/*
 * qq.c
 *
 * Copyright (C) 2009-2011 by ipoque GmbH
 * Copyright (C) 2011-18 - ntop.org
 *
 * This file is part of nDPI, an open source deep packet inspection
 * library based on the OpenDPI and PACE technology by ipoque GmbH
 *
 * nDPI is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Lesser General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * nDPI is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
 *
 */

#include "ndpi_protocol_ids.h"

#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_QQ

#include "ndpi_api.h"

static void ndpi_int_qq_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
        struct ndpi_flow_struct *flow/* , */
        /* ndpi_protocol_type_t protocol_type */)
{
    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QQ);
}

/*
 * a qq client packet looks like this:
 *
 * TCP packets starts with 16 bit length, then the normal packets follows
 *
 * 0 1 byte packet tag (usually 0x02)
 * 1 2 byte client tag (client version)
 * 3 2 byte command
 * 5 2 byte sequence number
 * 7 4 byte userid
 * 11 x bytes data
 * LAST 1 byte packet tail (usually 0x03)
 *
 * a qq server packet looks like this:
 *
 * TCP packets starts with 16 bit length, then the normal packets follows
 *
 * 0 1 byte packet tag (usually 0x02)
 * 1 2 byte source tag (client version, might also be a server id)
 * 3 2 byte command (usually reply to client request, so same command id)
 * 5 2 byte sequence number
 * LAST 1 byte packet tail (usually 0x03)
 *
 * NOTE: there are other qq versions which uses different packet types!
 */

/*
 * these are some currently known client ids (or server ids)
 * new ids might be added here if the traffic is really QQ
 */
static const u_int16_t ndpi_valid_qq_versions[] = {
    0x0100, 0x05a5, 0x062e, 0x06d5, 0x072e, 0x0801, 0x087d, 0x08d2, 0x0961,
    0x0a1d, 0x0b07, 0x0b2f, 0x0b35, 0x0b37, 0x0c0b, 0x0c0d, 0x0c21, 0x0c49,
    0x0d05, 0x0d51, 0x0d55, 0x0d61, 0x0e1b, 0x0e35, 0x0f15, 0x0f4b, 0x0f5f,
    0x1105, 0x111b, 0x111d, 0x1131, 0x113f, 0x115b, 0x1203, 0x1205, 0x120b,
    0x1251, 0x1412, 0x1441, 0x1501, 0x1549, 0x163a, 0x1801, 0x180d, 0x1c27,
    0x1e0d
};

/**
 * this functions checks whether the packet is a valid qq packet
 * it can handle tcp and udp packets
 */

#if !defined(WIN32)
static inline
#elif defined(MINGW_GCC)
__mingw_forceinline static
#else
__forceinline static
#endif
u_int8_t ndpi_is_valid_qq_packet(const struct ndpi_packet_struct *packet)
{
    u_int8_t real_start = 0;
    u_int16_t command;
    u_int8_t ids, found = 0;
    u_int16_t version_id;

    if (packet->payload_packet_len < 9)
        return 0;

    /* for tcp the length is prefixed */
    if (packet->tcp) {
        if (ntohs(get_u_int16_t(packet->payload, 0)) != packet->payload_packet_len) {
            return 0;
        }
        real_start = 2;
    }

    /* packet usually starts with 0x02 */
    if (packet->payload[real_start] != 0x02) {
        return 0;
    }

    /* packet usually ends with 0x03 */
    if (packet->payload[packet->payload_packet_len - 1] != 0x03) {
        return 0;
    }

    version_id = ntohs(get_u_int16_t(packet->payload, real_start + 1));

    if (version_id == 0) {
        return 0;
    }

    /* check for known version id */
    for (ids = 0; ids < sizeof(ndpi_valid_qq_versions) / sizeof(ndpi_valid_qq_versions[0]); ids++) {
        if (version_id == ndpi_valid_qq_versions[ids]) {
            found = 1;
            break;
        }
    }

    if (!found)
        return 0;

    command = ntohs(get_u_int16_t(packet->payload, real_start + 3));

    /* these are some known commands, not all need to be checked
       since many are used with already established connections */

    switch (command) {
        case 0x0091:				/* get server */
        case 0x00ba:				/* login token */
        case 0x00dd:				/* password verify */
        case 0x00e5:
        case 0x00a4:
        case 0x0030:
        case 0x001d:
        case 0x0001:
        case 0x0062:
        case 0x0002:
        case 0x0022:
        case 0x0029:
            break;
        default:
            return 0;
            break;
    }

    return 1;
}

/*
 * some file transfer packets look like this
 *
 * 0 1 byte packet tag (usually 0x04)
 * 1 2 byte client tag (client version)
 * 3 2 byte length (this is speculative)
 * LAST 1 byte packet tail (usually 0x03)
 *
 */
/**
 * this functions checks whether the packet is a valid qq file transfer packet
 * it can handle tcp and udp packets
 */

#if !defined(WIN32)
static inline
#elif defined(MINGW_GCC)
__mingw_forceinline static
#else
__forceinline static
#endif
u_int8_t ndpi_is_valid_qq_ft_packet(const struct ndpi_packet_struct *packet)
{
    u_int8_t ids, found = 0;
    u_int16_t version_id;

    if (packet->payload_packet_len < 9)
        return 0;

    /* file transfer packets may start with 0x00 (control), 0x03 (data), 0x04 (agent) */

    if (packet->payload[0] != 0x04 && packet->payload[0] != 0x03 && packet->payload[0] != 0x00) {
        return 0;
    }

    version_id = ntohs(get_u_int16_t(packet->payload, 1));

    if (version_id == 0) {
        return 0;
    }

    /* check for known version id */
    for (ids = 0; ids < sizeof(ndpi_valid_qq_versions) / sizeof(ndpi_valid_qq_versions[0]); ids++) {
        if (version_id == ndpi_valid_qq_versions[ids]) {
            found = 1;
            break;
        }
    }

    if (!found)
        return 0;

    if (packet->payload[0] == 0x04) {

        if (ntohs(get_u_int16_t(packet->payload, 3)) != packet->payload_packet_len) {
            return 0;
        }

        /* packet usually ends with 0x03 */
        if (packet->payload[packet->payload_packet_len - 1] != 0x03) {
            return 0;
        }
    } else if (packet->payload[0] == 0x03) {
        /* TODO currently not detected */
        return 0;
    } else if (packet->payload[0] == 0x00) {

        /* packet length check, there might be other lengths */
        if (packet->payload_packet_len != 84) {
            return 0;
        }

        /* packet usually ends with 0x0c ? */
        if (packet->payload[packet->payload_packet_len - 1] != 0x0c) {
            return 0;
        }
    }
    return 1;
}

static void ndpi_search_qq_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
    struct ndpi_packet_struct *packet = &flow->packet;

    static const u_int16_t p8000_patt_02[15] =	// maybe version numbers
    { 0x1549, 0x1801, 0x180d, 0x0961, 0x01501, 0x0e35, 0x113f, 0x0b37, 0x1131, 0x163a, 0x1e0d, 0x3619, 0x371b, 0x3823,};
    u_int16_t no_of_patterns = 14, index = 0;


    NDPI_LOG_DBG(ndpi_struct, "search qq udp\n");


    if (flow->qq_stage <= 3) {
        if ((packet->payload_packet_len == 27 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0300
                    && packet->payload[2] == 0x01)
                || (packet->payload_packet_len == 84 && ((ntohs(get_u_int16_t(packet->payload, 0)) == 0x000e
                            && packet->payload[2] == 0x35)
                        || (ntohs(get_u_int16_t(packet->payload, 0)) == 0x0015
                            && packet->payload[2] == 0x01)
                        || (ntohs(get_u_int16_t(packet->payload, 0)) == 0x000b
                            && packet->payload[2] == 0x37)
                        || (ntohs(get_u_int16_t(packet->payload, 0)) == 0x0015
                            && packet->payload[2] == 0x49)))
                || (packet->payload_packet_len > 10
                    && ((get_u_int16_t(packet->payload, 0) == htons(0x000b) && packet->payload[2] == 0x37)
                        || (get_u_int32_t(packet->payload, 0) == htonl(0x04163a00)
                            && packet->payload[packet->payload_packet_len - 1] == 0x03
                            && packet->payload[4] == packet->payload_packet_len)))) {
            /*
               if (flow->qq_stage == 3 && flow->detected_protocol == NDPI_PROTOCOL_QQ) {
               if (flow->packet_direction_counter[0] > 0 && flow->packet_direction_counter[1] > 0) {
               flow->protocol_subtype = NDPI_PROTOCOL_QQ_SUBTYPE_AUDIO;
               return;
               } else if (flow->packet_counter < 10) {
               return;
               }
               } */
            flow->qq_stage++;
            if (flow->qq_stage == 3) {
                NDPI_LOG_INFO(ndpi_struct, "found qq udp pattern 030001 or 000e35 four times\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
            return;
        }
        if (packet->payload_packet_len > 2 && (packet->payload[0] == 0x02 || packet->payload[0] == 0x04)) {
            u_int16_t pat = ntohs(get_u_int16_t(packet->payload, 1));
            for (index = 0; index < no_of_patterns; index++) {
                if (pat == p8000_patt_02[index] && packet->payload[packet->payload_packet_len - 1] == 0x03) {
                    flow->qq_stage++;
                    // maybe we can test here packet->payload[4] == packet->payload_packet_len
                    if (flow->qq_stage == 3) {
                        NDPI_LOG_INFO(ndpi_struct, "found qq udp pattern 02 ... 03 four times\n");
                        /*
                           if (packet->payload[0] == 0x04) {
                           ndpi_int_qq_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL);
                           return;
                           } */
                        ndpi_int_qq_add_connection(ndpi_struct, flow);
                        return;
                    }
                    return;
                }
            }
        }
        if (packet->payload_packet_len == 84 && (packet->payload[0] == 0 || packet->payload[0] == 0x03)) {
            u_int16_t pat = ntohs(get_u_int16_t(packet->payload, 1));
            for (index = 0; index < no_of_patterns; index++) {
                if (pat == p8000_patt_02[index]) {
                    flow->qq_stage++;
                    /*
                       if (flow->qq_stage == 3 && flow->packet_direction_counter[0] > 0 &&
                       flow->packet_direction_counter[1] > 0) {
                       NDPI_LOG_DBG(ndpi_struct, "found qq udp pattern four times\n");
                       ndpi_int_qq_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL);
                       return;
                       } else */ if (flow->qq_stage == 3) {
                           NDPI_LOG_INFO(ndpi_struct, "found qq udp pattern four times\n");
                           ndpi_int_qq_add_connection(ndpi_struct, flow);
                           return;
                       }
                return;
                }
            }
        }
        if (packet->payload_packet_len > 2 && packet->payload[0] == 0x04
                && ((ntohs(get_u_int16_t(packet->payload, 1)) == 0x1549
                        || ntohs(get_u_int16_t(packet->payload, 1)) == 0x1801 || ntohs(get_u_int16_t(packet->payload, 1)) == 0x0961)
                    ||
                    (packet->payload_packet_len > 16
                     && (ntohs(get_u_int16_t(packet->payload, 1)) == 0x180d || ntohs(get_u_int16_t(packet->payload, 1)) == 0x096d)
                     && ntohl(get_u_int32_t(packet->payload, 12)) == 0x28000000
                     && ntohs(get_u_int16_t(packet->payload, 3)) == packet->payload_packet_len))
                && packet->payload[packet->payload_packet_len - 1] == 0x03) {
            flow->qq_stage++;
            if (flow->qq_stage == 3) {
                NDPI_LOG_INFO(ndpi_struct,
                        "found qq udp pattern 04 1159 ... 03 four times.\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
            return;
        }
        if (packet->payload_packet_len > 2 && (packet->payload[0] == 0x06 || packet->payload[0] == 0x02)
                && ntohs(get_u_int16_t(packet->payload, 1)) == 0x0100
                && (packet->payload[packet->payload_packet_len - 1] == 0x00
                    || packet->payload[packet->payload_packet_len - 1] == 0x03)) {
            flow->qq_stage++;
            if (flow->qq_stage == 3) {
                NDPI_LOG_INFO(ndpi_struct,
                        "found qq udp pattern 02/06 0100 ... 03/00 four times.\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
            return;
        }

        if (packet->payload_packet_len > 2 && (packet->payload[0] == 0x02)
                && ntohs(get_u_int16_t(packet->payload, 1)) == 0x1131 && packet->payload[packet->payload_packet_len - 1] == 0x03) {
            flow->qq_stage++;
            if (flow->qq_stage == 3) {
                NDPI_LOG_INFO(ndpi_struct,
                        "found qq udp pattern 02 1131 ... 03 four times.\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
            return;
        }

        if (packet->payload_packet_len > 5 && get_u_int16_t(packet->payload, 0) == htons(0x0203) &&
                ntohs(get_u_int16_t(packet->payload, 2)) == packet->payload_packet_len &&
                get_u_int16_t(packet->payload, 4) == htons(0x0b0b)) {
            flow->qq_stage++;
            if (flow->qq_stage == 3) {
                NDPI_LOG_INFO(ndpi_struct,
                        "found qq udp pattern 0203[packet_length_0b0b] three times.\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
            return;
        }

        if (packet->udp->dest == htons(9000) || packet->udp->source == htons(9000)) {
            if (packet->payload_packet_len > 3
                    && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0202
                    && ntohs(get_u_int16_t(packet->payload, 2)) == packet->payload_packet_len) {
                flow->qq_stage++;
                if (flow->qq_stage == 3) {
                    NDPI_LOG_INFO(ndpi_struct,
                            "found qq udp pattern 02 02 <length> four times.\n");
                    ndpi_int_qq_add_connection(ndpi_struct, flow);
                    return;
                }
                return;
            }

        }
    }

    if (ndpi_is_valid_qq_packet(packet)) {
        flow->qq_stage++;
        if (flow->qq_stage == 3) {
            NDPI_LOG_INFO(ndpi_struct, "found qq over udp\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }
        NDPI_LOG_DBG2(ndpi_struct, "found qq packet stage %d\n", flow->qq_stage);
        return;
    }

    if (ndpi_is_valid_qq_ft_packet(packet)) {
        flow->qq_stage++;
        if (flow->qq_stage == 3) {
            NDPI_LOG_INFO(ndpi_struct, "found qq ft over udp\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }
        return;
    }

    if (flow->qq_stage && flow->packet_counter <= 5) {
        return;
    }

    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}



#if !defined(WIN32)
static inline
#elif defined(MINGW_GCC)
__mingw_forceinline static
#else
__forceinline static
#endif
void ndpi_search_qq_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
    struct ndpi_packet_struct *packet = &flow->packet;
    u_int16_t i = 0;

    NDPI_LOG_DBG(ndpi_struct, "search qq tcp\n");

    if (packet->payload_packet_len == 39 && get_u_int32_t(packet->payload, 0) == htonl(0x27000000) &&
            get_u_int16_t(packet->payload, 4) == htons(0x0014) && get_u_int32_t(packet->payload, 11) != 0 &&
            get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == htons(0x0000)) {
        if (flow->qq_stage == 4) {
            NDPI_LOG_INFO(ndpi_struct, "found qq over tcp - maybe ft/audio/video\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }
        flow->qq_stage = 4;
        return;
    }

    if ((packet->payload_packet_len > 4 && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len
                && get_u_int16_t(packet->payload, 2) == htons(0x0212) && packet->payload[4] == 0x0b)
            || (packet->payload_packet_len > 6 && packet->payload[0] == 0x02
                && packet->payload[packet->payload_packet_len - 1] == 0x03
                && ntohs(get_u_int16_t(packet->payload, 1)) == packet->payload_packet_len
                && (get_u_int16_t(packet->payload, 3) == htons(0x0605) || get_u_int16_t(packet->payload, 3) == htons(0x0608))
                && packet->payload[5] == 0x00)
            || (packet->payload_packet_len > 9 && get_u_int32_t(packet->payload, 0) == htonl(0x04154900)
                && get_l16(packet->payload, 4) == packet->payload_packet_len
                && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 9 && get_u_int32_t(packet->payload, 0) == htonl(0x040e3500)
                && get_l16(packet->payload, 4) == packet->payload_packet_len
                && packet->payload[9] == 0x33 && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 9 && get_u_int32_t(packet->payload, 0) == htonl(0x040e0215)
                && get_l16(packet->payload, 4) == packet->payload_packet_len
                && packet->payload[9] == 0x33 && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 6 && get_u_int32_t(packet->payload, 2) == htonl(0x020d5500)
                && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len
                && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 6 && get_u_int16_t(packet->payload, 0) == htons(0x0418)
                && packet->payload[2] == 0x01
                && ntohs(get_u_int16_t(packet->payload, 3)) == packet->payload_packet_len
                && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 6 && get_u_int16_t(packet->payload, 0) == htons(0x0411)
                    && packet->payload[2] == 0x31
                    && ntohs(get_u_int16_t(packet->payload, 3)) == packet->payload_packet_len
                    && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 6 && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len
                    && get_u_int16_t(packet->payload, 2) == htons(0x0211) && packet->payload[4] == 0x31
                    && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 6 && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len
                    && get_u_int16_t(packet->payload, 2) == htons(0x0218) && packet->payload[4] == 0x01
                    && packet->payload[packet->payload_packet_len - 1] == 0x03)
            || (packet->payload_packet_len > 10 && get_u_int32_t(packet->payload, 0) == htonl(0x04163a00)
                    && packet->payload[packet->payload_packet_len - 1] == 0x03
                    && packet->payload[4] == packet->payload_packet_len)
            ) {
                flow->qq_stage++;
                if (flow->qq_stage == 3) {
                    NDPI_LOG_INFO(ndpi_struct, "found qq over tcp\n");
                    ndpi_int_qq_add_connection(ndpi_struct, flow);
                    return;
                }
                return;
            }

    if (ndpi_is_valid_qq_packet(packet)) {
        flow->qq_stage++;
        if (flow->qq_stage == 3) {
            NDPI_LOG_INFO(ndpi_struct, "found qq over tcp\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }

        return;
    }

    if (ndpi_is_valid_qq_ft_packet(packet)) {
        flow->qq_stage++;
        if (flow->qq_stage == 3) {
            NDPI_LOG_INFO(ndpi_struct, "found qq ft over tcp\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }

        return;
    }

    if (packet->payload_packet_len == 2) {
        flow->l4.tcp.qq_nxt_len = ntohs(get_u_int16_t(packet->payload, 0));
        return;
    }

    if (packet->payload_packet_len > 5 && (((flow->l4.tcp.qq_nxt_len == packet->payload_packet_len + 2)
                    && packet->payload[0] == 0x02
                    && packet->payload[packet->payload_packet_len - 1] == 0x03
                    && get_u_int16_t(packet->payload, 1) == htons(0x0f5f))
                || (ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len
                    && packet->payload[2] == 0x02
                    && packet->payload[packet->payload_packet_len - 1] == 0x03
                    && get_u_int16_t(packet->payload, 3) == htons(0x0f5f)))) {
        flow->qq_stage++;
        if (flow->qq_stage == 3) {
            NDPI_LOG_INFO(ndpi_struct, "found qq udp pattern 02 ... 03 four times\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }

        return;
    }

    if (packet->payload_packet_len > 2 && packet->payload[0] == 0x04 && ((get_u_int16_t(packet->payload, 1) == htons(0x1549)
                    || get_u_int16_t(packet->payload,
                        1) == htons(0x1801)
                    || get_u_int16_t(packet->payload,
                        1) == htons(0x0961))
                || (packet->payload_packet_len > 16
                    && (get_u_int16_t(packet->payload, 1) ==
                        htons(0x180d)
                        || get_u_int16_t(packet->payload,
                            1) == htons(0x096d))
                    && get_u_int32_t(packet->payload,
                        12) == htonl(0x28000000)
                    && ntohs(get_u_int16_t(packet->payload, 3)) ==
                    packet->payload_packet_len))
            && packet->payload[packet->payload_packet_len - 1] == 0x03) {
        flow->qq_stage++;
        if (flow->qq_stage == 3) {
            NDPI_LOG_INFO(ndpi_struct,
                    "found qq udp pattern 04 1159 ... 03 four times.\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }
        return;
    }

    if (packet->payload_packet_len > 100
            && ((memcmp(packet->payload, "GET", 3) == 0) || (memcmp(packet->payload, "POST", 4) == 0))) {
        NDPI_LOG_DBG2(ndpi_struct, "found GET or POST\n");
        if (memcmp(packet->payload, "GET /qqfile/qq", 14) == 0) {
            NDPI_LOG_INFO(ndpi_struct, "found qq over tcp GET /qqfile/qq\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }
        ndpi_parse_packet_line_info(ndpi_struct, flow);

        if (packet->user_agent_line.ptr != NULL
                && (packet->user_agent_line.len > 7 && memcmp(packet->user_agent_line.ptr, "QQClient", 8) == 0)) {
            NDPI_LOG_INFO(ndpi_struct, "found qq over tcp GET...QQClient\n");
            ndpi_int_qq_add_connection(ndpi_struct, flow);
            return;
        }
        for (i = 0; i < packet->parsed_lines; i++) {
            if (packet->line[i].len > 3 && memcmp(packet->line[i].ptr, "QQ: ", 4) == 0) {
                NDPI_LOG_INFO(ndpi_struct, "found qq over tcp GET...QQ: \n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
        }
        if (packet->host_line.ptr != NULL) {
            NDPI_LOG_DBG2(ndpi_struct, "host line ptr\n");
            if (packet->host_line.len > 11 && memcmp(&packet->host_line.ptr[0], "www.qq.co.za", 12) == 0) {
                NDPI_LOG_INFO(ndpi_struct, "found qq over tcp Host: www.qq.co.za\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
        }
    }
    if (flow->qq_stage == 0 && packet->payload_packet_len == 82
            && get_u_int32_t(packet->payload, 0) == htonl(0x0000004e) && get_u_int32_t(packet->payload, 4) == htonl(0x01010000)) {
        for (i = 8; i < 82; i++) {
            if (packet->payload[i] != 0x00) {
                break;
            }
            if (i == 81) {
                NDPI_LOG_INFO(ndpi_struct, "found qq Mail\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
        }
    }
    if (flow->qq_stage == 0 && packet->payload_packet_len == 182 && get_u_int32_t(packet->payload, 0) == htonl(0x000000b2)
            && get_u_int32_t(packet->payload, 4) == htonl(0x01020000)
            && get_u_int32_t(packet->payload, 8) == htonl(0x04015151) && get_u_int32_t(packet->payload, 12) == htonl(0x4d61696c)) {
        NDPI_LOG_INFO(ndpi_struct, "found qq Mail\n");
        ndpi_int_qq_add_connection(ndpi_struct, flow);
        return;
    }
    if (packet->payload_packet_len == 204 && flow->qq_stage == 0 && get_u_int32_t(packet->payload, 200) == htonl(0xfbffffff)) {
        for (i = 0; i < 200; i++) {
            NDPI_LOG_DBG2(ndpi_struct, "i = %u\n", i);
            if (packet->payload[i] != 0) {
                break;
            }
            if (i == 199) {
                NDPI_LOG_INFO(ndpi_struct, "found qq chat or file transfer\n");
                ndpi_int_qq_add_connection(ndpi_struct, flow);
                return;
            }
        }
    }

    if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) {

        NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QQ);
        NDPI_LOG_DBG(ndpi_struct, "QQ tcp excluded; len %u\n",
                packet->payload_packet_len);
    }

}

void ndpi_search_qq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
    struct ndpi_packet_struct *packet = &flow->packet;

    if (packet->udp != NULL && flow->detected_protocol != NDPI_PROTOCOL_QQ)
        ndpi_search_qq_udp(ndpi_struct, flow);

    if (packet->tcp != NULL && flow->detected_protocol != NDPI_PROTOCOL_QQ)
        ndpi_search_qq_tcp(ndpi_struct, flow);
}

void init_qq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
{
    ndpi_set_bitmask_protocol_detection("QQ", ndpi_struct, detection_bitmask, *id,
            NDPI_PROTOCOL_QQ,
            ndpi_search_qq,
            NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
            SAVE_DETECTION_BITMASK_AS_UNKNOWN,
            ADD_TO_DETECTION_BITMASK);

    *id += 1;
}
