payload[plen] < '0' || packet->payload[plen] > '9') {
                        goto ndpi_msn_exclude;
                    }
                    plen++;
                    if (plen >= endlen) {
                        goto ndpi_msn_exclude;
                    }
                }

                while (plen < endlen) {
                    if (ndpi_check_for_email_address(ndpi_struct, flow, plen) != 0) {
                        NDPI_LOG_DBG2(ndpi_struct, "found mail address\n");
                        break;
                    }
                    if (packet->payload_packet_len > plen + 1
                            && (packet->payload[plen] < 20 || packet->payload[plen] > 128)) {
                        goto ndpi_msn_exclude;
                    }
                    plen++;
                    if (plen >= endlen) {
                        goto ndpi_msn_exclude;
                    }
                }
                NDPI_LOG_INFO(ndpi_struct, "found MSN  with pattern USR/ANS ...mail_address\n");
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                return;
            }
        }
        }
        /* finished examining the first packet only. */

        /* asym (1) ; possibly occurs in symmetric cases also. */
        if(flow->packet_counter <= 10 &&
                (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2) &&
                packet->payload_packet_len > 100) {
            /* not necessary to check the length, because this has been done : >400. */
            if(
                    packet->detected_protocol == NDPI_PROTOCOL_HTTP ||
                    (memcmp(packet->payload, "HTTP/1.0 200 OK", 15) == 0) ||
                    (memcmp(packet->payload, "HTTP/1.1 200 OK", 15) == 0)) {

                ndpi_parse_packet_line_info(ndpi_struct, flow);

                if(packet->content_line.ptr != NULL && ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") &&
                                memcmp(packet->content_line.ptr, "application/x-msn-messenger",
                                    NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) ||
                            (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") &&
                             memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) {

                    NDPI_LOG_INFO(ndpi_struct, "found MSN application/x-msn-messenger\n");
                    ndpi_int_msn_add_connection(ndpi_struct, flow);
                    return;
                }
                if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) {
                    NDPI_LOG_INFO(ndpi_struct, "found MSN X-MSN\n");
                    ndpi_int_msn_add_connection(ndpi_struct, flow);
                    return;
                }
            }
        }
        /* finished examining the second packet only */
        /* direct user connection (file transfer,...) */

        if((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)
                || (dst != NULL
                    && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) {
            if (flow->packet_counter == 1 &&
                    packet->payload_packet_len > 12 && memcmp(packet->payload, "recipientid=", 12) == 0) {
                NDPI_LOG_INFO(ndpi_struct, "found MSN file transfer\n");
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                return;
            }
        }
        /* MSN File Transfer of MSN 8.1 and 8.5
         * first packet with length 4 and pattern 0x04000000
         * second packet (in the same direction), with length 56 and pattern 0x00000000 from payload[16]
         * third packet (in the opposite direction to 1 & 2), with length 4 and pattern 0x30000000
         */
        if(flow->l4.tcp.msn_stage == 0) {
            /* asymmetric detection to this pattern is asym (2) */
            if((packet->payload_packet_len == 4 || packet->payload_packet_len == 8)
                    && get_u_int32_t(packet->payload, 0) == htonl(0x04000000)) {

                NDPI_LOG_DBG2(ndpi_struct, "maybe first TCP MSN detected\n");

                if(packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 4) == htonl(0x666f6f00)) {
                    flow->l4.tcp.msn_stage = 5 + packet->packet_direction;
                    return;
                }
                flow->l4.tcp.msn_stage = 1 + packet->packet_direction;
                return;
            }
            /* asymmetric detection to this pattern is asym (2) */
        } else if (flow->l4.tcp.msn_stage == 1 + packet->packet_direction) {
            if (packet->payload_packet_len > 10 && get_u_int32_t(packet->payload, 0) == htonl(0x666f6f00)) {
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 1\n");
                return;
            }
            /* did not see this pattern in any trace */
            if (packet->payload_packet_len == 56 && get_u_int32_t(packet->payload, 16) == 0) {
                NDPI_LOG_DBG2(ndpi_struct, "maybe Second TCP MSN detected\n");
                flow->l4.tcp.msn_stage = 3 + packet->packet_direction;
                return;
            }


        } else if (flow->l4.tcp.msn_stage == 2 - packet->packet_direction
                && packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x30000000)) {
            ndpi_int_msn_add_connection(ndpi_struct, flow);
            NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 2\n");
            return;
        } else if ((flow->l4.tcp.msn_stage == 3 + packet->packet_direction)
                || (flow->l4.tcp.msn_stage == 4 - packet->packet_direction)) {
            if (packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x30000000)) {
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 2\n");
                return;
            }
        } else if (flow->l4.tcp.msn_stage == 6 - packet->packet_direction) {
            if ((packet->payload_packet_len == 4) &&
                    (get_u_int32_t(packet->payload, 0) == htonl(0x10000000) || get_u_int32_t(packet->payload, 0) == htonl(0x30000000))) {
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 3\n");
                return;
            }
        } else if (flow->l4.tcp.msn_stage == 5 + packet->packet_direction) {
            if ((packet->payload_packet_len == 20) && get_u_int32_t(packet->payload, 0) == htonl(0x10000000)) {
                ndpi_int_msn_add_connection(ndpi_struct, flow);
                NDPI_LOG_INFO(ndpi_struct, "found MSN File Transfer 3\n");
                return;
            }
        }
        NDPI_LOG_DBG(ndpi_struct, "msn 7\n");

        if (flow->packet_counter <= MAX_PACKETS_FOR_MSN) {
            if (packet->payload_packet_len >=4 &&  (memcmp(&packet->payload[0], "MSG ", 4) == 0
                        || memcmp(&packet->payload[0], "PNG", 3) == 0
                        || memcmp(&packet->payload[0], "QNG ", 4) == 0
                        || memcmp(&packet->payload[0], "OUT", 3) == 0
                        || memcmp(&packet->payload[0], "RNG ", 4) == 0
                        || memcmp(&packet->payload[0], "NLN ", 4) == 0
                        || memcmp(&packet->payload[0], "UBX ", 4) == 0
                        || memcmp(&packet->payload[0], "XFR ", 4) == 0)
               ){
                ndpi_int_msn_add_connection(ndpi_struct, flow);

                NDPI_LOG_INFO(ndpi_struct, "found MSN\n");
                return;
            }
        }
ndpi_msn_exclude:
        NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
    }

    /* search over UDP */
    static void ndpi_search_msn_udp_misc(struct ndpi_detection_module_struct
            *ndpi_struct, struct ndpi_flow_struct *flow)
    {
        struct ndpi_packet_struct *packet = &flow->packet;

        struct ndpi_id_struct *src = flow->src;
        struct ndpi_id_struct *dst = flow->dst;


        /* do we have an msn login ? */
        if ((src == NULL || NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0)
                && (dst == NULL
                    || NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0)) {
            NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
            return;
        }

        /* asymmetric ft detection works */
        if (packet->payload_packet_len == 20
                && get_u_int32_t(packet->payload, 4) == 0 && packet->payload[9] == 0
                && get_u_int16_t(packet->payload, 10) == htons(0x0100)) {
            NDPI_LOG_INFO(ndpi_struct, "found MSN udp misc data connection\n");
            ndpi_int_msn_add_connection(ndpi_struct, flow);
        }

        /* asymmetric detection working. */
        return;
        //}
}


void ndpi_search_msn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
    struct ndpi_packet_struct *packet = &flow->packet;

    NDPI_LOG_DBG(ndpi_struct, "search msn\n");
    /* this if request should always be true */
    if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) {
        /* we deal with tcp now */
        if(packet->tcp != NULL) {
            /* msn can use http or ssl for connection. That's why every http, ssl and ukn packet must enter in the msn detection */
            /* the detection can switch out the http or the ssl detection. In this case we need not check those protocols */
            // need to do the ceck when protocol == http too (POST /gateway ...)
            if(packet->detected_protocol == NDPI_PROTOCOL_UNKNOWN
                    || packet->detected_protocol == NDPI_PROTOCOL_HTTP
                    || packet->detected_protocol == NDPI_PROTOCOL_SSL
                    || packet->detected_protocol == NDPI_PROTOCOL_STUN
              )
                ndpi_search_msn_tcp(ndpi_struct, flow);
        } else if (packet->udp != NULL) {
            ndpi_search_msn_udp_misc(ndpi_struct, flow);
        }
    }
}


void init_msn_dissector(struct ndpi_detection_module_struct *ndpi_struct,
        u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
{

    NDPI_BITMASK_RESET(ndpi_struct->callback_buffer[*id].excluded_protocol_bitmask);

    ndpi_set_bitmask_protocol_detection("MSN", ndpi_struct, detection_bitmask, *id,
            NDPI_PROTOCOL_MSN,
            ndpi_search_msn,
            NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
            SAVE_DETECTION_BITMASK_AS_UNKNOWN,
            ADD_TO_DETECTION_BITMASK);

    *id += 1;
}

