diff --git a/CMakeLists.txt b/CMakeLists.txt index 27c88ce..7ff43ca 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -81,7 +81,7 @@ add_subdirectory(conf) add_subdirectory(vendors) add_subdirectory(deps) add_subdirectory(infra) -#add_subdirectory(decoders) +add_subdirectory(decoders) add_subdirectory(scripts) add_subdirectory(include) add_subdirectory(test) diff --git a/conf/stellar.toml b/conf/stellar.toml index d7d1a01..beb2121 100644 --- a/conf/stellar.toml +++ b/conf/stellar.toml @@ -10,6 +10,23 @@ cpu_mask = [5, 6, 7, 8, 9, 10, 11, 12] idle_yield_interval_ms = 900 # range: [0, 60000] (ms) +[[module]] +path="" +init="packet_manager_on_init" +exit="packet_manager_on_exit" + +[[module]] +path = "" +init = "polling_manager_on_init" +exit = "polling_manager_on_exit" + +[[module]] +path="" +init="session_manager_on_init" +exit="session_manager_on_exit" + + + [ip_reassembly] enable = 1 bucket_entries = 32 # range: [1, 4294967295] (must be power of 2) @@ -68,17 +85,5 @@ file = "log/stellar.log" level = "INFO" # TRACE, DEBUG, INFO, WARN, ERROR, FATAL -[[module]] -path = "" -init = "polling_manager_on_init" -exit = "polling_manager_on_exit" -[[module]] -path = "" -init = "packet_manager_on_init" -exit = "packet_manager_on_exit" -[[module]] -path = "" -init = "session_manager_on_init" -exit = "session_manager_on_exit" diff --git a/decoders/CMakeLists.txt b/decoders/CMakeLists.txt index 8b3f7a9..efad779 100644 --- a/decoders/CMakeLists.txt +++ b/decoders/CMakeLists.txt @@ -1,5 +1,6 @@ -add_subdirectory(http) -add_subdirectory(lpi) -add_subdirectory(socks) -add_subdirectory(stratum) -add_subdirectory(session_flags) \ No newline at end of file +add_subdirectory(appid) +add_subdirectory(lpi_plus) +#add_subdirectory(http) +#add_subdirectory(socks) +#add_subdirectory(stratum) +#add_subdirectory(session_flags) \ No newline at end of file diff --git a/decoders/appid/CMakeLists.txt b/decoders/appid/CMakeLists.txt new file mode 100644 index 0000000..acb1939 --- /dev/null +++ b/decoders/appid/CMakeLists.txt @@ -0,0 +1 @@ +add_library(appid appid.c) \ No newline at end of file diff --git a/decoders/appid/appid.c b/decoders/appid/appid.c new file mode 100644 index 0000000..642e8e6 --- /dev/null +++ b/decoders/appid/appid.c @@ -0,0 +1,49 @@ +#include "appid_internal.h" + +#include "stellar/utils.h" +#include "stellar/mq.h" + + + +static void appid_message_free(void *msg, void *msg_free_arg __unused) +{ + if(msg==NULL)return; + FREE(msg); +} + +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wcast-function-type" + +static void stellar_appid_on_msg_dispatch(int topic_id __unused, + void *msg, + on_msg_cb_func* on_msg_cb, + void *on_msg_cb_arg, + void *dispatch_arg __unused) +{ + on_appid_callback *appid_cb = (on_appid_callback *)on_msg_cb; + struct appid_message *appid_msg=(struct appid_message *)msg; + appid_cb(appid_msg->sess, appid_msg->origin, appid_msg->appid, appid_msg->appid_num, on_msg_cb_arg); +} + +int stellar_appid_subscribe(struct stellar_module_manager *mod_mgr, on_appid_callback *cb, void *args) +{ + if(mod_mgr==NULL)return -1; + int appid_topic_id=mq_schema_get_topic_id(stellar_module_manager_get_mq_schema(mod_mgr), APPID_MESSAGE_TOPIC); + if(appid_topic_id<0) + { + appid_topic_id=mq_schema_create_topic(stellar_module_manager_get_mq_schema(mod_mgr), APPID_MESSAGE_TOPIC, stellar_appid_on_msg_dispatch, mod_mgr, appid_message_free, NULL); + } + return mq_schema_subscribe(stellar_module_manager_get_mq_schema(mod_mgr), appid_topic_id, (on_msg_cb_func *)cb, args); +} + +#pragma GCC diagnostic pop + +int stellar_appid_create_topic(struct stellar_module_manager *mod_mgr) +{ + int app_topic_id=mq_schema_get_topic_id(stellar_module_manager_get_mq_schema(mod_mgr), APPID_MESSAGE_TOPIC); + if(app_topic_id < 0) + { + app_topic_id=mq_schema_create_topic(stellar_module_manager_get_mq_schema(mod_mgr), APPID_MESSAGE_TOPIC, stellar_appid_on_msg_dispatch, NULL,appid_message_free, NULL); + } + return app_topic_id; +} \ No newline at end of file diff --git a/decoders/appid/appid_internal.h b/decoders/appid/appid_internal.h new file mode 100644 index 0000000..b107806 --- /dev/null +++ b/decoders/appid/appid_internal.h @@ -0,0 +1,25 @@ +#pragma once + +#ifdef __cplusplus +extern "C" +{ +#endif + +#include "stellar/appid.h" + +#define MAX_APPID_NUM 8 +#define APPID_MESSAGE_TOPIC "TOPIC_APPID" + +struct appid_message +{ + struct session *sess; + enum APPID_ORIGIN origin; + uint32_t appid_num; + int32_t appid[MAX_APPID_NUM]; + uint32_t surrogate_id[MAX_APPID_NUM]; + uint32_t packet_sequence[MAX_APPID_NUM]; +}; + +#ifdef __cplusplus +} +#endif \ No newline at end of file diff --git a/decoders/lpi/CMakeLists.txt b/decoders/lpi/CMakeLists.txt deleted file mode 100644 index 43528a6..0000000 --- a/decoders/lpi/CMakeLists.txt +++ /dev/null @@ -1,12 +0,0 @@ -add_definitions(-fPIC) -add_subdirectory(libprotoident) - -add_library(lpi lpi_plugin.cpp quic_ident.cpp openvpn_ident.cpp) -target_include_directories(lpi PUBLIC ${CMAKE_SOURCE_DIR}/deps/) - -target_link_libraries(lpi libprotoident) -set_target_properties(lpi PROPERTIES LINK_FLAGS - "-Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/version.map") - -#install(TARGETS ${PROJECT_NAME} LIBRARY DESTINATION ${CMAKE_INSTALL_PREFIX}/stellar_plugin COMPONENT LIBRARIES) - diff --git a/decoders/lpi/lpi_plugin.cpp b/decoders/lpi/lpi_plugin.cpp deleted file mode 100644 index 7591a90..0000000 --- a/decoders/lpi/lpi_plugin.cpp +++ /dev/null @@ -1,783 +0,0 @@ -/* - * dpkt_basic_proto_main.cpp - * - * Created on: Aug 7, 2020 - * Author: iie - */ - -#include -#include -#include -#include -#include - -#include "uthash/uthash.h" - - -#include "stellar/utils.h" - -#include "stellar/session.h" -#include "stellar/stellar_exdata.h" -#include "stellar/stellar_mq.h" - -#include "stellar/packet.h" -#include "stellar/appid.h" - -#include "lpi_plugin.h" - -const char *dns_name="DNS"; -const char *imap_name="IMAP"; -const char *quic_name="QUIC"; - -const char *g_app_proto_conffile="./tsgconf/main.conf"; -const char *log_path = (char *)"./tsglog/lpi/"; - - -struct lpi_plugin_env -{ - int level; - int max_pkts; - int l7_label_id; - int l7_bridge_id; - int plugin_exdata_idx; - int l7_app_id_exdata_idx; - int topic_id; - int plugin_id; - struct stellar *st; - char log_path[128]; - char l7_protocol_file[128]; - struct l7_protocol_hash *name_by_id; - void *logger; - int tcp_topic_id; - int udp_topic_id; -}; - -struct l7_protocol_hash g_app_name2lpi_id[]={ - {0, LPI_PROTO_UNKNOWN, "UNCATEGORIZED",{}}, - //{0, LPI_PROTO_UNKNOWN, "Unknown_UDP"}, - //{0, LPI_PROTO_UNSUPPORTED, "Unknown_Other"}, - {0, LPI_PROTO_DNS, "DNS", {}}, - {0, LPI_PROTO_FTP_CONTROL, "FTP", {}}, - //{0, LPI_PROTO_FTP_DATA, "FTP", NULL, NULL}, - {0, LPI_PROTP_FTPS, "FTPS", {}}, - {0, LPI_PROTO_HTTP, "HTTP", {}}, - {0, LPI_PROTO_HTTPS, "HTTPS", {}}, - {0, LPI_PROTO_ICMP, "ICMP", {}}, - {0, LPI_PROTO_IKE, "IKE", {}}, - {0, LPI_PROTO_MAIL, "MAIL", {}}, - {0, LPI_PROTO_IMAP, "IMAP", {}}, - {0, LPI_PROTO_IMAPS, "IMAPS", {}}, - {0, LPI_PROTO_UDP_ESP, "IPSEC", {}}, - {0, LPI_PROTO_XMPP, "XMPP", {}}, - {0, LPI_PROTO_UDP_L2TP, "L2TP", {}}, - {0, LPI_PROTO_UDP_NTP, "NTP", {}}, - {0, LPI_PROTO_POP3, "POP3", {}}, - {0, LPI_PROTO_POP3S, "POP3S", {}}, - {0, LPI_PROTO_PPTP, "PPTP", {}}, - {0, LPI_PROTO_UDP_QUIC, "QUIC", {}}, - {0, LPI_PROTO_SIP, "SIP", {}}, - {0, LPI_PROTO_SMB, "SMB", {}}, - {0, LPI_PROTO_SMTP, "SMTP", {}}, - {0, LPI_PROTO_SMTPS, "SMTPS", {}}, - {0, LPI_PROTO_SPDY, "SPDY", {}}, - {0, LPI_PROTO_SSH, "SSH", {}}, - {0, LPI_PROTO_SSL, "SSL", {}}, - {0, LPI_PROTO_SOCKS4, "SOCKS", {}}, - //{0, LPI_PROTO_SOCKS4, "SOCKS4", NULL, NULL}, - //{0, LPI_PROTO_SOCKS5, "SOCKS5", NULL, NULL}, - {0, LPI_PROTO_TELNET, "TELNET", {}}, - {0, LPI_PROTO_UDP_DHCP, "DHCP", {}}, - {0, LPI_PROTO_UDP_RADIUS, "RADIUS", {}}, - {0, LPI_PROTO_OPENVPN, "OPENVPN", {}}, - {0, LPI_PROTO_STUN, "STUN", {}}, - {0, LPI_PROTO_UDP_TEREDO, "TEREDO", {}}, - {0, LPI_PROTO_UDP_DTLS, "DTLS", {}}, - {0, LPI_PROTO_DOH, "DoH", {}}, - {0, LPI_PROTO_UDP_ISAKMP, "ISAKMP", {}}, - {0, LPI_PROTO_UDP_MDNS, "MDNS", {}}, - {0, LPI_PROTO_NETBIOS, "NETBIOS", {}}, - {0, LPI_PROTO_UDP_NETFLOW, "NETFLOW", {}}, - {0, LPI_PROTO_RDP, "RDP", {}}, - {0, LPI_PROTO_UDP_RTCP, "RTCP", {}}, - {0, LPI_PROTO_UDP_RTP, "RTP", {}}, - {0, LPI_PROTO_UDP_SLP, "SLP", {}}, - {0, LPI_PROTO_UDP_SNMP, "SNMP", {}}, - {0, LPI_PROTO_UDP_SSDP, "SSDP", {}}, - {0, LPI_PROTO_UDP_TFTP, "TFTP", {}}, - {0, LPI_PROTO_UDP_BJNP, "BJNP", {}}, - {0, LPI_PROTO_LDAP, "LDAP", {}}, - {0, LPI_PROTO_RTMP, "RTMP", {}}, - {0, LPI_PROTO_RTSP, "RTSP", {}}, - {0, LPI_PROTO_ESNI, "ESNI", {}}, - {0, LPI_PROTO_STRATUM, "Stratum", {}}, - {0, LPI_PROTO_QQ, "QQ", {}}, - {0, LPI_PROTO_WECHAT, "WeChat", {}}, - {0, LPI_PROTO_MMS, "MMS", {}}, - {0, LPI_PROTO_RSYNC, "RSYNC", {}}, - {0, LPI_PROTO_UDP_WIREGUARD, "WIREGUARD", {}}, - }; - -struct dns_header -{ - u_int16_t id; -#if __BYTE_ORDER == __LITTLE_ENDIAN - u_char rd:1; - u_char tc:1; - u_char aa:1; - u_char opcode:4; - u_char qr:1; - u_char rcode:4; - u_char z:3; - u_char ra:1; -#elif __BYTE_ORDER == __BIG_ENDIAN - u_char qr:1; - u_char opcode:4; - u_char aa:1; - u_char tc:1; - u_char rd:1; - u_char ra:1; - u_char z:3; - u_char rcode:4; -#endif - u_int16_t qdcount; - u_int16_t ancount; - u_int16_t aucount;//authority count - u_int16_t adcount;//additional count -}; - -static void get_host_order_port(struct session *sess __unused, unsigned short *sport, unsigned short *dport) -{ - *sport=0; - *dport=0; -//get host order port from stellar session api - - const struct packet *pkt = session_get0_current_packet(sess); - enum flow_type flow_type=session_get_flow_type(sess); - if(pkt && (flow_type==FLOW_TYPE_C2S || flow_type==FLOW_TYPE_S2C)) - { - int layer_cnt=packet_get_layer_count(pkt); - const struct layer *layer = packet_get_layer_by_idx(pkt, layer_cnt - 1); - if (layer && layer->proto == LAYER_PROTO_TCP) - { - *sport = ntohs(layer->hdr.tcp->th_sport); - *dport = ntohs(layer->hdr.tcp->th_dport); - } - if (layer && layer->proto == LAYER_PROTO_UDP) - { - *sport = ntohs(layer->hdr.udp->uh_sport); - *dport = ntohs(layer->hdr.udp->uh_dport); - } - //S2C, swap sport and dport - if(flow_type == FLOW_TYPE_S2C) - { - unsigned short tmp = *sport; - *sport = *dport; - *dport = tmp; - } - } - return; -} - -static int revise_lpi_result(struct session *sess, const char *scan_data, const int scan_data_len, lpi_module_t* proto, struct traffic_context *context, int l4_is_tcp, int curdir_is_c2s) -{ - unsigned short sport=0, dport=0; - - get_host_order_port(sess, &sport, &dport); - - if(sport == 989 || sport == 990 || dport == 989 || dport == 990) - { - if(proto->protocol == LPI_PROTO_SSL) - { - proto->protocol=(lpi_protocol_t)LPI_PROTP_FTPS; - proto->category=LPI_CATEGORY_FILES; - proto->priority=3; - proto->name="FTPS"; - proto->lpi_callback=NULL; - return 1; - } - } - - if(sport==443 || dport==443 || sport==80 || dport==80 || sport==8443 || dport==8443) - { - if(app_identify_get_quic_protocol(curdir_is_c2s, (const unsigned char *)scan_data, scan_data_len) != QUIC_VERSION_UNKNOWN) - { - //lpi_quic - proto->protocol=LPI_PROTO_UDP_QUIC; - proto->category=LPI_CATEGORY_WEB; - proto->priority=9; - proto->name=quic_name; - proto->lpi_callback=NULL; - return 1; - } - } - - if((sport==53 || dport==53) && (scan_data_len>12)) - { - struct dns_header *dns_hdr=NULL; - if(l4_is_tcp) - { - dns_hdr=(struct dns_header *)(scan_data+2); - } - else - { - dns_hdr=(struct dns_header *)scan_data; - } - if((dns_hdr->qr==1 && ntohs(dns_hdr->qdcount)==1) || - (dns_hdr->qr==0 && ntohs(dns_hdr->qdcount)==1 && ntohs(dns_hdr->aucount)==0 && ntohs(dns_hdr->ancount)==0)) - { - proto->protocol=LPI_PROTO_DNS; - proto->category=LPI_CATEGORY_SERVICES; - proto->priority=10; - proto->name=dns_name; - proto->lpi_callback=NULL; - return 1; - } - } - - if(((sport==143 || dport==143)) && - ( - (scan_data_len>=11 && memmem(scan_data, scan_data_len, " CAPABILITY", 11)!=NULL) || - (scan_data_len>=7 && memmem(scan_data, scan_data_len, " LOGIN ", 7)!=NULL) - ) - ) - { - proto->protocol=LPI_PROTO_IMAP; - proto->category=LPI_CATEGORY_MAIL; - proto->priority=2; - proto->name=imap_name; - proto->lpi_callback=NULL; - return 1; - } - int c2s_pkt_cnt=context->c2s_pkt; - int s2c_pkt_cnt=context->s2c_pkt; - - if(app_identify_guess_openvpn((const unsigned char *)scan_data, scan_data_len, c2s_pkt_cnt, s2c_pkt_cnt, &context->ovpn, l4_is_tcp, curdir_is_c2s)==1) - { - proto->protocol=LPI_PROTO_OPENVPN; - proto->category=LPI_CATEGORY_TUNNELLING; - proto->priority=4; - proto->name="OpenVPN"; - proto->lpi_callback=NULL; - return 1; - } - - return 0; -} - - -static int set_lpi_same_name(struct l7_protocol_hash *l7_protocol_hash, struct l7_protocol_hash *l7_protocol_elem, int lpi_protocol_id) -{ - struct l7_protocol_hash *tmp=(struct l7_protocol_hash *)calloc(1, sizeof(struct l7_protocol_hash)); - memcpy(tmp, l7_protocol_elem, sizeof(struct l7_protocol_hash)); - - tmp->lpi_protocol=lpi_protocol_id; - HASH_ADD(hh, l7_protocol_hash, lpi_protocol, sizeof(int), tmp); - - return 0; -} - -static int get_protocol_id(struct l7_protocol_hash *name_by_id, const lpi_module_t* proto) -{ - struct l7_protocol_hash *out=NULL; - - HASH_FIND(hh, name_by_id, &(proto->protocol), sizeof(int), out); - if(out!=NULL) - { - return out->protocol_id; - } - - return -1; -} - -static struct app_id_message *app_id_messgae_create(unsigned short *id_array, int id_num) -{ - struct app_id_message *result=CALLOC(struct app_id_message, 1); - result->origin=ORIGIN_PROTO_IDENTIFY; - result->magic=MESSAGE_MAGIC; - result->app_id_num=id_num; - for(unsigned int i=0; iapp_id_num; i++) - { - result->app_id[i]=(int)(id_array[i]); - result->surrogate_id[i]=0; - } - - return result; -} - -static int update_protocol_id(unsigned short *old_id_array, int *old_id_num, unsigned short new_id) -{ - int i=0; - - if(*old_id_num>=MAX_APP_ID_NUM) - { - return 0; - } - - for(i=0; i<(*old_id_num); i++) - { - if(new_id==old_id_array[i]) - { - return 0; - } - } - - old_id_array[(*old_id_num)]=new_id; - (*old_id_num)++; - - return 1; -} - -static int l7_protocol_mapper(struct lpi_plugin_env *g_app_proto_para, const char *filename) -{ - size_t i=0,ret=0; - FILE *fp=NULL; - char line[1024]={0}; - char type_name[32]={0}; - struct l7_protocol_hash *name2lpi=NULL; - struct l7_protocol_hash *l7_protocol=NULL; - struct l7_protocol_hash *out=NULL; - - fp=fopen(filename, "r"); - if(fp==NULL) - { - printf("Open %s failed ...", filename); - return -1; - } - - for(i=0; i<(sizeof(g_app_name2lpi_id)/sizeof(struct l7_protocol_hash)); i++) - { - HASH_ADD(hh, name2lpi, name, strlen(g_app_name2lpi_id[i].name), &(g_app_name2lpi_id[i])); - } - - memset(line, 0, sizeof(line)); - - while((fgets(line, sizeof(line), fp))!=NULL) - { - if(line[0]=='#' || line[0]=='\n' || line[0]=='\r' ||line[0]=='\0') - { - continue; - } - - l7_protocol=(struct l7_protocol_hash *)calloc(1, sizeof(struct l7_protocol_hash)); - ret=sscanf(line, "%31s %63s %d", type_name, l7_protocol->name, &l7_protocol->protocol_id); - assert(ret==3); - - HASH_FIND(hh, name2lpi, l7_protocol->name, strlen(l7_protocol->name), out); - if(out==NULL) - { - //MESA_handle_runtime_log(g_app_proto_para->logger, RLOG_LV_FATAL, "INIT_HASH", "Protocol %s identified without registered LPI ID", l7_protocol->name); - free(l7_protocol); - continue; - } - - l7_protocol->lpi_protocol=out->lpi_protocol; - HASH_ADD(hh, g_app_proto_para->name_by_id, lpi_protocol, sizeof(int), l7_protocol); - - switch(out->lpi_protocol) - { - case LPI_PROTO_DNS: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_DNS); - break; - case LPI_PROTO_SIP: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_SIP); - break; - case LPI_PROTO_SOCKS4: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_SOCKS5); - break; - case LPI_PROTO_FTP_CONTROL: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_FTP_DATA); - break; - case LPI_PROTO_OPENVPN: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_OPENVPN); - break; - case LPI_PROTO_LDAP: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_TCP_LDAP_AD); - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_LDAP_AD); - break; - case LPI_PROTO_HTTP: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_HTTP_BADPORT); - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_HTTP_TUNNEL); - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_NONSTANDARD_HTTP); - break; - case LPI_PROTO_STUN: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_STUN); - break; - case LPI_PROTO_NETBIOS: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_NETBIOS); - break; - case LPI_PROTO_QQ: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_QQ); - break; - case LPI_PROTO_WECHAT: - set_lpi_same_name(g_app_proto_para->name_by_id, l7_protocol, LPI_PROTO_UDP_WECHAT); - break; - default: - break; - } - - memset(line, 0, sizeof(line)); - } - - fclose(fp); - fp=NULL; - - HASH_CLEAR(hh, name2lpi); - -#if 0 - HASH_ITER(hh, g_app_proto_para->name_by_id, out ,tmp) - { - MESA_handle_runtime_log(g_app_proto_para->logger, - RLOG_LV_DEBUG, - "ID_MAPPER", - "%s lpi_protocol built-in ID is %d and TSG ID is %d", - out->name, - out->lpi_protocol, - out->protocol_id - ); - } -#endif - - return ret; -} - -static void free_l7_protocol_mapper(struct l7_protocol_hash *hash) -{ - if(hash==NULL) - { - return ; - } - struct l7_protocol_hash *out=NULL, *tmp=NULL; - HASH_ITER(hh, hash, out ,tmp) - { - if(out!=NULL) - { - HASH_DEL(hash, out); - free(out); - out=NULL; - } - } -} - -int lpi_update_dpkt(lpi_data_t *data, struct session *sess, - const char *scan_data, int scan_data_len, char tsproto, - uint32_t is_c2s) -{ - - uint32_t dir = 0; - if(is_c2s == 1) - { - dir = 0; - } - else - { - dir = 1; - } - uint32_t four_bytes; - - if (data->observed[dir] > 32 * 1024) - return 0; - - data->observed[dir] += scan_data_len; - - if (data->trans_proto == 0)data->trans_proto = tsproto; - - if (scan_data == NULL)return 0; - if (scan_data_len <= 0)return 0; - - if (scan_data_len < 4) - { - memcpy((char *)&four_bytes, scan_data, scan_data_len); - four_bytes = (ntohl(four_bytes)) >> (8 * (4 - scan_data_len)); - four_bytes = htonl(four_bytes << (8 * (4 - scan_data_len))); - } - else - { - four_bytes = (*(uint32_t *)scan_data); - } - - data->payload[dir] = four_bytes; - data->payload_len[dir] = scan_data_len; - - uint16_t source=0; - uint16_t dest=0; - get_host_order_port(sess,&source ,&dest); - - data->client_port = source; - data->server_port = dest; - -// DONE: no need to set saddr and daddr -/* - - if (pstream != NULL && data->ips[0] == 0 - && (pstream->addr.addrtype == __ADDR_TYPE_IP_PAIR_V4 - || pstream->addr.addrtype == ADDR_TYPE_IPV4)) - { - if (dir == 1) - { - data->ips[0] = pstream->addr.ipv4->saddr; - data->ips[1] = pstream->addr.ipv4->daddr; - } - else - { - data->ips[1] = pstream->addr.ipv4->saddr; - data->ips[0] = pstream->addr.ipv4->daddr; - } - } -*/ - return 1; - -} - - - -static int lpi_detector(struct session *sess, struct traffic_context *context, struct lpi_plugin_env *g_app_proto_para, const char *scan_data, const int scan_data_len, int l4_proto) -{ - int ret=0,is_update=0; - //unsigned short sport=0, dport=0; - lpi_module_t modify_lpi_result={(lpi_protocol_t)0, (lpi_category_t)0, NULL, 0, NULL}; - unsigned short new_protocol_id=0; - struct l7_protocol_label *l7_protocol=NULL; - //const struct packet *raw_packet=session_get0_current_packet(sess); - //int cur_pkt_dir= packet_get_direction(raw_packet); - int cur_pkt_dir=session_get_flow_type(sess); - context->pkt_cnt++; - (cur_pkt_dir==FLOW_TYPE_C2S) ? (context->c2s_pkt++) : (context->s2c_pkt++); - int is_c2s_pkt=((cur_pkt_dir==FLOW_TYPE_C2S) ? 1 : 0); - ret=lpi_update_dpkt(&(context->lpi_data), sess, scan_data, scan_data_len, l4_proto, is_c2s_pkt); - if(!ret) - { - return 1; - } - - lpi_module_t *plpi_mod=lpi_guess_protocol(&(context->lpi_data)); - if(plpi_mod==NULL) - { - return 1; - } - - if((plpi_mod->protocol==LPI_PROTO_UNKNOWN || plpi_mod->protocol==LPI_PROTO_UDP) && - (context->pkt_cntmax_pkts || context->is_identify==1)) - { - ret=revise_lpi_result(sess, scan_data, scan_data_len, &modify_lpi_result, context, - (l4_proto==6?1:0), - (cur_pkt_dir==FLOW_TYPE_C2S?1:0)); - if(ret==0) - { - return 1; - } - - plpi_mod=&modify_lpi_result; - } - - if (plpi_mod->protocol == LPI_PROTO_FTP_CONTROL && context->is_first_payload == 1 && cur_pkt_dir == FLOW_TYPE_S2C) - { - if ((((scan_data_len >= 4 && (memcmp(scan_data, "220-", 4) == 0)) || memcmp(scan_data, "220 ", 4) == 0)) && - (((scan_data_len >= 7 && (memmem(scan_data, scan_data_len, " ESMTP ", 7) != NULL)) || - memmem(scan_data, scan_data_len, " esmtp ", 7) != NULL))) - { - // lpi_smtp - modify_lpi_result.protocol = LPI_PROTO_SMTP; - modify_lpi_result.category = LPI_CATEGORY_MAIL; - modify_lpi_result.priority = 2; - modify_lpi_result.name = "SMTP"; - - plpi_mod = &modify_lpi_result; - } - } - - if (plpi_mod->protocol == LPI_PROTO_SMTP && context->is_first_payload == 1 && cur_pkt_dir == FLOW_TYPE_S2C) - { - if ( - (scan_data_len >= 4) && - (memcmp(scan_data, "220 ", 4) == 0 || memcmp(scan_data, "220-", 4) == 0) && - (memmem(scan_data, scan_data_len, "FTPd", 4) != NULL || - memmem(scan_data, scan_data_len, "ftpd", 4) != NULL || - memmem(scan_data, scan_data_len, "FTPD", 4) != NULL)) - { - // lpi_ftpcontrol - modify_lpi_result.protocol = LPI_PROTO_FTP_CONTROL; - modify_lpi_result.category = LPI_CATEGORY_FILES; - modify_lpi_result.priority = 3; - modify_lpi_result.name = "FTP_Control"; - - plpi_mod = &modify_lpi_result; - } - } - - new_protocol_id=get_protocol_id(g_app_proto_para->name_by_id, plpi_mod); -#if 0 - if(new_protocol_id==(unsigned short)-1) - { - - if(plpi_mod->protocol!=LPI_PROTO_UNKNOWN && plpi_mod->protocol!=LPI_PROTO_UDP && plpi_mod->protocol!=LPI_PROTO_UNSUPPORTED) - { - MESA_handle_runtime_log(g_app_proto_para->logger, - RLOG_LV_INFO, - "UNDEFINE", - "Protocol Name: %s identified without registered LPI ID=%d, category: %s priority: %d addr: %s", - plpi_mod->name, - plpi_mod->protocol, - lpi_print_category(plpi_mod->category), - plpi_mod->priority, - session_get0_readable_addr(sess) - ); - } - return 1; - } - else - { - MESA_handle_runtime_log(g_app_proto_para->logger, - RLOG_LV_INFO, - "DEFINE", - "Protocol Name: %s identified registered LPI ID(%d), category: %s priority: %d addr: %s", - plpi_mod->name, - plpi_mod->protocol, - lpi_print_category(plpi_mod->category), - plpi_mod->priority, - session_get0_readable_addr(sess) - ); - } -#endif - - l7_protocol = (struct l7_protocol_label *)session_exdata_get(sess, g_app_proto_para->l7_app_id_exdata_idx); - if(l7_protocol==NULL) - { - l7_protocol=CALLOC(struct l7_protocol_label, 1); - l7_protocol->continue_scan_flag = 1; - session_exdata_set(sess, g_app_proto_para->l7_app_id_exdata_idx, l7_protocol); - } - - is_update=update_protocol_id(l7_protocol->protocol_id, &(l7_protocol->protocol_id_num), new_protocol_id); - if(is_update==1) - { - context->is_identify=1; - struct app_id_message *msg=app_id_messgae_create(l7_protocol->protocol_id, l7_protocol->protocol_id_num); - if(session_mq_publish_message(sess, g_app_proto_para->topic_id, msg) < 0) - { - FREE(msg); - } - //MESA_handle_runtime_log(g_app_proto_para->logger, RLOG_LV_DEBUG, "ADD_PROJECT", "%s identified, ID %d addr: %s", plpi_mod->name, new_protocol_id, session_get0_readable_addr(sess)); - } - - if (context->pkt_cnt >= g_app_proto_para->max_pkts || (plpi_mod->category != LPI_CATEGORY_TUNNELLING && plpi_mod->category != LPI_CATEGORY_NAT && plpi_mod->protocol != LPI_PROTO_RDP && plpi_mod->protocol != LPI_PROTO_UDP_RDP && plpi_mod->protocol != LPI_PROTO_UDP_RTP && plpi_mod->protocol != LPI_PROTO_UDP_RTCP)) - { - l7_protocol->continue_scan_flag=0; - return 0; - } - - return 1; -} - -static void lpi_plugin_on_session_msg(struct session *sess, int topic_id __unused, const void *msg, void *per_session_ctx __unused, void *plugin_env) -{ - assert(plugin_env!=NULL); - - if(msg==NULL)return; - - struct lpi_plugin_env *env=(struct lpi_plugin_env *)plugin_env; - int identify_continue=0; - struct traffic_context *context = (struct traffic_context *)session_exdata_get(sess, env->plugin_exdata_idx); - if(context==NULL) - { - context= CALLOC(struct traffic_context, 1); - context->is_first_payload=1; - session_exdata_set(sess, env->plugin_exdata_idx, context); - } - //size_t payload_len=0; - //const char *payload=session_get0_current_payload(sess, &payload_len); - - uint16_t payload_len=packet_get_payload_len((struct packet*)msg); - const char *payload=packet_get_payload((struct packet*)msg); - if (payload!=NULL && payload_len>0 && context->pkt_cntmax_pkts) - { - int l4_proto=0; - enum session_type type= session_get_type(sess); - if(type == SESSION_TYPE_TCP) - { - l4_proto=6; - } - if(type == SESSION_TYPE_UDP) - { - l4_proto=17; - } - identify_continue=lpi_detector(sess, context, env, payload, payload_len, l4_proto); - context->is_first_payload=0; - } - else - { - identify_continue=1; - } - - if (identify_continue==0) - { - FREE(context); - session_exdata_set(sess, env->plugin_exdata_idx, NULL); - stellar_session_plugin_dettach_current_session(sess); - } - return; -} - - -extern "C" void lpi_plugin_unload(void *plugin_env) -{ - if(plugin_env) - { - struct lpi_plugin_env *env=(struct lpi_plugin_env *)plugin_env; - lpi_free_library(); - free_l7_protocol_mapper(env->name_by_id); - FREE(plugin_env); - } -} - -extern "C" void * lpi_plugin_load(struct stellar *st) -{ - int ret=0; - struct lpi_plugin_env *env=CALLOC(struct lpi_plugin_env, 1); - env->st=st; - env->max_pkts=16; - strcpy( env->l7_protocol_file, "./tsgconf/tsg_l7_protocol.conf"); - - ret=lpi_init_library(1); // 1, 2 or 3 - if(ret<0) - { - goto INIT_ERROR; - } - - ret=l7_protocol_mapper(env,env->l7_protocol_file); - if(ret<0) - { - goto INIT_ERROR; - } - - env->plugin_id=stellar_session_plugin_register(st, NULL, NULL, env); - if(env->plugin_id < 0) - { - goto INIT_ERROR; - } - env->tcp_topic_id=stellar_mq_get_topic_id(st, TOPIC_TCP_INPUT); - env->udp_topic_id=stellar_mq_get_topic_id(st, TOPIC_UDP_INPUT); - if(env->tcp_topic_id < 0 || env->udp_topic_id < 0) - { - perror("get tcp or udp topic id failed\n"); - exit(-1); - } - - stellar_session_mq_subscribe(st, env->tcp_topic_id, lpi_plugin_on_session_msg, env->plugin_id); - stellar_session_mq_subscribe(st, env->udp_topic_id, lpi_plugin_on_session_msg, env->plugin_id); - - env->plugin_exdata_idx = stellar_exdata_new_index(st, "EXDATA_LPI", stellar_exdata_free_default, NULL); - env->l7_app_id_exdata_idx = stellar_exdata_new_index(st, "L7_PROTOCOL", stellar_exdata_free_default, NULL); - env->topic_id=stellar_mq_get_topic_id(st, APP_ID_MESSAGE_TOPIC); - if(env->topic_id < 0) - { - env->topic_id=stellar_mq_create_topic(st, APP_ID_MESSAGE_TOPIC, stellar_msg_free_default, NULL); - } - return env; - -INIT_ERROR: - lpi_plugin_unload(env); - exit(-1); - return NULL; - -} - diff --git a/decoders/lpi/lpi_plugin.h b/decoders/lpi/lpi_plugin.h deleted file mode 100644 index 2fae274..0000000 --- a/decoders/lpi/lpi_plugin.h +++ /dev/null @@ -1,227 +0,0 @@ -#pragma once - -#include "libprotoident/libprotoident.h" -#include "uthash/uthash.h" - -#define MAX_APP_ID_NUM 8 - -typedef enum { - LPI_PROTO_EXTEND_FRIST = LPI_PROTO_LAST, - LPI_PROTO_IKE, //unsupport - LPI_PROTO_DOH, //unsupport - LPI_PROTO_MAIL, //unsupport - LPI_PROTO_ESNI, //unsupport - LPI_PROTP_FTPS, - LPI_PROTO_EXTEND_LAST -} extend_lpi_protocol_t; - -struct l7_protocol_label -{ - int continue_scan_flag; //0: stop; 1: continue - int protocol_id_num; - unsigned short protocol_id[MAX_APP_ID_NUM]; -}; - -struct l7_protocol_hash -{ - int protocol_id; - int lpi_protocol; - char name[64]; - UT_hash_handle hh; -}; - - -struct ovpn_ctx -{ - uint64_t local_session_id; - int contain_local_session_id_pkt_num; - int valid_opcode_cnt; -}; - -struct traffic_context -{ - unsigned char is_identify; - unsigned char is_first_payload; - unsigned short pkt_cnt; - unsigned short s2c_pkt; - unsigned short c2s_pkt; - lpi_data_t lpi_data; // lpi API - union{ - uint64_t ctx[2]; - struct ovpn_ctx ovpn; - }; -}; - -//https://github.com/quicwg/base-drafts/wiki/QUIC-Versions -enum _QUIC_VERSION -{ - QUIC_VERSION_UNKNOWN=0, - //NetApp - QUANT_VERSION_00=0x45474700, - QUANT_VERSION_FF=0x454747FF, - - //Private Octopus - PICOQUIC_VERSION_30=0x50435130, - - //google - GQUIC_VERSION_Q001=0x51303031, - GQUIC_VERSION_Q002=0x51303032, - GQUIC_VERSION_Q003=0x51303033, - GQUIC_VERSION_Q004=0x51303034, - GQUIC_VERSION_Q005=0x51303035, - GQUIC_VERSION_Q006=0x51303036, - GQUIC_VERSION_Q007=0x51303037, - GQUIC_VERSION_Q008=0x51303038, - GQUIC_VERSION_Q009=0x51303039, - - GQUIC_VERSION_Q010=0x51303130, - GQUIC_VERSION_Q011=0x51303131, - GQUIC_VERSION_Q012=0x51303132, - GQUIC_VERSION_Q013=0x51303133, - GQUIC_VERSION_Q014=0x51303134, - GQUIC_VERSION_Q015=0x51303135, - GQUIC_VERSION_Q016=0x51303136, - GQUIC_VERSION_Q017=0x51303137, - GQUIC_VERSION_Q018=0x51303138, - GQUIC_VERSION_Q019=0x51303139, - - GQUIC_VERSION_Q020=0x51303230, - GQUIC_VERSION_Q021=0x51303231, - GQUIC_VERSION_Q022=0x51303232, - GQUIC_VERSION_Q023=0x51303233, - GQUIC_VERSION_Q024=0x51303234, - GQUIC_VERSION_Q025=0x51303235, - GQUIC_VERSION_Q026=0x51303236, - GQUIC_VERSION_Q027=0x51303237, - GQUIC_VERSION_Q028=0x51303238, - GQUIC_VERSION_Q029=0x51303239, - - GQUIC_VERSION_Q030=0x51303330, - GQUIC_VERSION_Q031=0x51303331, - GQUIC_VERSION_Q032=0x51303332, - GQUIC_VERSION_Q033=0x51303333, - GQUIC_VERSION_Q034=0x51303334, - GQUIC_VERSION_Q035=0x51303335, - GQUIC_VERSION_Q036=0x51303336, - GQUIC_VERSION_Q037=0x51303337, - GQUIC_VERSION_Q038=0x51303338, - GQUIC_VERSION_Q039=0x51303339, - - GQUIC_VERSION_Q040=0x51303430, - GQUIC_VERSION_Q041=0x51303431, - GQUIC_VERSION_Q042=0x51303432, - GQUIC_VERSION_Q043=0x51303433, - GQUIC_VERSION_Q044=0x51303434, - GQUIC_VERSION_Q045=0x51303435, - GQUIC_VERSION_Q046=0x51303436, - GQUIC_VERSION_Q047=0x51303437, - GQUIC_VERSION_Q048=0x51303438, - GQUIC_VERSION_Q049=0x51303439, - - GQUIC_VERSION_Q050=0x51303530, - GQUIC_VERSION_Q051=0x51303531, - GQUIC_VERSION_Q052=0x51303532, - GQUIC_VERSION_Q053=0x51303533, - GQUIC_VERSION_Q054=0x51303534, - GQUIC_VERSION_Q055=0x51303535, - GQUIC_VERSION_Q056=0x51303536, - GQUIC_VERSION_Q057=0x51303537, - GQUIC_VERSION_Q058=0x51303538, - GQUIC_VERSION_Q059=0x51303539, - - GQUIC_VERSION_Q099=0x51303939, - - //Google QUIC with TLS 48 - 49 (T048 - T049) - GQUIC_VERSION_T048=0x54303438, - GQUIC_VERSION_T049=0x54303439, - - //Google QUIC with TLS 50 - 59 (T050 - T059) - GQUIC_VERSION_T050=0x54303530, - GQUIC_VERSION_T051=0x54303531, - GQUIC_VERSION_T052=0x54303532, - GQUIC_VERSION_T053=0x54303533, - GQUIC_VERSION_T054=0x54303534, - GQUIC_VERSION_T055=0x54303535, - GQUIC_VERSION_T056=0x54303536, - GQUIC_VERSION_T057=0x54303537, - GQUIC_VERSION_T058=0x54303538, - GQUIC_VERSION_T059=0x54303539, - - //Google QUIC with TLS 99 (T099) - GQUIC_VERSION_T099=0x54303939, - - //Google Proxied QUIC - PQUIC_VERSION_PROX=0x50524f58, - - //quic-go - QUIC_GO_VERSION_00=0x51474F00, - QUIC_GO_VERSION_FF=0x51474FFF, - - //quicly - QUICLY_VERSION_00=0x91c17000, - QUICLY_VERSION_FF=0x91c170FF, - - //Microsoft - MSQUIC_VERSION_00=0xabcd0000, - MSQUIC_VERSION_0F=0xabcd000F, - - //Mozilla - MOZQUIC_VERSION_00=0xf123f0c0, - MOZQUIC_VERSION_0F=0xf123f0cF, - - //Facebook - MVFST_VERSION_00=0xfaceb000, - MVFST_VERSION_01=0xfaceb001, - MVFST_VERSION_02=0xfaceb002, - MVFST_VERSION_03=0xfaceb003, - MVFST_VERSION_04=0xfaceb004, - MVFST_VERSION_05=0xfaceb005, - MVFST_VERSION_06=0xfaceb006, - MVFST_VERSION_07=0xfaceb007, - MVFST_VERSION_08=0xfaceb008, - MVFST_VERSION_09=0xfaceb009, - MVFST_VERSION_0A=0xfaceb00A, - MVFST_VERSION_0B=0xfaceb00B, - MVFST_VERSION_0C=0xfaceb00C, - MVFST_VERSION_0D=0xfaceb00D, - MVFST_VERSION_0E=0xfaceb00E, - MVFST_VERSION_0F=0xfaceb00F, - - //IETF - IQUIC_VERSION_RFC9000=0x00000001, - IQUIC_VERSION_I001=0xFF000001, - IQUIC_VERSION_I002=0xFF000002, - IQUIC_VERSION_I003=0xFF000003, - IQUIC_VERSION_I004=0xFF000004, - IQUIC_VERSION_I005=0xFF000005, - IQUIC_VERSION_I006=0xFF000006, - IQUIC_VERSION_I007=0xFF000007, - IQUIC_VERSION_I008=0xFF000008, - IQUIC_VERSION_I009=0xFF000009, - IQUIC_VERSION_I010=0xFF00000A, - IQUIC_VERSION_I011=0xFF00000B, - IQUIC_VERSION_I012=0xFF00000C, - IQUIC_VERSION_I013=0xFF00000D, - IQUIC_VERSION_I014=0xFF00000E, - IQUIC_VERSION_I015=0xFF00000F, - IQUIC_VERSION_I016=0xFF000010, - IQUIC_VERSION_I017=0xFF000011, - IQUIC_VERSION_I018=0xFF000012, - IQUIC_VERSION_I019=0xFF000013, - IQUIC_VERSION_I020=0xFF000014, - IQUIC_VERSION_I021=0xFF000015, - IQUIC_VERSION_I022=0xFF000016, - IQUIC_VERSION_I023=0xFF000017, - IQUIC_VERSION_I024=0xFF000018, - IQUIC_VERSION_I025=0xFF000019, - IQUIC_VERSION_I026=0xFF00001A, - IQUIC_VERSION_I027=0xFF00001B, - IQUIC_VERSION_I028=0xFF00001C, - IQUIC_VERSION_I029=0xFF00001D, - IQUIC_VERSION_I030=0xFF00001E, - IQUIC_VERSION_I031=0xFF00001F, - IQUIC_VERSION_I032=0xFF000020 -}; - -enum _QUIC_VERSION app_identify_get_quic_protocol(int curdir_is_c2s, const unsigned char *payload, const int payload_len); -int app_identify_guess_openvpn(const unsigned char *payload, int payload_len, int c2s_pkt_cnt, int s2c_pkt_cnt, struct ovpn_ctx *ovpn, int l4_is_tcp, int curdir_is_c2s); \ No newline at end of file diff --git a/decoders/lpi/openvpn_ident.cpp b/decoders/lpi/openvpn_ident.cpp deleted file mode 100644 index 5c40eaf..0000000 --- a/decoders/lpi/openvpn_ident.cpp +++ /dev/null @@ -1,183 +0,0 @@ -/* - * openvpn.c - * - * Copyright (C) 2011-22 - ntop.org - * - * - * nDPI is free software: you can redistribute it and/or modify - * it under the terms of the GNU Lesser General Public License as published by - * the Free Software Foundation, either version 3 of the License, or - * (at your option) any later version. - * - * nDPI is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public License - * along with nDPI. If not, see . - * - */ - - - -#include -#include - -#include "lpi_plugin.h" -/* - * OpenVPN TCP / UDP Detection - 128/160 hmac - * - * Detection based upon these openvpn protocol properties: - * - opcode - * - packet ID - * - session ID - * - * Two (good) packets are needed to perform detection. - * - First packet from client: save session ID - * - Second packet from server: report saved session ID - * - * TODO - * - Support PSK only mode (instead of TLS) - * - Support PSK + TLS mode (PSK used for early authentication) - * - TLS certificate extraction - * - */ - -#define P_CONTROL_HARD_RESET_CLIENT_V1 (0x01 << 3) -#define P_CONTROL_HARD_RESET_CLIENT_V2 (0x07 << 3) -#define P_CONTROL_HARD_RESET_SERVER_V1 (0x02 << 3) -#define P_CONTROL_HARD_RESET_SERVER_V2 (0x08 << 3) -#define P_ACK_V1 (0x05 << 3) -#define P_CONTROL_V1 (0x04 << 3) -#define P_OPCODE_MASK 0xF8 -#define P_SHA1_HMAC_SIZE 20 -#define P_HMAC_128 16 // (RSA-)MD5, (RSA-)MD4, ..others -#define P_HMAC_160 20 // (RSA-|DSA-)SHA(1), ..others, SHA1 is openvpn default -#define P_HMAC_NONE 0 -#define P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) (9 + hmac_size) -#define P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size) (P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) + 8) -#define P_HARD_RESET_CLIENT_MAX_COUNT 5 - -static inline uint32_t get_packet_id(const uint8_t * payload, uint8_t hms) { - return(ntohl(*(uint32_t*)(payload + P_HARD_RESET_PACKET_ID_OFFSET(hms)))); -} - -static inline int8_t check_pkid_and_detect_hmac_size(const uint8_t * payload) { - // try to guess - if((int)get_packet_id(payload, P_HMAC_160) != 0) - return P_HMAC_160; - - if((int)get_packet_id(payload, P_HMAC_128) != 0 ) - return P_HMAC_128; - - if((int)get_packet_id(payload, P_HMAC_NONE) != 0) - return P_HMAC_NONE; - - return(-1); -} - -int app_identify_guess_openvpn(const unsigned char *payload, int payload_len, int c2s_pkt_cnt, int s2c_pkt_cnt, struct ovpn_ctx *ovpn, int l4_is_tcp, int curdir_is_c2s) -{ - const uint8_t * session_remote; - uint8_t opcode; - uint8_t alen; - int8_t hmac_size; - int8_t failed = 0; - - if (c2s_pkt_cnt > 5) - { - if (ovpn->contain_local_session_id_pkt_num == P_HARD_RESET_CLIENT_MAX_COUNT - 1 && ovpn->valid_opcode_cnt == P_HARD_RESET_CLIENT_MAX_COUNT) - return 1; - return -1; - } - - if (payload_len >= 40) - { - // skip openvpn TCP transport packet size - if (l4_is_tcp) - payload += 2, payload_len -= 2; - - opcode = payload[0] & P_OPCODE_MASK; - if (curdir_is_c2s == 1 && - (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || - opcode == P_CONTROL_HARD_RESET_CLIENT_V2 || - opcode == P_ACK_V1 || - opcode == P_CONTROL_V1)) - { - ovpn->valid_opcode_cnt++; - } - // for UDP, trying to identify by opcode and first packet length - if (l4_is_tcp == 0) - { - if ((c2s_pkt_cnt == 1 || s2c_pkt_cnt == 1) && (((payload_len == 112) && ((opcode == 168) || (opcode == 192))) || ((payload_len == 80) && ((opcode == 184) || (opcode == 88) || (opcode == 160) || (opcode == 168) || (opcode == 200))))) - { - return 1; - } - } - - if(s2c_pkt_cnt >= 1 && curdir_is_c2s == 0)return 0; - - if (curdir_is_c2s == 1 && c2s_pkt_cnt <= P_HARD_RESET_CLIENT_MAX_COUNT && (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || opcode == P_CONTROL_HARD_RESET_CLIENT_V2 || opcode == P_ACK_V1 || opcode == P_CONTROL_V1)) - { - if (check_pkid_and_detect_hmac_size(payload) >= 0) - { - if (c2s_pkt_cnt > 1) - { - if (memcmp(&ovpn->local_session_id, payload + 1, 8) == 0) - { - ovpn->contain_local_session_id_pkt_num++; - } - } - memcpy(&ovpn->local_session_id, payload + 1, 8); - } - } - else if (c2s_pkt_cnt >= 1 && c2s_pkt_cnt <= P_HARD_RESET_CLIENT_MAX_COUNT && - (opcode == P_CONTROL_HARD_RESET_SERVER_V1 || opcode == P_CONTROL_HARD_RESET_SERVER_V2)) - { - - hmac_size = check_pkid_and_detect_hmac_size(payload); - - if (hmac_size >= 0) - { - u_int16_t offset = P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size); - - alen = payload[offset]; - - if (alen > 0) - { - offset += 1 + alen * 4; - - if ((offset + 8) <= payload_len) - { - session_remote = &payload[offset]; - - if (memcmp(&ovpn->local_session_id, session_remote, 8) == 0) - { - - return 1; - } - else - { - - failed = 1; - } - } - else - failed = 1; - } - else - failed = 1; - } - else - failed = 1; - } - else - failed = 1; - - if (failed) - return -1; - } - - return 0; -} \ No newline at end of file diff --git a/decoders/lpi/quic_ident.cpp b/decoders/lpi/quic_ident.cpp deleted file mode 100644 index f1d5659..0000000 --- a/decoders/lpi/quic_ident.cpp +++ /dev/null @@ -1,237 +0,0 @@ -#include -#include "lpi_plugin.h" - -#define GQUIC_PUBLIC_FLAG_VERSION 0x01 -#define GQUIC_PUBLIC_FLAG_RST 0x02 -#define GQUIC_PUBLIC_FLAG_NONCE 0x04 -#define GQUIC_PUBLIC_FLAG_CID 0x08 -#define GQUIC_PUBLIC_FLAG_PKT_NUM 0x30 - -//GQIIC Frame type -#define GQUIC_SPECIAL_FRAME_FLAG 0xE0 // Special Frame Types -#define GQUIC_SPECIAL_FRAME_STREAM 0x80 -#define GQUIC_SPECIAL_FRAME_ACK 0x40 -#define GQUIC_SPECIAL_FRAME_CONGEST_FB 0x20 - -#define GQUIC_SPECIAL_FRAME_STREAM_FIN 0x40 // FIN -#define GQUIC_SPECIAL_FRAME_STREAM_DLEN 0x20 //stream length -#define GQUIC_SPECIAL_FRAME_STREAM_OFFSET 0x1C //offset header field -#define GQUIC_SPECIAL_FRAME_STREAM_ID 0x03 //offset header field - -#define GQUIC_REGULAR_FRAME_PADDING 0x00 -#define GQUIC_REGULAR_FRAME_RST_STREAM 0x01 -#define GQUIC_REGULAR_FRAME_CONNECTION_CLOSE 0x02 -#define GQUIC_REGULAR_FRAME_GOAWAY 0x03 -#define GQUIC_REGULAR_FRAME_WINDOW_UPDATE 0x04 -#define GQUIC_REGULAR_FRAME_BLOCKED 0x05 -#define GQUIC_REGULAR_FRAME_STOP_WAITING 0x06 -#define GQUIC_REGULAR_FRAME_PING 0x07 - -#define GQUIC_SPECIAL_FRAME_FLAG 0xE0 // Special Frame Types -#define GQUIC_SPECIAL_FRAME_STREAM 0x80 -#define GQUIC_SPECIAL_FRAME_ACK 0x40 -#define GQUIC_SPECIAL_FRAME_CONGEST_FB 0x20 - -#define GQUIC_SPECIAL_FRAME_STREAM_FIN 0x40 // FIN -#define GQUIC_SPECIAL_FRAME_STREAM_DLEN 0x20 //stream length -#define GQUIC_SPECIAL_FRAME_STREAM_OFFSET 0x1C //offset header field -#define GQUIC_SPECIAL_FRAME_STREAM_ID 0x03 //offset header field - -#define GQUIC_REGULAR_FRAME_PADDING 0x00 -#define GQUIC_REGULAR_FRAME_RST_STREAM 0x01 -#define GQUIC_REGULAR_FRAME_CONNECTION_CLOSE 0x02 -#define GQUIC_REGULAR_FRAME_GOAWAY 0x03 -#define GQUIC_REGULAR_FRAME_WINDOW_UPDATE 0x04 -#define GQUIC_REGULAR_FRAME_BLOCKED 0x05 -#define GQUIC_REGULAR_FRAME_STOP_WAITING 0x06 -#define GQUIC_REGULAR_FRAME_PING 0x07 - -//IQIIC Frame type (GQUIC_Q046 is iQUIC 17) -#define IQUIC_FRAME_PADDING 0x00 -#define IQUIC_FRAME_PING 0x10 -#define IQUIC_FRAME_ACK_HEX02 0x20 -#define IQUIC_FRAME_ACK_HEX03 0x30 -#define IQUIC_FRAME_RESET_STREAM 0x40 -#define IQUIC_FRAME_STOP_SENDING 0x50 -#define IQUIC_FRAME_CRYPTO 0x60 -#define IQUIC_FRAME_NEW_TOKEN 0x70 -#define IQUIC_FRAME_STREAM_HEX08 0x80 -#define IQUIC_FRAME_STREAM_HEX09 0x90 -#define IQUIC_FRAME_STREAM_HEX0A 0xA0 -#define IQUIC_FRAME_STREAM_HEX0B 0xB0 -#define IQUIC_FRAME_STREAM_HEX0C 0xC0 -#define IQUIC_FRAME_STREAM_HEX0D 0xD0 -#define IQUIC_FRAME_STREAM_HEX0E 0xE0 -#define IQUIC_FRAME_STREAM_HEX0F 0xF0 -#define IQUIC_FRAME_MAX_DATA 0x01 -#define IQUIC_FRAME_MAX_STREAM_DATA 0x11 -#define IQUIC_FRAME_MAX_STREAMS_HEX12 0x21 -#define IQUIC_FRAME_MAX_STREAMS_HEX13 0x31 -#define IQUIC_FRAME_DATA_BLOCKED 0x41 -#define IQUIC_FRAME_STREAM_DATA_BLOCKED 0x51 -#define IQUIC_FRAME_STREAMS_BLOCKED_HEX16 0x61 -#define IQUIC_FRAME_STREAMS_BLOCKED_HEX17 0x71 -#define IQUIC_FRAME_NEW_CONNECTION_ID 0x81 -#define IQUIC_FRAME_RETIRE_CONNECTION_ID 0x91 -#define IQUIC_FRAME_PATH_CHALLENGE 0xA1 -#define IQUIC_FRAME_PATH_RESPONSE 0xB1 -#define IQUIC_FRAME_CONNECTION_CLOSE_HEX1C 0xC1 -#define IQUIC_FRAME_CONNECTION_CLOSE_HEX1D 0xD1 - - -/**************************************************************************/ -/* Message tag */ -/**************************************************************************/ -#define CHLO 0x43484C4F -#define SHLO 0x53484C4F -#define REJ 0x52454A00 -#define PRST 0x50525354 - - -/**************************************************************************/ -/* Tag */ -/**************************************************************************/ -#define TAG_PAD 0x50414400 -#define TAG_SNI 0x534E4900 -#define TAG_VER 0x56455200 -#define TAG_CCS 0x43435300 -#define TAG_UAID 0x55414944 -#define TAG_PDMD 0x50444d44 -#define TAG_STK 0x53544b00 -#define TAG_SNO 0x534E4F00 -#define TAG_PROF 0x50524F46 -#define TAG_SCFG 0x53434647 -#define TAG_RREJ 0x5252454A -#define TAG_CRT 0x435254FF -#define TAG_AEAD 0x41454144 -#define TAG_SCID 0x53434944 -#define TAG_PUBS 0x50554253 -#define TAG_KEXS 0x4B455853 -#define TAG_OBIT 0x4F424954 -#define TAG_EXPY 0x45585059 -#define TAG_NONC 0x4E4F4E43 -#define TAG_MSPC 0x4D535043 -#define TAG_TCID 0x54434944 -#define TAG_SRBF 0x53524246 -#define TAG_ICSL 0x4943534C -#define TAG_SCLS 0x53434C53 -#define TAG_COPT 0x434F5054 -#define TAG_CCRT 0x43435254 -#define TAG_IRTT 0x49525454 -#define TAG_CFCW 0x43464357 -#define TAG_SFCW 0x53464357 -#define TAG_CETV 0x43455456 -#define TAG_XLCT 0x584C4354 -#define TAG_NONP 0x4E4F4E50 -#define TAG_CSCT 0x43534354 -#define TAG_CTIM 0x4354494D -#define TAG_MIDS 0x4D494453 -#define TAG_FHOL 0x46484F4C -#define TAG_STTL 0x5354544C -#define TAG_SMHL 0x534D484C -#define TAG_TBKP 0x54424B50 - -/* Public Reset Tag */ -#define TAG_RNON 0x524E4F4E -#define TAG_RSEQ 0x52534551 -#define TAG_CADR 0x43414452 - -#define EXTENSION_SERVER_NAME 0x0000 -#define EXTENSION_SUPPORT_GROUP 0x000A -#define EXTENSION_APP_PROT_NEGO 0x0010 //application layer protocol negotiation -#define EXTENSION_SIG_ALGORITHM 0x000D -#define EXTENSION_KEY_SHARE 0x0033 -#define EXTENSION_PSK_EXCHANGE 0x002D -#define EXTENSION_SUPP_SSL_VER 0x002B -#define EXTENSION_QUIC_PARAM 0xFFA5 -#define EXTENSION_COMPRESS_CERT 0x001B - -#define EXT_QUIC_PARAM_MAX_IDLE_TIMEOUT 0x01 -#define EXT_QUIC_PARAM_MAX_UDP_PAYLOAD 0x03 -#define EXT_QUIC_PARAM_MAX_INIT_DATA 0x04 -#define EXT_QUIC_PARAM_MAX_STREAM_BIDI_LOCAL 0x05 -#define EXT_QUIC_PARAM_MAX_STREAM_BIDI_REMOTE 0x06 -#define EXT_QUIC_PARAM_MAX_STREAM_UNI 0x07 -#define EXT_QUIC_PARAM_MAX_STREAMS_BIDI 0x08 -#define EXT_QUIC_PARAM_MAX_STREAMS_UNI 0x09 -#define EXT_QUIC_PARAM_MAX_FRAME_SIZE 0x20 -#define EXT_QUIC_PARAM_INIT_SRC_CONN_ID 0x0F -#define EXT_QUIC_PARAM_USER_AGENT 0x7129 -#define EXT_QUIC_PARAM_NOT_YET_SUPPORTED 0x712B -#define EXT_QUIC_PARAM_QUIC_VERSION 0x80004752 -#define EXT_QUIC_PARAM_GREASE_LOW4 0x91D24E9B -#define EXT_QUIC_PARAM_GREASE_HIGH4 0xEA666DE7 - -#define EXTENSION_QUIC_PARAM_UA 0x7129 -#define EXTENSION_QUIC_PARAM_VERSION 0x4752 - -enum _QUIC_VERSION app_identify_get_quic_protocol(int curdir_is_c2s, const unsigned char *payload, const int payload_len) -{ - enum _QUIC_VERSION quic_version = QUIC_VERSION_UNKNOWN; - - if(payload_len<5) - { - return QUIC_VERSION_UNKNOWN; - } - - // Q001~Q043: 0x80 is currently unused, and must be set to 0 - - // The most significant bit (0x80) of byte 0 (the first byte) is set to 1 for long headers - (payload[0] & 0x80) ? (quic_version = (enum _QUIC_VERSION)ntohl(*(unsigned int *)(payload + 1))) : QUIC_VERSION_UNKNOWN; - if ( - (quic_version == GQUIC_VERSION_Q099) || - (quic_version == PICOQUIC_VERSION_30) || - (quic_version == PQUIC_VERSION_PROX) || - (quic_version == GQUIC_VERSION_T099) || - (quic_version >= GQUIC_VERSION_Q044 && quic_version <= GQUIC_VERSION_Q050) || - (quic_version >= GQUIC_VERSION_Q051 && quic_version <= GQUIC_VERSION_Q059) || - (quic_version >= GQUIC_VERSION_T048 && quic_version <= GQUIC_VERSION_T049) || - (quic_version >= GQUIC_VERSION_T050 && quic_version <= GQUIC_VERSION_T059) || - (quic_version >= QUANT_VERSION_00 && quic_version <= QUANT_VERSION_FF) || - (quic_version >= QUIC_GO_VERSION_00 && quic_version <= QUIC_GO_VERSION_FF) || - (quic_version >= QUICLY_VERSION_00 && quic_version <= QUICLY_VERSION_FF) || - (quic_version >= MSQUIC_VERSION_00 && quic_version <= MSQUIC_VERSION_0F) || - (quic_version >= MOZQUIC_VERSION_00 && quic_version <= MOZQUIC_VERSION_0F) || - (quic_version >= MVFST_VERSION_00 && quic_version <= MVFST_VERSION_0F) || - (quic_version >= IQUIC_VERSION_I001 && quic_version <= IQUIC_VERSION_I032) || - (quic_version == IQUIC_VERSION_RFC9000)) - { - return quic_version; - } - - char public_flags=payload[0]; - int used_len = 1; - if(curdir_is_c2s==0 && public_flags & GQUIC_PUBLIC_FLAG_VERSION) - { - return QUIC_VERSION_UNKNOWN; - } - if((!public_flags)&GQUIC_PUBLIC_FLAG_PKT_NUM) - { - if(public_flags&GQUIC_PUBLIC_FLAG_VERSION) //Public Reset Packet - { - return QUIC_VERSION_UNKNOWN;// todo - } - else // Version Negotiation Packet - { - return QUIC_VERSION_UNKNOWN; - } - } - if(public_flags&GQUIC_PUBLIC_FLAG_CID) - { - used_len+=sizeof(unsigned long long); // CID length - } - - if(payload_len>=(int)(used_len+sizeof(int)) && public_flags&GQUIC_PUBLIC_FLAG_VERSION && (*(unsigned char *)(payload+used_len)==0x51)) - { - quic_version=(enum _QUIC_VERSION)ntohl(*(unsigned int *)(payload+used_len)); - used_len+=sizeof(int); // skip version - } - - if(quic_versionGQUIC_VERSION_Q043) - { - return QUIC_VERSION_UNKNOWN; - } - - return quic_version; -} - diff --git a/decoders/lpi/version.map b/decoders/lpi/version.map deleted file mode 100644 index 63ee411..0000000 --- a/decoders/lpi/version.map +++ /dev/null @@ -1,10 +0,0 @@ -VERS_2.4{ -global: -extern "C" { - lpi_plugin_load; - lpi_plugin_unload; - GIT_VERSION_*; -}; - -local: *; -}; diff --git a/decoders/lpi/.gitignore b/decoders/lpi_plus/.gitignore similarity index 100% rename from decoders/lpi/.gitignore rename to decoders/lpi_plus/.gitignore diff --git a/decoders/lpi_plus/CMakeLists.txt b/decoders/lpi_plus/CMakeLists.txt new file mode 100644 index 0000000..b5da11a --- /dev/null +++ b/decoders/lpi_plus/CMakeLists.txt @@ -0,0 +1,13 @@ +add_definitions(-fPIC) +add_subdirectory(libprotoident) + +add_library(lpi_plus lpip_module.c lpip_extend.c) +target_include_directories(lpi_plus PUBLIC ${CMAKE_SOURCE_DIR}/deps/) +target_include_directories(lpi_plus PUBLIC ${CMAKE_SOURCE_DIR}/decoders/) + +target_link_libraries(lpi_plus libprotoident appid) +set_target_properties(lpi_plus PROPERTIES LINK_FLAGS + "-Wl,--version-script=${CMAKE_CURRENT_SOURCE_DIR}/version.map") + +#install(TARGETS ${PROJECT_NAME} LIBRARY DESTINATION ${CMAKE_INSTALL_PREFIX}/stellar_plugin COMPONENT LIBRARIES) + diff --git a/decoders/lpi/libprotoident/CMakeLists.txt b/decoders/lpi_plus/libprotoident/CMakeLists.txt similarity index 100% rename from decoders/lpi/libprotoident/CMakeLists.txt rename to decoders/lpi_plus/libprotoident/CMakeLists.txt diff --git a/decoders/lpi/libprotoident/libprotoident.cc b/decoders/lpi_plus/libprotoident/libprotoident.cc similarity index 99% rename from decoders/lpi/libprotoident/libprotoident.cc rename to decoders/lpi_plus/libprotoident/libprotoident.cc index f5baf58..e3f1db1 100644 --- a/decoders/lpi/libprotoident/libprotoident.cc +++ b/decoders/lpi_plus/libprotoident/libprotoident.cc @@ -29,12 +29,10 @@ #include #include -//#include #include #include #include #include -#include #include "libprotoident.h" #include "proto_manager.h" @@ -53,7 +51,7 @@ static LPIProtocolMap lpi_protocols; static LPICategoryMap lpi_categories; static LPICategoryProtocolMap lpi_category_protocols; -int lpi_init_library(int level) { +int lpi_init_library() { if (init_called) { fprintf(stderr, "WARNING: lpi_init_library has already been called\n"); diff --git a/decoders/lpi/libprotoident/libprotoident.h b/decoders/lpi_plus/libprotoident/libprotoident.h similarity index 98% rename from decoders/lpi/libprotoident/libprotoident.h rename to decoders/lpi_plus/libprotoident/libprotoident.h index 500d26a..3286276 100644 --- a/decoders/lpi/libprotoident/libprotoident.h +++ b/decoders/lpi_plus/libprotoident/libprotoident.h @@ -30,8 +30,8 @@ //#include #include -#include #include +#include #include @@ -716,22 +716,12 @@ struct lpi_module { }; -typedef std::list ProtoMatchList; - -typedef struct lpi_thread { - int index; - lpi_module_t *module; - lpi_data_t *data; - bool result; -} lpi_thread_t; - -typedef std::list ThreadList; /* Initialises the LPI library, by registering all the protocol modules. * * @return 0 if initialisation succeeded, -1 otherwise */ -int lpi_init_library(int level); +int lpi_init_library(); /* Shuts down the LPI library, by de-registering all the protocol modules */ void lpi_free_library(void); @@ -755,9 +745,6 @@ void lpi_init_data(lpi_data_t *data); * * @return 0 if the packet was ignored, 1 if the LPI data was updated. */ -int lpi_update_dpkt(lpi_data_t *data, struct streaminfo *pstream, - const char *scan_data, int scan_data_len, char tsproto, uint32_t plseq, - uint32_t _curdir); /** Returns a unique string describing the provided protocol. * diff --git a/decoders/lpi/libprotoident/proto_common.cc b/decoders/lpi_plus/libprotoident/proto_common.cc similarity index 100% rename from decoders/lpi/libprotoident/proto_common.cc rename to decoders/lpi_plus/libprotoident/proto_common.cc diff --git a/decoders/lpi/libprotoident/proto_common.h b/decoders/lpi_plus/libprotoident/proto_common.h similarity index 100% rename from decoders/lpi/libprotoident/proto_common.h rename to decoders/lpi_plus/libprotoident/proto_common.h diff --git a/decoders/lpi/libprotoident/proto_manager.cc b/decoders/lpi_plus/libprotoident/proto_manager.cc similarity index 100% rename from decoders/lpi/libprotoident/proto_manager.cc rename to decoders/lpi_plus/libprotoident/proto_manager.cc diff --git a/decoders/lpi/libprotoident/proto_manager.h b/decoders/lpi_plus/libprotoident/proto_manager.h similarity index 100% rename from decoders/lpi/libprotoident/proto_manager.h rename to decoders/lpi_plus/libprotoident/proto_manager.h diff --git a/decoders/lpi/libprotoident/tcp/lpi_300heroes.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_300heroes.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_300heroes.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_300heroes.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_360safeguard.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_360safeguard.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_360safeguard.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_360safeguard.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_4d.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_4d.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_4d.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_4d.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_acestream.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_acestream.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_acestream.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_acestream.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_afp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_afp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_afp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_afp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_airdroid.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_airdroid.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_airdroid.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_airdroid.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_airmedia.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_airmedia.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_airmedia.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_airmedia.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_akamai.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_akamai.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_akamai.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_akamai.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_amp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_amp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_amp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_amp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_antcoin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_antcoin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_antcoin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_antcoin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_appearin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_appearin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_appearin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_appearin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_apple_push.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_apple_push.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_apple_push.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_apple_push.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ares.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ares.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ares.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ares.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_badbaidu.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_badbaidu.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_badbaidu.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_badbaidu.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_baofeng_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_baofeng_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_baofeng_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_baofeng_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_beam.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_beam.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_beam.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_beam.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_bitcoin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_bitcoin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_bitcoin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_bitcoin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_bitextend.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_bitextend.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_bitextend.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_bitextend.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_bittorrent.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_bittorrent.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_bittorrent.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_bittorrent.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_blackdesert.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_blackdesert.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_blackdesert.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_blackdesert.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_blizzard.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_blizzard.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_blizzard.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_blizzard.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_btsync.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_btsync.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_btsync.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_btsync.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_bwsyncandshare.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_bwsyncandshare.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_bwsyncandshare.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_bwsyncandshare.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_cacaoweb.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_cacaoweb.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_cacaoweb.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_cacaoweb.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_cgp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_cgp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_cgp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_cgp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_chatango.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_chatango.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_chatango.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_chatango.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_cisco_vpn.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_cisco_vpn.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_cisco_vpn.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_cisco_vpn.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_clashofclans.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_clashofclans.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_clashofclans.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_clashofclans.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_classin_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_classin_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_classin_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_classin_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_clubbox.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_clubbox.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_clubbox.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_clubbox.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_cod_waw.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_cod_waw.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_cod_waw.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_cod_waw.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_conquer.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_conquer.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_conquer.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_conquer.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_crashplan.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_crashplan.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_crashplan.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_crashplan.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_crossfire_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_crossfire_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_crossfire_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_crossfire_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_cryptic.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_cryptic.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_cryptic.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_cryptic.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_cvs.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_cvs.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_cvs.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_cvs.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dahua_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dahua_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dahua_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dahua_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dash.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dash.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dash.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dash.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dell_backup.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dell_backup.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dell_backup.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dell_backup.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_destiny.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_destiny.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_destiny.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_destiny.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_diablo3.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_diablo3.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_diablo3.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_diablo3.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dianping_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dianping_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dianping_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dianping_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_directconnect.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_directconnect.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_directconnect.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_directconnect.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dnf.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dnf.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dnf.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dnf.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dns.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dns.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dns.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dns.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dogecoin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dogecoin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dogecoin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dogecoin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_douyu.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_douyu.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_douyu.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_douyu.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_douyu_chat.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_douyu_chat.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_douyu_chat.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_douyu_chat.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_duelingnetwork.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_duelingnetwork.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_duelingnetwork.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_duelingnetwork.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dvrns.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dvrns.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dvrns.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dvrns.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_dxp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_dxp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_dxp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_dxp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ea_games.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ea_games.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ea_games.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ea_games.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_emule.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_emule.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_emule.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_emule.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ethernetip.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ethernetip.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ethernetip.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ethernetip.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_eye.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_eye.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_eye.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_eye.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_facebook_turn.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_facebook_turn.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_facebook_turn.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_facebook_turn.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_fb_message.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_fb_message.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_fb_message.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_fb_message.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_fbcdn_ssl.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_fbcdn_ssl.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_fbcdn_ssl.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_fbcdn_ssl.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ffxiv.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ffxiv.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ffxiv.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ffxiv.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_filenori.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_filenori.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_filenori.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_filenori.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_flash.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_flash.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_flash.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_flash.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_fliggy.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_fliggy.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_fliggy.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_fliggy.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_fring.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_fring.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_fring.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_fring.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ftpcontrol.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ftpcontrol.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ftpcontrol.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ftpcontrol.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ftpdata.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ftpdata.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ftpdata.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ftpdata.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_fuckcoin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_fuckcoin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_fuckcoin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_fuckcoin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_funshion.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_funshion.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_funshion.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_funshion.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_gamespy.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_gamespy.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_gamespy.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_gamespy.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_gcafe_updater.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_gcafe_updater.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_gcafe_updater.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_gcafe_updater.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_giop.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_giop.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_giop.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_giop.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_git.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_git.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_git.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_git.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_glupteba.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_glupteba.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_glupteba.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_glupteba.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_gnutella.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_gnutella.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_gnutella.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_gnutella.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_goku.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_goku.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_goku.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_goku.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_googlehangouts.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_googlehangouts.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_googlehangouts.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_googlehangouts.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_graalonlineera.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_graalonlineera.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_graalonlineera.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_graalonlineera.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_guildwars2.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_guildwars2.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_guildwars2.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_guildwars2.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_hamachi.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_hamachi.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_hamachi.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_hamachi.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_harveys.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_harveys.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_harveys.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_harveys.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_hearthstone.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_hearthstone.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_hearthstone.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_hearthstone.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_hola.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_hola.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_hola.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_hola.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_hots_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_hots_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_hots_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_hots_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_http.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_http.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_http.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_http.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_http_badport.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_http_badport.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_http_badport.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_http_badport.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_http_nonstandard.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_http_nonstandard.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_http_nonstandard.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_http_nonstandard.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_http_tunnel.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_http_tunnel.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_http_tunnel.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_http_tunnel.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_https.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_https.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_https.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_https.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ica.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ica.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ica.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ica.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_icep.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_icep.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_icep.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_icep.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_id.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_id.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_id.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_id.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_idrivesync.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_idrivesync.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_idrivesync.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_idrivesync.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ihexin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ihexin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ihexin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ihexin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_imap.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_imap.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_imap.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_imap.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_imaps.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_imaps.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_imaps.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_imaps.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_imesh.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_imesh.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_imesh.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_imesh.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_invalid.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_invalid.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_invalid.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_invalid.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_invalid_bittorrent.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_invalid_bittorrent.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_invalid_bittorrent.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_invalid_bittorrent.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_invalid_http.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_invalid_http.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_invalid_http.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_invalid_http.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_invalid_pop.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_invalid_pop.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_invalid_pop.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_invalid_pop.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_invalid_smtp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_invalid_smtp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_invalid_smtp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_invalid_smtp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ipfs.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ipfs.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ipfs.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ipfs.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ipop.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ipop.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ipop.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ipop.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ipsharkk.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ipsharkk.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ipsharkk.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ipsharkk.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_irc.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_irc.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_irc.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_irc.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_java.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_java.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_java.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_java.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_jedi.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_jedi.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_jedi.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_jedi.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_jx3online.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_jx3online.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_jx3online.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_jx3online.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_kakao.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_kakao.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_kakao.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_kakao.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_kankan_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_kankan_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_kankan_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_kankan_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_kaseya.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_kaseya.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_kaseya.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_kaseya.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_kaspersky.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_kaspersky.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_kaspersky.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_kaspersky.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_kik.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_kik.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_kik.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_kik.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_kingofglory_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_kingofglory_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_kingofglory_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_kingofglory_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_kuaibo.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_kuaibo.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_kuaibo.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_kuaibo.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ldap.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ldap.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ldap.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ldap.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_lifeforge.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_lifeforge.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_lifeforge.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_lifeforge.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_line.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_line.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_line.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_line.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_litecoin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_litecoin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_litecoin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_litecoin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_llp2p.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_llp2p.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_llp2p.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_llp2p.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_maplestory_china.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_maplestory_china.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_maplestory_china.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_maplestory_china.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_maxicloud.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_maxicloud.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_maxicloud.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_maxicloud.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_message4u.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_message4u.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_message4u.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_message4u.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_minecraft.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_minecraft.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_minecraft.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_minecraft.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mitglieder.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mitglieder.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mitglieder.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mitglieder.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mms.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mms.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mms.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mms.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mongo.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mongo.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mongo.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mongo.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mp2p.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mp2p.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mp2p.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mp2p.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_msn.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_msn.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_msn.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_msn.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_msnc.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_msnc.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_msnc.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_msnc.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_msnv.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_msnv.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_msnv.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_msnv.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_munin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_munin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_munin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_munin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mysql.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mysql.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mysql.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mysql.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mystery_8000.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mystery_8000.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mystery_8000.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mystery_8000.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mystery_9000.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mystery_9000.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mystery_9000.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mystery_9000.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mystery_conn.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mystery_conn.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mystery_conn.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mystery_conn.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mystery_iG.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mystery_iG.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mystery_iG.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mystery_iG.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mystery_pspr.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mystery_pspr.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mystery_pspr.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mystery_pspr.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mystery_rxxf.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mystery_rxxf.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mystery_rxxf.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mystery_rxxf.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mystery_symantec.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mystery_symantec.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mystery_symantec.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mystery_symantec.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_mzinga.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_mzinga.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_mzinga.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_mzinga.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_naverp2p.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_naverp2p.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_naverp2p.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_naverp2p.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ncsoft.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ncsoft.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ncsoft.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ncsoft.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ndt_tput.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ndt_tput.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ndt_tput.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ndt_tput.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_netbios.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_netbios.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_netbios.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_netbios.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_netcat_cctv.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_netcat_cctv.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_netcat_cctv.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_netcat_cctv.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_netmfp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_netmfp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_netmfp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_netmfp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_nntp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_nntp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_nntp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_nntp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_nntps.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_nntps.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_nntps.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_nntps.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_nofirstpkt.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_nofirstpkt.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_nofirstpkt.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_nofirstpkt.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_nomachine.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_nomachine.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_nomachine.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_nomachine.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_nopayload.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_nopayload.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_nopayload.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_nopayload.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_norton_backup.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_norton_backup.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_norton_backup.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_norton_backup.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_notes_rpc.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_notes_rpc.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_notes_rpc.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_notes_rpc.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_nsq.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_nsq.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_nsq.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_nsq.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_omegle.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_omegle.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_omegle.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_omegle.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_openvpn.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_openvpn.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_openvpn.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_openvpn.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ourworld.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ourworld.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ourworld.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ourworld.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_palringo.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_palringo.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_palringo.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_palringo.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_paltalk.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_paltalk.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_paltalk.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_paltalk.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_pandatv.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_pandatv.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_pandatv.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_pandatv.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_pando.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_pando.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_pando.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_pando.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_pathofexile.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_pathofexile.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_pathofexile.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_pathofexile.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_pdbox.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_pdbox.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_pdbox.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_pdbox.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_pop3.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_pop3.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_pop3.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_pop3.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_pop3s.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_pop3s.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_pop3s.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_pop3s.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_postgresql.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_postgresql.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_postgresql.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_postgresql.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_pptp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_pptp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_pptp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_pptp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_psn_store.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_psn_store.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_psn_store.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_psn_store.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_qcloud_ilvb.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_qcloud_ilvb.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_qcloud_ilvb.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_qcloud_ilvb.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_qq_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_qq_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_qq_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_qq_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_qqdownload.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_qqdownload.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_qqdownload.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_qqdownload.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_qqlive_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_qqlive_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_qqlive_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_qqlive_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_qqspeedmobile_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_qqspeedmobile_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_qqspeedmobile_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_qqspeedmobile_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_qvod.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_qvod.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_qvod.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_qvod.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rabbitmq.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rabbitmq.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rabbitmq.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rabbitmq.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ragnarokonline.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ragnarokonline.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ragnarokonline.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ragnarokonline.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_razor.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_razor.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_razor.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_razor.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rbls.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rbls.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rbls.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rbls.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rdp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rdp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rdp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rdp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_realmofthemadgod.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_realmofthemadgod.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_realmofthemadgod.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_realmofthemadgod.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_realvnc.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_realvnc.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_realvnc.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_realvnc.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rejection.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rejection.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rejection.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rejection.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_relay.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_relay.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_relay.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_relay.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_remote_manipulator.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_remote_manipulator.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_remote_manipulator.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_remote_manipulator.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_revolver_nblbt.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_revolver_nblbt.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_revolver_nblbt.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_revolver_nblbt.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rfb.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rfb.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rfb.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rfb.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rpcscan.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rpcscan.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rpcscan.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rpcscan.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rrtv.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rrtv.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rrtv.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rrtv.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rsync.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rsync.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rsync.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rsync.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rtmp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rtmp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rtmp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rtmp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_rtsp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_rtsp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_rtsp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_rtsp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_runescape.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_runescape.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_runescape.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_runescape.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_s7comm.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_s7comm.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_s7comm.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_s7comm.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_saprouter.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_saprouter.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_saprouter.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_saprouter.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_saszombieassault4.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_saszombieassault4.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_saszombieassault4.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_saszombieassault4.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_second_life.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_second_life.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_second_life.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_second_life.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_shoutcast.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_shoutcast.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_shoutcast.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_shoutcast.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_silkroadonline.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_silkroadonline.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_silkroadonline.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_silkroadonline.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_sip.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_sip.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_sip.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_sip.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_skyforge.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_skyforge.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_skyforge.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_skyforge.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_skype_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_skype_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_skype_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_skype_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_smb.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_smb.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_smb.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_smb.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_smite_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_smite_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_smite_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_smite_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_smtp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_smtp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_smtp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_smtp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_smtps.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_smtps.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_smtps.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_smtps.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_socks4.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_socks4.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_socks4.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_socks4.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_socks5.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_socks5.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_socks5.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_socks5.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_spdy.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_spdy.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_spdy.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_spdy.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_speedify.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_speedify.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_speedify.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_speedify.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_speedin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_speedin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_speedin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_speedin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_speedtest.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_speedtest.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_speedtest.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_speedtest.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_spotify.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_spotify.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_spotify.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_spotify.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ssh.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ssh.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ssh.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ssh.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ssjj.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ssjj.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ssjj.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ssjj.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_ssl.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_ssl.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_ssl.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_ssl.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_steam.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_steam.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_steam.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_steam.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_stratum.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_stratum.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_stratum.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_stratum.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_stun.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_stun.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_stun.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_stun.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_supl.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_supl.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_supl.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_supl.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_svn.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_svn.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_svn.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_svn.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_talesrunner.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_talesrunner.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_talesrunner.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_talesrunner.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tankionline.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tankionline.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tankionline.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tankionline.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tankix.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tankix.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tankix.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tankix.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_taobao.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_taobao.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_taobao.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_taobao.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tds.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tds.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tds.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tds.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_teamviewer.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_teamviewer.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_teamviewer.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_teamviewer.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_telecomkey.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_telecomkey.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_telecomkey.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_telecomkey.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_telegram.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_telegram.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_telegram.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_telegram.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_telnet.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_telnet.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_telnet.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_telnet.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_telnet_exploit.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_telnet_exploit.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_telnet_exploit.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_telnet_exploit.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tencent_games.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tencent_games.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tencent_games.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tencent_games.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tenfivecoin.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tenfivecoin.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tenfivecoin.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tenfivecoin.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tensafe.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tensafe.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tensafe.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tensafe.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tera.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tera.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tera.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tera.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tetrisonline.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tetrisonline.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tetrisonline.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tetrisonline.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_thedivision.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_thedivision.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_thedivision.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_thedivision.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tip.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tip.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tip.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tip.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tor.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tor.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tor.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tor.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_tpkt.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_tpkt.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_tpkt.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_tpkt.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_trackmania.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_trackmania.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_trackmania.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_trackmania.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_transocks.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_transocks.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_transocks.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_transocks.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_trion.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_trion.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_trion.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_trion.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_trojan_win32_generic_sb.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_trojan_win32_generic_sb.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_trojan_win32_generic_sb.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_trojan_win32_generic_sb.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_trojan_zeroaccess.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_trojan_zeroaccess.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_trojan_zeroaccess.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_trojan_zeroaccess.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_twitcasting.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_twitcasting.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_twitcasting.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_twitcasting.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_twitch_irc.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_twitch_irc.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_twitch_irc.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_twitch_irc.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_utherverse.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_utherverse.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_utherverse.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_utherverse.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_vainglory.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_vainglory.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_vainglory.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_vainglory.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_vhdp2p.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_vhdp2p.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_vhdp2p.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_vhdp2p.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_viber.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_viber.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_viber.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_viber.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_vmware.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_vmware.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_vmware.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_vmware.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_vodlocker.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_vodlocker.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_vodlocker.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_vodlocker.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_vpnrobot_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_vpnrobot_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_vpnrobot_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_vpnrobot_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_vpnunlimited_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_vpnunlimited_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_vpnunlimited_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_vpnunlimited_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_warcraft3.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_warcraft3.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_warcraft3.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_warcraft3.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_web_junk.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_web_junk.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_web_junk.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_web_junk.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_webex_stun.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_webex_stun.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_webex_stun.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_webex_stun.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_weblogic.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_weblogic.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_weblogic.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_weblogic.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_wechat.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_wechat.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_wechat.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_wechat.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_weibo.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_weibo.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_weibo.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_weibo.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_weiqi.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_weiqi.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_weiqi.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_weiqi.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_whatsapp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_whatsapp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_whatsapp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_whatsapp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_whois.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_whois.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_whois.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_whois.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_winmx.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_winmx.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_winmx.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_winmx.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_wizard101.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_wizard101.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_wizard101.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_wizard101.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_wns.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_wns.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_wns.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_wns.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_wow.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_wow.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_wow.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_wow.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_wuala.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_wuala.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_wuala.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_wuala.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_xiami.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_xiami.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_xiami.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_xiami.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_xmpp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_xmpp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_xmpp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_xmpp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_xmpps.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_xmpps.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_xmpps.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_xmpps.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_xunlei.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_xunlei.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_xunlei.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_xunlei.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_xunlei_accel.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_xunlei_accel.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_xunlei_accel.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_xunlei_accel.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_xymon.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_xymon.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_xymon.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_xymon.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_yahoo.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_yahoo.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_yahoo.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_yahoo.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_yahoo_error.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_yahoo_error.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_yahoo_error.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_yahoo_error.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_yahoo_games.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_yahoo_games.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_yahoo_games.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_yahoo_games.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_yahoo_webcam.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_yahoo_webcam.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_yahoo_webcam.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_yahoo_webcam.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_youku.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_youku.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_youku.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_youku.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_yy_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_yy_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_yy_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_yy_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_zabbix.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_zabbix.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_zabbix.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_zabbix.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_zero.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_zero.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_zero.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_zero.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_zoom_tcp.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_zoom_tcp.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_zoom_tcp.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_zoom_tcp.cc diff --git a/decoders/lpi/libprotoident/tcp/lpi_zynga.cc b/decoders/lpi_plus/libprotoident/tcp/lpi_zynga.cc similarity index 100% rename from decoders/lpi/libprotoident/tcp/lpi_zynga.cc rename to decoders/lpi_plus/libprotoident/tcp/lpi_zynga.cc diff --git a/decoders/lpi/libprotoident/tcp/tcp_protocols.h b/decoders/lpi_plus/libprotoident/tcp/tcp_protocols.h similarity index 100% rename from decoders/lpi/libprotoident/tcp/tcp_protocols.h rename to decoders/lpi_plus/libprotoident/tcp/tcp_protocols.h diff --git a/decoders/lpi/libprotoident/udp/lpi_360cn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_360cn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_360cn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_360cn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_360p2p.cc b/decoders/lpi_plus/libprotoident/udp/lpi_360p2p.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_360p2p.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_360p2p.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_aachen_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_aachen_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_aachen_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_aachen_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_acercloud.cc b/decoders/lpi_plus/libprotoident/udp/lpi_acercloud.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_acercloud.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_acercloud.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_akamai.cc b/decoders/lpi_plus/libprotoident/udp/lpi_akamai.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_akamai.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_akamai.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_akamai_transfer.cc b/decoders/lpi_plus/libprotoident/udp/lpi_akamai_transfer.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_akamai_transfer.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_akamai_transfer.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_amanda.cc b/decoders/lpi_plus/libprotoident/udp/lpi_amanda.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_amanda.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_amanda.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_apple_facetime_init.cc b/decoders/lpi_plus/libprotoident/udp/lpi_apple_facetime_init.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_apple_facetime_init.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_apple_facetime_init.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ard.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ard.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ard.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ard.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ares.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ares.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ares.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ares.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ark.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ark.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ark.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ark.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_arma3_server.cc b/decoders/lpi_plus/libprotoident/udp/lpi_arma3_server.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_arma3_server.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_arma3_server.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_arma_server.cc b/decoders/lpi_plus/libprotoident/udp/lpi_arma_server.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_arma_server.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_arma_server.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_artcp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_artcp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_artcp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_artcp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_assettocorsa.cc b/decoders/lpi_plus/libprotoident/udp/lpi_assettocorsa.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_assettocorsa.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_assettocorsa.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_avast_secure_dns.cc b/decoders/lpi_plus/libprotoident/udp/lpi_avast_secure_dns.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_avast_secure_dns.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_avast_secure_dns.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_backweb.cc b/decoders/lpi_plus/libprotoident/udp/lpi_backweb.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_backweb.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_backweb.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_bacnet.cc b/decoders/lpi_plus/libprotoident/udp/lpi_bacnet.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_bacnet.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_bacnet.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_baiduyun_p2p.cc b/decoders/lpi_plus/libprotoident/udp/lpi_baiduyun_p2p.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_baiduyun_p2p.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_baiduyun_p2p.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_baofeng_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_baofeng_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_baofeng_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_baofeng_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_battlefield.cc b/decoders/lpi_plus/libprotoident/udp/lpi_battlefield.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_battlefield.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_battlefield.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_bjnp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_bjnp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_bjnp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_bjnp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_bmdp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_bmdp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_bmdp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_bmdp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_btsync.cc b/decoders/lpi_plus/libprotoident/udp/lpi_btsync.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_btsync.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_btsync.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_cacaoweb_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_cacaoweb_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_cacaoweb_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_cacaoweb_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_canon_mfnp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_canon_mfnp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_canon_mfnp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_canon_mfnp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_chargen_exploit.cc b/decoders/lpi_plus/libprotoident/udp/lpi_chargen_exploit.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_chargen_exploit.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_chargen_exploit.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_checkpoint_rdp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_checkpoint_rdp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_checkpoint_rdp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_checkpoint_rdp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_chivalry.cc b/decoders/lpi_plus/libprotoident/udp/lpi_chivalry.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_chivalry.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_chivalry.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_cip_io.cc b/decoders/lpi_plus/libprotoident/udp/lpi_cip_io.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_cip_io.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_cip_io.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_cirn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_cirn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_cirn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_cirn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_cisco_ipsec.cc b/decoders/lpi_plus/libprotoident/udp/lpi_cisco_ipsec.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_cisco_ipsec.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_cisco_ipsec.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_cisco_sslvpn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_cisco_sslvpn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_cisco_sslvpn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_cisco_sslvpn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_classin_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_classin_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_classin_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_classin_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_cloudflare_warp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_cloudflare_warp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_cloudflare_warp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_cloudflare_warp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_cod.cc b/decoders/lpi_plus/libprotoident/udp/lpi_cod.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_cod.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_cod.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_codmobile.cc b/decoders/lpi_plus/libprotoident/udp/lpi_codmobile.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_codmobile.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_codmobile.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_combatarms.cc b/decoders/lpi_plus/libprotoident/udp/lpi_combatarms.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_combatarms.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_combatarms.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_combatarms_p2p.cc b/decoders/lpi_plus/libprotoident/udp/lpi_combatarms_p2p.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_combatarms_p2p.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_combatarms_p2p.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_contract_wars.cc b/decoders/lpi_plus/libprotoident/udp/lpi_contract_wars.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_contract_wars.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_contract_wars.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_crossfire.cc b/decoders/lpi_plus/libprotoident/udp/lpi_crossfire.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_crossfire.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_crossfire.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_crossout.cc b/decoders/lpi_plus/libprotoident/udp/lpi_crossout.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_crossout.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_crossout.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_csgo.cc b/decoders/lpi_plus/libprotoident/udp/lpi_csgo.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_csgo.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_csgo.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_csoriginal.cc b/decoders/lpi_plus/libprotoident/udp/lpi_csoriginal.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_csoriginal.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_csoriginal.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dahua.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dahua.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dahua.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dahua.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_db2.cc b/decoders/lpi_plus/libprotoident/udp/lpi_db2.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_db2.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_db2.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dcc.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dcc.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dcc.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dcc.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_demonware.cc b/decoders/lpi_plus/libprotoident/udp/lpi_demonware.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_demonware.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_demonware.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_destiny_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_destiny_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_destiny_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_destiny_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dhcp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dhcp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dhcp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dhcp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dht_dict.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dht_dict.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dht_dict.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dht_dict.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dht_other.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dht_other.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dht_other.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dht_other.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_diablo2.cc b/decoders/lpi_plus/libprotoident/udp/lpi_diablo2.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_diablo2.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_diablo2.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dianping_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dianping_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dianping_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dianping_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dianshijia.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dianshijia.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dianshijia.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dianshijia.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_directconnect.cc b/decoders/lpi_plus/libprotoident/udp/lpi_directconnect.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_directconnect.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_directconnect.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_discord.cc b/decoders/lpi_plus/libprotoident/udp/lpi_discord.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_discord.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_discord.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dns.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dns.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dns.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dns.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dota2.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dota2.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dota2.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dota2.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_doyo.cc b/decoders/lpi_plus/libprotoident/udp/lpi_doyo.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_doyo.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_doyo.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_driveshare.cc b/decoders/lpi_plus/libprotoident/udp/lpi_driveshare.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_driveshare.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_driveshare.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_dtls.cc b/decoders/lpi_plus/libprotoident/udp/lpi_dtls.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_dtls.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_dtls.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_emule.cc b/decoders/lpi_plus/libprotoident/udp/lpi_emule.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_emule.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_emule.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_emule_weak.cc b/decoders/lpi_plus/libprotoident/udp/lpi_emule_weak.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_emule_weak.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_emule_weak.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_epson.cc b/decoders/lpi_plus/libprotoident/udp/lpi_epson.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_epson.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_epson.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_eso.cc b/decoders/lpi_plus/libprotoident/udp/lpi_eso.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_eso.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_eso.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_esp_encap.cc b/decoders/lpi_plus/libprotoident/udp/lpi_esp_encap.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_esp_encap.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_esp_encap.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ethernetip.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ethernetip.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ethernetip.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ethernetip.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_eye.cc b/decoders/lpi_plus/libprotoident/udp/lpi_eye.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_eye.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_eye.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_fasp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_fasp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_fasp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_fasp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_feitwo.cc b/decoders/lpi_plus/libprotoident/udp/lpi_feitwo.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_feitwo.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_feitwo.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_forticlient_sslvpn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_forticlient_sslvpn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_forticlient_sslvpn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_forticlient_sslvpn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_fortinet.cc b/decoders/lpi_plus/libprotoident/udp/lpi_fortinet.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_fortinet.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_fortinet.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_foscam.cc b/decoders/lpi_plus/libprotoident/udp/lpi_foscam.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_foscam.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_foscam.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_freechal.cc b/decoders/lpi_plus/libprotoident/udp/lpi_freechal.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_freechal.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_freechal.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_freefire.cc b/decoders/lpi_plus/libprotoident/udp/lpi_freefire.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_freefire.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_freefire.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_funshion.cc b/decoders/lpi_plus/libprotoident/udp/lpi_funshion.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_funshion.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_funshion.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gamespy.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gamespy.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gamespy.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gamespy.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ganglia.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ganglia.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ganglia.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ganglia.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gangsofspace.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gangsofspace.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gangsofspace.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gangsofspace.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_garena.cc b/decoders/lpi_plus/libprotoident/udp/lpi_garena.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_garena.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_garena.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gearsofwar.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gearsofwar.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gearsofwar.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gearsofwar.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gnutella.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gnutella.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gnutella.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gnutella.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gnutella2.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gnutella2.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gnutella2.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gnutella2.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gnutella_weak.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gnutella_weak.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gnutella_weak.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gnutella_weak.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gotomeeting.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gotomeeting.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gotomeeting.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gotomeeting.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gprs_tunnel.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gprs_tunnel.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gprs_tunnel.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gprs_tunnel.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_gsm.cc b/decoders/lpi_plus/libprotoident/udp/lpi_gsm.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_gsm.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_gsm.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_h1z1.cc b/decoders/lpi_plus/libprotoident/udp/lpi_h1z1.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_h1z1.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_h1z1.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_halflife.cc b/decoders/lpi_plus/libprotoident/udp/lpi_halflife.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_halflife.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_halflife.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_haloonline.cc b/decoders/lpi_plus/libprotoident/udp/lpi_haloonline.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_haloonline.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_haloonline.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_hamachi.cc b/decoders/lpi_plus/libprotoident/udp/lpi_hamachi.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_hamachi.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_hamachi.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_heliborne.cc b/decoders/lpi_plus/libprotoident/udp/lpi_heliborne.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_heliborne.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_heliborne.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_heroes_generals.cc b/decoders/lpi_plus/libprotoident/udp/lpi_heroes_generals.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_heroes_generals.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_heroes_generals.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_heroesevolved.cc b/decoders/lpi_plus/libprotoident/udp/lpi_heroesevolved.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_heroesevolved.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_heroesevolved.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_hollachat.cc b/decoders/lpi_plus/libprotoident/udp/lpi_hollachat.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_hollachat.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_hollachat.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_hots.cc b/decoders/lpi_plus/libprotoident/udp/lpi_hots.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_hots.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_hots.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_icp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_icp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_icp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_icp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_imesh.cc b/decoders/lpi_plus/libprotoident/udp/lpi_imesh.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_imesh.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_imesh.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ipmsg.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ipmsg.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ipmsg.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ipmsg.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ipv6.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ipv6.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ipv6.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ipv6.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_isakmp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_isakmp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_isakmp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_isakmp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_jedi.cc b/decoders/lpi_plus/libprotoident/udp/lpi_jedi.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_jedi.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_jedi.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_jedi_academy.cc b/decoders/lpi_plus/libprotoident/udp/lpi_jedi_academy.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_jedi_academy.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_jedi_academy.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_kademlia.cc b/decoders/lpi_plus/libprotoident/udp/lpi_kademlia.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_kademlia.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_kademlia.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_kankan.cc b/decoders/lpi_plus/libprotoident/udp/lpi_kankan.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_kankan.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_kankan.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_kaspersky.cc b/decoders/lpi_plus/libprotoident/udp/lpi_kaspersky.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_kaspersky.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_kaspersky.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_kazaa.cc b/decoders/lpi_plus/libprotoident/udp/lpi_kazaa.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_kazaa.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_kazaa.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_kingofglory_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_kingofglory_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_kingofglory_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_kingofglory_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_kuguo.cc b/decoders/lpi_plus/libprotoident/udp/lpi_kuguo.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_kuguo.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_kuguo.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_l2tp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_l2tp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_l2tp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_l2tp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_lansync.cc b/decoders/lpi_plus/libprotoident/udp/lpi_lansync.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_lansync.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_lansync.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ldap_ad.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ldap_ad.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ldap_ad.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ldap_ad.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_line_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_line_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_line_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_line_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_linkproof.cc b/decoders/lpi_plus/libprotoident/udp/lpi_linkproof.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_linkproof.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_linkproof.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_loadout.cc b/decoders/lpi_plus/libprotoident/udp/lpi_loadout.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_loadout.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_loadout.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_lol.cc b/decoders/lpi_plus/libprotoident/udp/lpi_lol.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_lol.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_lol.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_mdns.cc b/decoders/lpi_plus/libprotoident/udp/lpi_mdns.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_mdns.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_mdns.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_merakicloud.cc b/decoders/lpi_plus/libprotoident/udp/lpi_merakicloud.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_merakicloud.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_merakicloud.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_moh.cc b/decoders/lpi_plus/libprotoident/udp/lpi_moh.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_moh.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_moh.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_moonhunters.cc b/decoders/lpi_plus/libprotoident/udp/lpi_moonhunters.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_moonhunters.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_moonhunters.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_mp2p.cc b/decoders/lpi_plus/libprotoident/udp/lpi_mp2p.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_mp2p.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_mp2p.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_msn_cache.cc b/decoders/lpi_plus/libprotoident/udp/lpi_msn_cache.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_msn_cache.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_msn_cache.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_msn_video.cc b/decoders/lpi_plus/libprotoident/udp/lpi_msn_video.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_msn_video.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_msn_video.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_msoffice_mac.cc b/decoders/lpi_plus/libprotoident/udp/lpi_msoffice_mac.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_msoffice_mac.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_msoffice_mac.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_mta.cc b/decoders/lpi_plus/libprotoident/udp/lpi_mta.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_mta.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_mta.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_n2ping.cc b/decoders/lpi_plus/libprotoident/udp/lpi_n2ping.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_n2ping.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_n2ping.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_natpmp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_natpmp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_natpmp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_natpmp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_netbios.cc b/decoders/lpi_plus/libprotoident/udp/lpi_netbios.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_netbios.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_netbios.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_netcat_cctv_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_netcat_cctv_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_netcat_cctv_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_netcat_cctv_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_netcore_scan.cc b/decoders/lpi_plus/libprotoident/udp/lpi_netcore_scan.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_netcore_scan.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_netcore_scan.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_netflow.cc b/decoders/lpi_plus/libprotoident/udp/lpi_netflow.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_netflow.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_netflow.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_newerth.cc b/decoders/lpi_plus/libprotoident/udp/lpi_newerth.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_newerth.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_newerth.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_nintendo.cc b/decoders/lpi_plus/libprotoident/udp/lpi_nintendo.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_nintendo.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_nintendo.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_noction.cc b/decoders/lpi_plus/libprotoident/udp/lpi_noction.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_noction.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_noction.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_noe.cc b/decoders/lpi_plus/libprotoident/udp/lpi_noe.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_noe.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_noe.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_nopayload.cc b/decoders/lpi_plus/libprotoident/udp/lpi_nopayload.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_nopayload.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_nopayload.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_norton.cc b/decoders/lpi_plus/libprotoident/udp/lpi_norton.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_norton.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_norton.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ntp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ntp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ntp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ntp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ntp_reflect.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ntp_reflect.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ntp_reflect.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ntp_reflect.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_nvidia_gamestream.cc b/decoders/lpi_plus/libprotoident/udp/lpi_nvidia_gamestream.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_nvidia_gamestream.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_nvidia_gamestream.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_nwn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_nwn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_nwn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_nwn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_opaserv.cc b/decoders/lpi_plus/libprotoident/udp/lpi_opaserv.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_opaserv.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_opaserv.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_openvpn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_openvpn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_openvpn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_openvpn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_orbit.cc b/decoders/lpi_plus/libprotoident/udp/lpi_orbit.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_orbit.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_orbit.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_overwatch.cc b/decoders/lpi_plus/libprotoident/udp/lpi_overwatch.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_overwatch.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_overwatch.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_paladins.cc b/decoders/lpi_plus/libprotoident/udp/lpi_paladins.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_paladins.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_paladins.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_pando.cc b/decoders/lpi_plus/libprotoident/udp/lpi_pando.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_pando.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_pando.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_panipani.cc b/decoders/lpi_plus/libprotoident/udp/lpi_panipani.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_panipani.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_panipani.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_planetside2.cc b/decoders/lpi_plus/libprotoident/udp/lpi_planetside2.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_planetside2.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_planetside2.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_portmap_rpc.cc b/decoders/lpi_plus/libprotoident/udp/lpi_portmap_rpc.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_portmap_rpc.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_portmap_rpc.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_pplive.cc b/decoders/lpi_plus/libprotoident/udp/lpi_pplive.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_pplive.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_pplive.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ppstream.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ppstream.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ppstream.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ppstream.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_probable_gnutella.cc b/decoders/lpi_plus/libprotoident/udp/lpi_probable_gnutella.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_probable_gnutella.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_probable_gnutella.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ps4_remoteplay.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ps4_remoteplay.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ps4_remoteplay.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ps4_remoteplay.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_psn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_psn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_psn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_psn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_punkbuster.cc b/decoders/lpi_plus/libprotoident/udp/lpi_punkbuster.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_punkbuster.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_punkbuster.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_pyzor.cc b/decoders/lpi_plus/libprotoident/udp/lpi_pyzor.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_pyzor.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_pyzor.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_qq.cc b/decoders/lpi_plus/libprotoident/udp/lpi_qq.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_qq.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_qq.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_qqlive.cc b/decoders/lpi_plus/libprotoident/udp/lpi_qqlive.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_qqlive.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_qqlive.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_qqpcmgr.cc b/decoders/lpi_plus/libprotoident/udp/lpi_qqpcmgr.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_qqpcmgr.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_qqpcmgr.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_qqspeedmobile_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_qqspeedmobile_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_qqspeedmobile_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_qqspeedmobile_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_quake.cc b/decoders/lpi_plus/libprotoident/udp/lpi_quake.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_quake.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_quake.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_quic.cc b/decoders/lpi_plus/libprotoident/udp/lpi_quic.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_quic.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_quic.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_qvod_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_qvod_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_qvod_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_qvod_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_radius.cc b/decoders/lpi_plus/libprotoident/udp/lpi_radius.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_radius.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_radius.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_raknet.cc b/decoders/lpi_plus/libprotoident/udp/lpi_raknet.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_raknet.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_raknet.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ramseydash.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ramseydash.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ramseydash.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ramseydash.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_rdp_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_rdp_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_rdp_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_rdp_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_real.cc b/decoders/lpi_plus/libprotoident/udp/lpi_real.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_real.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_real.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_risingstorm.cc b/decoders/lpi_plus/libprotoident/udp/lpi_risingstorm.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_risingstorm.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_risingstorm.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_robocraft.cc b/decoders/lpi_plus/libprotoident/udp/lpi_robocraft.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_robocraft.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_robocraft.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_rocket_league.cc b/decoders/lpi_plus/libprotoident/udp/lpi_rocket_league.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_rocket_league.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_rocket_league.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_rrshare.cc b/decoders/lpi_plus/libprotoident/udp/lpi_rrshare.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_rrshare.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_rrshare.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_rtcp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_rtcp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_rtcp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_rtcp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_rtmfp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_rtmfp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_rtmfp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_rtmfp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_rtp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_rtp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_rtp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_rtp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_rulesofsurvival.cc b/decoders/lpi_plus/libprotoident/udp/lpi_rulesofsurvival.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_rulesofsurvival.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_rulesofsurvival.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_sanandreas_mp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_sanandreas_mp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_sanandreas_mp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_sanandreas_mp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_second_life.cc b/decoders/lpi_plus/libprotoident/udp/lpi_second_life.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_second_life.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_second_life.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_serialnumberd.cc b/decoders/lpi_plus/libprotoident/udp/lpi_serialnumberd.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_serialnumberd.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_serialnumberd.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_sip.cc b/decoders/lpi_plus/libprotoident/udp/lpi_sip.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_sip.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_sip.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_skype.cc b/decoders/lpi_plus/libprotoident/udp/lpi_skype.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_skype.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_skype.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_slp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_slp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_slp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_slp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_smite.cc b/decoders/lpi_plus/libprotoident/udp/lpi_smite.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_smite.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_smite.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_snapvpn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_snapvpn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_snapvpn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_snapvpn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_snmp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_snmp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_snmp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_snmp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_sopcast.cc b/decoders/lpi_plus/libprotoident/udp/lpi_sopcast.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_sopcast.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_sopcast.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_spamfighter.cc b/decoders/lpi_plus/libprotoident/udp/lpi_spamfighter.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_spamfighter.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_spamfighter.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_spotify_bcast.cc b/decoders/lpi_plus/libprotoident/udp/lpi_spotify_bcast.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_spotify_bcast.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_spotify_bcast.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_sql_worm.cc b/decoders/lpi_plus/libprotoident/udp/lpi_sql_worm.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_sql_worm.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_sql_worm.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ssdp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ssdp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ssdp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ssdp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_starcitizen.cc b/decoders/lpi_plus/libprotoident/udp/lpi_starcitizen.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_starcitizen.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_starcitizen.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_starcraft.cc b/decoders/lpi_plus/libprotoident/udp/lpi_starcraft.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_starcraft.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_starcraft.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_starleaf.cc b/decoders/lpi_plus/libprotoident/udp/lpi_starleaf.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_starleaf.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_starleaf.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_steam.cc b/decoders/lpi_plus/libprotoident/udp/lpi_steam.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_steam.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_steam.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_steam_inhomebroadcast.cc b/decoders/lpi_plus/libprotoident/udp/lpi_steam_inhomebroadcast.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_steam_inhomebroadcast.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_steam_inhomebroadcast.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_steam_localbroadcast.cc b/decoders/lpi_plus/libprotoident/udp/lpi_steam_localbroadcast.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_steam_localbroadcast.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_steam_localbroadcast.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_steamfriends.cc b/decoders/lpi_plus/libprotoident/udp/lpi_steamfriends.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_steamfriends.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_steamfriends.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_storm_worm.cc b/decoders/lpi_plus/libprotoident/udp/lpi_storm_worm.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_storm_worm.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_storm_worm.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_stun.cc b/decoders/lpi_plus/libprotoident/udp/lpi_stun.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_stun.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_stun.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_syslog.cc b/decoders/lpi_plus/libprotoident/udp/lpi_syslog.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_syslog.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_syslog.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_talesrunner_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_talesrunner_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_talesrunner_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_talesrunner_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_teamspeak.cc b/decoders/lpi_plus/libprotoident/udp/lpi_teamspeak.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_teamspeak.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_teamspeak.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_teamviewer.cc b/decoders/lpi_plus/libprotoident/udp/lpi_teamviewer.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_teamviewer.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_teamviewer.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_teredo.cc b/decoders/lpi_plus/libprotoident/udp/lpi_teredo.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_teredo.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_teredo.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_tf2.cc b/decoders/lpi_plus/libprotoident/udp/lpi_tf2.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_tf2.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_tf2.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_tftp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_tftp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_tftp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_tftp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_thecrew.cc b/decoders/lpi_plus/libprotoident/udp/lpi_thecrew.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_thecrew.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_thecrew.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_thq.cc b/decoders/lpi_plus/libprotoident/udp/lpi_thq.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_thq.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_thq.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_torchlight2.cc b/decoders/lpi_plus/libprotoident/udp/lpi_torchlight2.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_torchlight2.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_torchlight2.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_tox.cc b/decoders/lpi_plus/libprotoident/udp/lpi_tox.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_tox.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_tox.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_traceroute.cc b/decoders/lpi_plus/libprotoident/udp/lpi_traceroute.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_traceroute.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_traceroute.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_tremulous.cc b/decoders/lpi_plus/libprotoident/udp/lpi_tremulous.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_tremulous.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_tremulous.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_turbovpn.cc b/decoders/lpi_plus/libprotoident/udp/lpi_turbovpn.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_turbovpn.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_turbovpn.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_tvants.cc b/decoders/lpi_plus/libprotoident/udp/lpi_tvants.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_tvants.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_tvants.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ubisoft_games.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ubisoft_games.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ubisoft_games.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ubisoft_games.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_umeye.cc b/decoders/lpi_plus/libprotoident/udp/lpi_umeye.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_umeye.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_umeye.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_unreal.cc b/decoders/lpi_plus/libprotoident/udp/lpi_unreal.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_unreal.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_unreal.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_ventrilo.cc b/decoders/lpi_plus/libprotoident/udp/lpi_ventrilo.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_ventrilo.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_ventrilo.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_viber.cc b/decoders/lpi_plus/libprotoident/udp/lpi_viber.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_viber.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_viber.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_vivox.cc b/decoders/lpi_plus/libprotoident/udp/lpi_vivox.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_vivox.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_vivox.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_vpnmaster.cc b/decoders/lpi_plus/libprotoident/udp/lpi_vpnmaster.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_vpnmaster.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_vpnmaster.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_vpnrobot_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_vpnrobot_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_vpnrobot_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_vpnrobot_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_vxworks_exploit.cc b/decoders/lpi_plus/libprotoident/udp/lpi_vxworks_exploit.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_vxworks_exploit.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_vxworks_exploit.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_warthunder.cc b/decoders/lpi_plus/libprotoident/udp/lpi_warthunder.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_warthunder.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_warthunder.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_webex.cc b/decoders/lpi_plus/libprotoident/udp/lpi_webex.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_webex.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_webex.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_wechat_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_wechat_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_wechat_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_wechat_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_winmessage.cc b/decoders/lpi_plus/libprotoident/udp/lpi_winmessage.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_winmessage.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_winmessage.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_wireguard.cc b/decoders/lpi_plus/libprotoident/udp/lpi_wireguard.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_wireguard.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_wireguard.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_wolfet.cc b/decoders/lpi_plus/libprotoident/udp/lpi_wolfet.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_wolfet.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_wolfet.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_worm_22105.cc b/decoders/lpi_plus/libprotoident/udp/lpi_worm_22105.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_worm_22105.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_worm_22105.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_xfire_p2p.cc b/decoders/lpi_plus/libprotoident/udp/lpi_xfire_p2p.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_xfire_p2p.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_xfire_p2p.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_xlsp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_xlsp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_xlsp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_xlsp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_xunlei.cc b/decoders/lpi_plus/libprotoident/udp/lpi_xunlei.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_xunlei.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_xunlei.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_xunlei_jsq.cc b/decoders/lpi_plus/libprotoident/udp/lpi_xunlei_jsq.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_xunlei_jsq.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_xunlei_jsq.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_xunyou.cc b/decoders/lpi_plus/libprotoident/udp/lpi_xunyou.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_xunyou.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_xunyou.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_youdao_dict.cc b/decoders/lpi_plus/libprotoident/udp/lpi_youdao_dict.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_youdao_dict.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_youdao_dict.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_youku.cc b/decoders/lpi_plus/libprotoident/udp/lpi_youku.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_youku.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_youku.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_yuanfudao.cc b/decoders/lpi_plus/libprotoident/udp/lpi_yuanfudao.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_yuanfudao.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_yuanfudao.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_yy_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_yy_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_yy_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_yy_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_zalo_call.cc b/decoders/lpi_plus/libprotoident/udp/lpi_zalo_call.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_zalo_call.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_zalo_call.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_zeroaccess_udp.cc b/decoders/lpi_plus/libprotoident/udp/lpi_zeroaccess_udp.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_zeroaccess_udp.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_zeroaccess_udp.cc diff --git a/decoders/lpi/libprotoident/udp/lpi_zoom.cc b/decoders/lpi_plus/libprotoident/udp/lpi_zoom.cc similarity index 100% rename from decoders/lpi/libprotoident/udp/lpi_zoom.cc rename to decoders/lpi_plus/libprotoident/udp/lpi_zoom.cc diff --git a/decoders/lpi/libprotoident/udp/udp_protocols.h b/decoders/lpi_plus/libprotoident/udp/udp_protocols.h similarity index 100% rename from decoders/lpi/libprotoident/udp/udp_protocols.h rename to decoders/lpi_plus/libprotoident/udp/udp_protocols.h diff --git a/decoders/lpi/libprotoident/version.map b/decoders/lpi_plus/libprotoident/version.map similarity index 100% rename from decoders/lpi/libprotoident/version.map rename to decoders/lpi_plus/libprotoident/version.map diff --git a/decoders/lpi_plus/lpi_plus.h b/decoders/lpi_plus/lpi_plus.h new file mode 100644 index 0000000..72844d2 --- /dev/null +++ b/decoders/lpi_plus/lpi_plus.h @@ -0,0 +1,6 @@ +#pragma once + +#include "stellar/module_manager.h" +struct lpi_plus_mapper; +struct lpi_plus_mapper *stellar_module_get_lpip(struct stellar_module_manager *mod_mgr); +const char *lpi_plus_appid2name(struct lpi_plus_mapper *mapper, int appid); \ No newline at end of file diff --git a/decoders/lpi_plus/lpip_extend.c b/decoders/lpi_plus/lpip_extend.c new file mode 100644 index 0000000..79b3849 --- /dev/null +++ b/decoders/lpi_plus/lpip_extend.c @@ -0,0 +1,558 @@ +#include "lpip_extend.h" +#include +#include + +const char *dns_name="DNS"; +const char *imap_name="IMAP"; +const char *quic_name="QUIC"; +const char *ftps_name="FTPS"; +const char *openvpn_name="OpenVPN"; +const char *smtp_name="SMTP"; +const char *ftp_control_name="FTP_Control"; + +#define P_CONTROL_HARD_RESET_CLIENT_V1 (0x01 << 3) +#define P_CONTROL_HARD_RESET_CLIENT_V2 (0x07 << 3) +#define P_CONTROL_HARD_RESET_SERVER_V1 (0x02 << 3) +#define P_CONTROL_HARD_RESET_SERVER_V2 (0x08 << 3) +#define P_ACK_V1 (0x05 << 3) +#define P_CONTROL_V1 (0x04 << 3) +#define P_OPCODE_MASK 0xF8 +#define P_SHA1_HMAC_SIZE 20 +#define P_HMAC_128 16 // (RSA-)MD5, (RSA-)MD4, ..others +#define P_HMAC_160 20 // (RSA-|DSA-)SHA(1), ..others, SHA1 is openvpn default +#define P_HMAC_NONE 0 +#define P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) (9 + hmac_size) +#define P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size) (P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) + 8) +#define P_HARD_RESET_CLIENT_MAX_COUNT 5 + +static inline uint32_t get_packet_id(const uint8_t * payload, uint8_t hms) { + return(ntohl(*(uint32_t*)(payload + P_HARD_RESET_PACKET_ID_OFFSET(hms)))); +} + +static inline int8_t check_pkid_and_detect_hmac_size(const uint8_t * payload) { + // try to guess + if((int)get_packet_id(payload, P_HMAC_160) != 0) + return P_HMAC_160; + + if((int)get_packet_id(payload, P_HMAC_128) != 0 ) + return P_HMAC_128; + + if((int)get_packet_id(payload, P_HMAC_NONE) != 0) + return P_HMAC_NONE; + + return(-1); +} + +int lpi_plus_match_openvpn(const unsigned char *payload, size_t payload_sz, int c2s_pkt_cnt, int s2c_pkt_cnt, struct ovpn_ctx *ovpn, unsigned char trans_proto, bool is_c2s_flow) +{ + const uint8_t * session_remote; + uint8_t opcode; + uint8_t alen; + int8_t hmac_size; + int8_t failed = 0; + + if (trans_proto!=IPPROTO_UDP && trans_proto!=IPPROTO_TCP)return 0; + + if (c2s_pkt_cnt > 5) + { + if (ovpn->contain_local_session_id_pkt_num == P_HARD_RESET_CLIENT_MAX_COUNT - 1 && ovpn->valid_opcode_cnt == P_HARD_RESET_CLIENT_MAX_COUNT) + return 1; + return 0; + } + + if (payload_sz >= 40) + { + // skip openvpn TCP transport packet size + if (trans_proto==IPPROTO_TCP)payload += 2, payload_sz -= 2; + + opcode = payload[0] & P_OPCODE_MASK; + if (is_c2s_flow == 1 && + (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || + opcode == P_CONTROL_HARD_RESET_CLIENT_V2 || + opcode == P_ACK_V1 || + opcode == P_CONTROL_V1)) + { + ovpn->valid_opcode_cnt++; + } + // for UDP, trying to identify by opcode and first packet length + if (trans_proto==IPPROTO_UDP) + { + if ((c2s_pkt_cnt == 1 || s2c_pkt_cnt == 1) && (((payload_sz == 112) && ((opcode == 168) || (opcode == 192))) || ((payload_sz == 80) && ((opcode == 184) || (opcode == 88) || (opcode == 160) || (opcode == 168) || (opcode == 200))))) + { + return 1; + } + } + + if(s2c_pkt_cnt >= 1 && is_c2s_flow == false)return 0; + + if (is_c2s_flow == true && c2s_pkt_cnt <= P_HARD_RESET_CLIENT_MAX_COUNT && (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || opcode == P_CONTROL_HARD_RESET_CLIENT_V2 || opcode == P_ACK_V1 || opcode == P_CONTROL_V1)) + { + if (check_pkid_and_detect_hmac_size(payload) >= 0) + { + if (c2s_pkt_cnt > 1) + { + if (memcmp(&ovpn->local_session_id, payload + 1, 8) == 0) + { + ovpn->contain_local_session_id_pkt_num++; + } + } + memcpy(&ovpn->local_session_id, payload + 1, 8); + } + } + else if (c2s_pkt_cnt >= 1 && c2s_pkt_cnt <= P_HARD_RESET_CLIENT_MAX_COUNT && + (opcode == P_CONTROL_HARD_RESET_SERVER_V1 || opcode == P_CONTROL_HARD_RESET_SERVER_V2)) + { + + hmac_size = check_pkid_and_detect_hmac_size(payload); + + if (hmac_size >= 0) + { + size_t offset = P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size); + + alen = payload[offset]; + + if (alen > 0) + { + offset += 1 + alen * 4; + + if ((offset + 8) <= payload_sz) + { + session_remote = &payload[offset]; + + if (memcmp(&ovpn->local_session_id, session_remote, 8) == 0) + { + + return 1; + } + else + { + + failed = 1; + } + } + else + failed = 1; + } + else + failed = 1; + } + else + failed = 1; + } + else + failed = 1; + + if (failed) + return 0; + } + + return 0; +} + +#define GQUIC_PUBLIC_FLAG_VERSION 0x01 +#define GQUIC_PUBLIC_FLAG_RST 0x02 +#define GQUIC_PUBLIC_FLAG_NONCE 0x04 +#define GQUIC_PUBLIC_FLAG_CID 0x08 +#define GQUIC_PUBLIC_FLAG_PKT_NUM 0x30 + +//https://github.com/quicwg/base-drafts/wiki/QUIC-Versions +enum _QUIC_VERSION +{ + QUIC_VERSION_UNKNOWN=0, + //NetApp + QUANT_VERSION_00=0x45474700, + QUANT_VERSION_FF=0x454747FF, + + //Private Octopus + PICOQUIC_VERSION_30=0x50435130, + + //google + GQUIC_VERSION_Q001=0x51303031, + GQUIC_VERSION_Q002=0x51303032, + GQUIC_VERSION_Q003=0x51303033, + GQUIC_VERSION_Q004=0x51303034, + GQUIC_VERSION_Q005=0x51303035, + GQUIC_VERSION_Q006=0x51303036, + GQUIC_VERSION_Q007=0x51303037, + GQUIC_VERSION_Q008=0x51303038, + GQUIC_VERSION_Q009=0x51303039, + + GQUIC_VERSION_Q010=0x51303130, + GQUIC_VERSION_Q011=0x51303131, + GQUIC_VERSION_Q012=0x51303132, + GQUIC_VERSION_Q013=0x51303133, + GQUIC_VERSION_Q014=0x51303134, + GQUIC_VERSION_Q015=0x51303135, + GQUIC_VERSION_Q016=0x51303136, + GQUIC_VERSION_Q017=0x51303137, + GQUIC_VERSION_Q018=0x51303138, + GQUIC_VERSION_Q019=0x51303139, + + GQUIC_VERSION_Q020=0x51303230, + GQUIC_VERSION_Q021=0x51303231, + GQUIC_VERSION_Q022=0x51303232, + GQUIC_VERSION_Q023=0x51303233, + GQUIC_VERSION_Q024=0x51303234, + GQUIC_VERSION_Q025=0x51303235, + GQUIC_VERSION_Q026=0x51303236, + GQUIC_VERSION_Q027=0x51303237, + GQUIC_VERSION_Q028=0x51303238, + GQUIC_VERSION_Q029=0x51303239, + + GQUIC_VERSION_Q030=0x51303330, + GQUIC_VERSION_Q031=0x51303331, + GQUIC_VERSION_Q032=0x51303332, + GQUIC_VERSION_Q033=0x51303333, + GQUIC_VERSION_Q034=0x51303334, + GQUIC_VERSION_Q035=0x51303335, + GQUIC_VERSION_Q036=0x51303336, + GQUIC_VERSION_Q037=0x51303337, + GQUIC_VERSION_Q038=0x51303338, + GQUIC_VERSION_Q039=0x51303339, + + GQUIC_VERSION_Q040=0x51303430, + GQUIC_VERSION_Q041=0x51303431, + GQUIC_VERSION_Q042=0x51303432, + GQUIC_VERSION_Q043=0x51303433, + GQUIC_VERSION_Q044=0x51303434, + GQUIC_VERSION_Q045=0x51303435, + GQUIC_VERSION_Q046=0x51303436, + GQUIC_VERSION_Q047=0x51303437, + GQUIC_VERSION_Q048=0x51303438, + GQUIC_VERSION_Q049=0x51303439, + + GQUIC_VERSION_Q050=0x51303530, + GQUIC_VERSION_Q051=0x51303531, + GQUIC_VERSION_Q052=0x51303532, + GQUIC_VERSION_Q053=0x51303533, + GQUIC_VERSION_Q054=0x51303534, + GQUIC_VERSION_Q055=0x51303535, + GQUIC_VERSION_Q056=0x51303536, + GQUIC_VERSION_Q057=0x51303537, + GQUIC_VERSION_Q058=0x51303538, + GQUIC_VERSION_Q059=0x51303539, + + GQUIC_VERSION_Q099=0x51303939, + + //Google QUIC with TLS 48 - 49 (T048 - T049) + GQUIC_VERSION_T048=0x54303438, + GQUIC_VERSION_T049=0x54303439, + + //Google QUIC with TLS 50 - 59 (T050 - T059) + GQUIC_VERSION_T050=0x54303530, + GQUIC_VERSION_T051=0x54303531, + GQUIC_VERSION_T052=0x54303532, + GQUIC_VERSION_T053=0x54303533, + GQUIC_VERSION_T054=0x54303534, + GQUIC_VERSION_T055=0x54303535, + GQUIC_VERSION_T056=0x54303536, + GQUIC_VERSION_T057=0x54303537, + GQUIC_VERSION_T058=0x54303538, + GQUIC_VERSION_T059=0x54303539, + + //Google QUIC with TLS 99 (T099) + GQUIC_VERSION_T099=0x54303939, + + //Google Proxied QUIC + PQUIC_VERSION_PROX=0x50524f58, + + //quic-go + QUIC_GO_VERSION_00=0x51474F00, + QUIC_GO_VERSION_FF=0x51474FFF, + + //quicly + QUICLY_VERSION_00=0x91c17000, + QUICLY_VERSION_FF=0x91c170FF, + + //Microsoft + MSQUIC_VERSION_00=0xabcd0000, + MSQUIC_VERSION_0F=0xabcd000F, + + //Mozilla + MOZQUIC_VERSION_00=0xf123f0c0, + MOZQUIC_VERSION_0F=0xf123f0cF, + + //Facebook + MVFST_VERSION_00=0xfaceb000, + MVFST_VERSION_01=0xfaceb001, + MVFST_VERSION_02=0xfaceb002, + MVFST_VERSION_03=0xfaceb003, + MVFST_VERSION_04=0xfaceb004, + MVFST_VERSION_05=0xfaceb005, + MVFST_VERSION_06=0xfaceb006, + MVFST_VERSION_07=0xfaceb007, + MVFST_VERSION_08=0xfaceb008, + MVFST_VERSION_09=0xfaceb009, + MVFST_VERSION_0A=0xfaceb00A, + MVFST_VERSION_0B=0xfaceb00B, + MVFST_VERSION_0C=0xfaceb00C, + MVFST_VERSION_0D=0xfaceb00D, + MVFST_VERSION_0E=0xfaceb00E, + MVFST_VERSION_0F=0xfaceb00F, + + //IETF + IQUIC_VERSION_RFC9000=0x00000001, + IQUIC_VERSION_I001=0xFF000001, + IQUIC_VERSION_I002=0xFF000002, + IQUIC_VERSION_I003=0xFF000003, + IQUIC_VERSION_I004=0xFF000004, + IQUIC_VERSION_I005=0xFF000005, + IQUIC_VERSION_I006=0xFF000006, + IQUIC_VERSION_I007=0xFF000007, + IQUIC_VERSION_I008=0xFF000008, + IQUIC_VERSION_I009=0xFF000009, + IQUIC_VERSION_I010=0xFF00000A, + IQUIC_VERSION_I011=0xFF00000B, + IQUIC_VERSION_I012=0xFF00000C, + IQUIC_VERSION_I013=0xFF00000D, + IQUIC_VERSION_I014=0xFF00000E, + IQUIC_VERSION_I015=0xFF00000F, + IQUIC_VERSION_I016=0xFF000010, + IQUIC_VERSION_I017=0xFF000011, + IQUIC_VERSION_I018=0xFF000012, + IQUIC_VERSION_I019=0xFF000013, + IQUIC_VERSION_I020=0xFF000014, + IQUIC_VERSION_I021=0xFF000015, + IQUIC_VERSION_I022=0xFF000016, + IQUIC_VERSION_I023=0xFF000017, + IQUIC_VERSION_I024=0xFF000018, + IQUIC_VERSION_I025=0xFF000019, + IQUIC_VERSION_I026=0xFF00001A, + IQUIC_VERSION_I027=0xFF00001B, + IQUIC_VERSION_I028=0xFF00001C, + IQUIC_VERSION_I029=0xFF00001D, + IQUIC_VERSION_I030=0xFF00001E, + IQUIC_VERSION_I031=0xFF00001F, + IQUIC_VERSION_I032=0xFF000020 +}; + +int lpi_plus_match_quic(int is_c2s_flow, const unsigned char *payload, size_t payload_sz) +{ + enum _QUIC_VERSION quic_version = QUIC_VERSION_UNKNOWN; + char public_flags=payload[0]; + int used_len = 1; + + if(payload_sz<5) + { + goto QUIC_UNKNOWN; + } + + // Q001~Q043: 0x80 is currently unused, and must be set to 0 + + // The most significant bit (0x80) of byte 0 (the first byte) is set to 1 for long headers + (payload[0] & 0x80) ? (quic_version = (enum _QUIC_VERSION)ntohl(*(unsigned int *)(payload + 1))) : QUIC_VERSION_UNKNOWN; + if ( + (quic_version == GQUIC_VERSION_Q099) || + (quic_version == PICOQUIC_VERSION_30) || + (quic_version == PQUIC_VERSION_PROX) || + (quic_version == GQUIC_VERSION_T099) || + (quic_version >= GQUIC_VERSION_Q044 && quic_version <= GQUIC_VERSION_Q050) || + (quic_version >= GQUIC_VERSION_Q051 && quic_version <= GQUIC_VERSION_Q059) || + (quic_version >= GQUIC_VERSION_T048 && quic_version <= GQUIC_VERSION_T049) || + (quic_version >= GQUIC_VERSION_T050 && quic_version <= GQUIC_VERSION_T059) || + (quic_version >= QUANT_VERSION_00 && quic_version <= QUANT_VERSION_FF) || + (quic_version >= QUIC_GO_VERSION_00 && quic_version <= QUIC_GO_VERSION_FF) || + (quic_version >= QUICLY_VERSION_00 && quic_version <= QUICLY_VERSION_FF) || + (quic_version >= MSQUIC_VERSION_00 && quic_version <= MSQUIC_VERSION_0F) || + (quic_version >= MOZQUIC_VERSION_00 && quic_version <= MOZQUIC_VERSION_0F) || + (quic_version >= MVFST_VERSION_00 && quic_version <= MVFST_VERSION_0F) || + (quic_version >= IQUIC_VERSION_I001 && quic_version <= IQUIC_VERSION_I032) || + (quic_version == IQUIC_VERSION_RFC9000)) + { + goto QUIC_KNOWN; + } + if(is_c2s_flow==0 && public_flags & GQUIC_PUBLIC_FLAG_VERSION) + { + goto QUIC_UNKNOWN; + } + if((!public_flags)&GQUIC_PUBLIC_FLAG_PKT_NUM) + { + if(public_flags&GQUIC_PUBLIC_FLAG_VERSION) //Public Reset Packet + { + goto QUIC_UNKNOWN;// todo + } + else // Version Negotiation Packet + { + goto QUIC_UNKNOWN; + } + } + if(public_flags&GQUIC_PUBLIC_FLAG_CID) + { + used_len+=sizeof(unsigned long long); // CID length + } + + if(payload_sz>=(size_t)(used_len+sizeof(int)) && public_flags&GQUIC_PUBLIC_FLAG_VERSION && (*(unsigned char *)(payload+used_len)==0x51)) + { + quic_version=(enum _QUIC_VERSION)ntohl(*(unsigned int *)(payload+used_len)); + used_len+=sizeof(int); // skip version + } + + if(quic_versionGQUIC_VERSION_Q043) + { + goto QUIC_UNKNOWN; + } + +QUIC_KNOWN: + return 1; + +QUIC_UNKNOWN: + return 0; +} + + +struct dns_header +{ + u_int16_t id; +#if __BYTE_ORDER == __LITTLE_ENDIAN + u_char rd:1; + u_char tc:1; + u_char aa:1; + u_char opcode:4; + u_char qr:1; + u_char rcode:4; + u_char z:3; + u_char ra:1; +#elif __BYTE_ORDER == __BIG_ENDIAN + u_char qr:1; + u_char opcode:4; + u_char aa:1; + u_char tc:1; + u_char rd:1; + u_char ra:1; + u_char z:3; + u_char rcode:4; +#endif + u_int16_t qdcount; + u_int16_t ancount; + u_int16_t aucount;//authority count + u_int16_t adcount;//additional count +}; + +__thread lpi_module_t per_thread_result; +lpi_module_t* lpi_plus_extended_guess(struct lpi_plus_detect_context *ctx, lpi_protocol_t lpi_proto, const char *payload, size_t payload_sz) +{ + unsigned short sport=ctx->lpi_data.client_port, dport=ctx->lpi_data.server_port; + + memset(&per_thread_result, 0, sizeof(per_thread_result)); + lpi_module_t *result=&per_thread_result; + + // FTPS + if((sport == 989 || sport == 990 || dport == 989 || dport == 990) && lpi_proto == LPI_PROTO_SSL) + { + result->protocol=(lpi_protocol_t)LPI_PROTP_FTPS; + result->category=LPI_CATEGORY_FILES; + result->priority=3; + result->name=ftps_name; + result->lpi_callback=NULL; + return result; + } + + //QUIC + if((sport==443 || dport==443 || sport==80 || dport==80 || sport==8443 || dport==8443) + && (lpi_proto==LPI_PROTO_UNKNOWN || lpi_proto==LPI_PROTO_UDP)) + { + if(lpi_plus_match_quic(ctx->current_is_c2s_flow, (const unsigned char *)payload, payload_sz)) + { + //lpi_quic + result->protocol=LPI_PROTO_UDP_QUIC; + result->category=LPI_CATEGORY_WEB; + result->priority=9; + result->name=quic_name; + result->lpi_callback=NULL; + return result; + } + } + + //DNS + if((sport==53 || dport==53) && (payload_sz>12) && (lpi_proto==LPI_PROTO_UNKNOWN || lpi_proto==LPI_PROTO_UDP)) + { + struct dns_header *dns_hdr=NULL; + if(ctx->lpi_data.trans_proto==IPPROTO_TCP) + { + dns_hdr=(struct dns_header *)(payload+2); + } + else + { + dns_hdr=(struct dns_header *)payload; + } + if((dns_hdr->qr==1 && ntohs(dns_hdr->qdcount)==1) || + (dns_hdr->qr==0 && ntohs(dns_hdr->qdcount)==1 && ntohs(dns_hdr->aucount)==0 && ntohs(dns_hdr->ancount)==0)) + { + result->protocol=LPI_PROTO_DNS; + result->category=LPI_CATEGORY_SERVICES; + result->priority=10; + result->name=dns_name; + result->lpi_callback=NULL; + return result; + } + } + + //IMAP + if(((sport==143 || dport==143)) + && ((lpi_proto==LPI_PROTO_UNKNOWN) && ctx->lpi_data.trans_proto==IPPROTO_TCP) + && ( + (payload_sz>=11 && memmem(payload, payload_sz, " CAPABILITY", 11)!=NULL) || + (payload_sz>=7 && memmem(payload, payload_sz, " LOGIN ", 7)!=NULL) + ) + ) + { + result->protocol=LPI_PROTO_IMAP; + result->category=LPI_CATEGORY_MAIL; + result->priority=2; + result->name=imap_name; + result->lpi_callback=NULL; + return result; + } + + if( (lpi_proto==LPI_PROTO_UNKNOWN || lpi_proto == LPI_PROTO_UDP)&& + 1 == lpi_plus_match_openvpn((const unsigned char *)payload, + payload_sz, + ctx->detected_c2s_pkt, + ctx->detected_s2c_pkt, + &ctx->ovpn, + ctx->lpi_data.trans_proto, + ctx->current_is_c2s_flow)) + { + result->protocol=LPI_PROTO_OPENVPN; + result->category=LPI_CATEGORY_TUNNELLING; + result->priority=4; + result->name=openvpn_name; + result->lpi_callback=NULL; + return result; + } + + //SMTP + if (lpi_proto == LPI_PROTO_FTP_CONTROL && ctx->detected_pkt_cnt == 1 && ctx->current_is_c2s_flow==0) + { + if ((((payload_sz >= 4 && (memcmp(payload, "220-", 4) == 0)) || memcmp(payload, "220 ", 4) == 0)) && + (((payload_sz >= 7 && (memmem(payload, payload_sz, " ESMTP ", 7) != NULL)) || + memmem(payload, payload_sz, " esmtp ", 7) != NULL))) + { + // lpi_smtp + result->protocol = LPI_PROTO_SMTP; + result->category = LPI_CATEGORY_MAIL; + result->priority = 2; + result->name = smtp_name; + return result; + } + } + + if (lpi_proto == LPI_PROTO_SMTP && ctx->detected_pkt_cnt == 1 && ctx->current_is_c2s_flow==0) + { + if ( + (payload_sz >= 4) && + (memcmp(payload, "220 ", 4) == 0 || memcmp(payload, "220-", 4) == 0) && + (memmem(payload, payload_sz, "FTPd", 4) != NULL || + memmem(payload, payload_sz, "ftpd", 4) != NULL || + memmem(payload, payload_sz, "FTPD", 4) != NULL)) + { + // lpi_ftpcontrol + result->protocol = LPI_PROTO_FTP_CONTROL; + result->category = LPI_CATEGORY_FILES; + result->priority = 3; + result->name = ftp_control_name; + return result; + } + } + return NULL; +} \ No newline at end of file diff --git a/decoders/lpi_plus/lpip_extend.h b/decoders/lpi_plus/lpip_extend.h new file mode 100644 index 0000000..0715c00 --- /dev/null +++ b/decoders/lpi_plus/lpip_extend.h @@ -0,0 +1,39 @@ +#pragma once + +#include "libprotoident/libprotoident.h" + +typedef enum { + LPI_PROTO_EXTEND_FRIST = LPI_PROTO_LAST, + LPI_PROTO_IKE, //unsupport + LPI_PROTO_DOH, //unsupport + LPI_PROTO_MAIL, //unsupport + LPI_PROTO_ESNI, //unsupport + LPI_PROTP_FTPS, + LPI_PROTO_EXTEND_LAST +} extend_lpi_protocol_t; + +struct ovpn_ctx +{ + uint64_t local_session_id; + int contain_local_session_id_pkt_num; + int valid_opcode_cnt; +}; + +struct lpi_plus_detect_context +{ + unsigned int detected_pkt_cnt; + unsigned short detected_s2c_pkt; + unsigned short detected_c2s_pkt; + unsigned char current_is_c2s_flow; + unsigned char stop_detect; + lpi_data_t lpi_data; // lpi API + union + { + struct ovpn_ctx ovpn; + }; +}; + + +int lpi_plus_match_quic(int is_c2s_flow, const unsigned char *payload, size_t payload_sz); +int lpi_plus_match_openvpn(const unsigned char *payload, size_t payload_sz, int c2s_pkt_cnt, int s2c_pkt_cnt, struct ovpn_ctx *ovpn, unsigned char trans_proto, bool is_c2s_flow); +lpi_module_t* lpi_plus_extended_guess(struct lpi_plus_detect_context *ctx, lpi_protocol_t lpi_proto, const char *payload, size_t payload_sz); \ No newline at end of file diff --git a/decoders/lpi_plus/lpip_module.c b/decoders/lpi_plus/lpip_module.c new file mode 100644 index 0000000..9286a2e --- /dev/null +++ b/decoders/lpi_plus/lpip_module.c @@ -0,0 +1,392 @@ +/* + * dpkt_basic_proto_main.cpp + * + * Created on: Aug 7, 2020 + * Author: iie + */ + +#include +#include +#include +#include +#include + +#include "uthash/uthash.h" + +#include "stellar/utils.h" +#include "stellar/packet.h" +#include "stellar/session_manager.h" + +#include "appid/appid_internal.h" + +#include "lpi_plus.h" +#include "lpip_extend.h" + + +const char *l7_protocol_file = (char *)"./tsgconf/tsg_l7_protocol.conf"; + +struct lpi_plus_appid_info +{ + int appid; + char lpi_name[255]; + char app_name[255]; + UT_hash_handle hh_appid; + UT_hash_handle hh_lpi_name; +}; + +struct lpi_plus_mapper +{ + struct lpi_plus_appid_info *hash_name2appid; + struct lpi_plus_appid_info *hash_appid2name; +}; + +struct lpi_plus_env +{ + unsigned int max_pkts; + int lpip_session_exdata_idx; + int topic_appid; + struct stellar_module_manager *mod_mgr; + struct lpi_plus_mapper *mapper; +}; + +struct lpi_plus_exdata +{ + struct lpi_plus_detect_context ctx; + int appid[MAX_APPID_NUM]; + size_t appid_num; +}; + +static void lpi_plus_get_host_order_port(struct session *sess __unused, unsigned short *sport, unsigned short *dport) +{ + *sport=0; + *dport=0; +//get host order port from stellar session api + + const struct packet *pkt = session_get0_current_packet(sess); + enum flow_type flow_type=session_get_flow_type(sess); + if(pkt && (flow_type==FLOW_TYPE_C2S || flow_type==FLOW_TYPE_S2C)) + { + int layer_cnt=packet_get_layer_count(pkt); + const struct layer *layer = packet_get_layer_by_idx(pkt, layer_cnt - 1); + if (layer && layer->proto == LAYER_PROTO_TCP) + { + *sport = ntohs(layer->hdr.tcp->th_sport); + *dport = ntohs(layer->hdr.tcp->th_dport); + } + if (layer && layer->proto == LAYER_PROTO_UDP) + { + *sport = ntohs(layer->hdr.udp->uh_sport); + *dport = ntohs(layer->hdr.udp->uh_dport); + } + //S2C, swap sport and dport + if(flow_type == FLOW_TYPE_S2C) + { + unsigned short tmp = *sport; + *sport = *dport; + *dport = tmp; + } + } + return; +} + +//TODO: fill packet sequence +static struct appid_message *lpi_plus_message_new(struct session *sess, int *id_array, size_t id_num) +{ + struct appid_message *result=CALLOC(struct appid_message, 1); + result->origin=ORIGIN_LPI_PLUS; + result->sess=sess; + result->appid_num=id_num; + for(unsigned int i=0; iappid_num; i++) + { + result->appid[i]=(int)(id_array[i]); + result->surrogate_id[i]=0; + } + + return result; +} + +static int lpi_plus_appid_update(int current_id_array[], size_t *current_id_num, int incoming_id) +{ + size_t i=0; + + if(*current_id_num>=MAX_APPID_NUM) + { + return 0; + } + + for(i=0; i<(*current_id_num); i++) + { + if(incoming_id==current_id_array[i]) + { + return 0; + } + } + + current_id_array[(*current_id_num)]=incoming_id; + (*current_id_num)++; + + return 1; +} + +static int lpi_plus_name2appid(struct lpi_plus_mapper *mapper, const char *lpi_name, size_t name_sz) +{ + struct lpi_plus_appid_info *out=NULL; + HASH_FIND(hh_lpi_name, mapper->hash_appid2name, lpi_name, name_sz, out); + if(out==NULL)return 0; + return out->appid; +} + +const char *lpi_plus_appid2name(struct lpi_plus_mapper *mapper, int appid) +{ + struct lpi_plus_appid_info *out=NULL; + HASH_FIND(hh_appid, mapper->hash_appid2name, &appid, sizeof(int), out); + if(out==NULL)return NULL; + return out->app_name; +} + +static struct lpi_plus_mapper *lpi_plus_mapper_new(const char *filename) +{ + size_t ret=0; + FILE *fp=NULL; + char line[1024]={0}; + char type_name[32]={0}; + struct lpi_plus_appid_info *appid_info=NULL; + struct lpi_plus_appid_info *tmp=NULL; + + fp=fopen(filename, "r"); + if(fp==NULL) + { + printf("Open %s failed ...", filename); + return NULL; + } + struct lpi_plus_mapper * mapper=(struct lpi_plus_mapper *)calloc(1, sizeof(struct lpi_plus_mapper)); + while((fgets(line, sizeof(line), fp))!=NULL) + { + if(line[0]=='#' || line[0]=='\n' || line[0]=='\r' ||line[0]=='\0') + { + continue; + } + + appid_info=(struct lpi_plus_appid_info *)calloc(1, sizeof(struct lpi_plus_appid_info)); + ret=sscanf(line, "%31s %63s %d %63s", type_name, appid_info->lpi_name, &appid_info->appid, appid_info->app_name); + + if(ret==3) + { + strcpy(appid_info->app_name, appid_info->lpi_name); + } + + HASH_FIND(hh_lpi_name, mapper->hash_name2appid, appid_info->lpi_name, strlen(appid_info->lpi_name), tmp); + + //deduplicate + if(tmp) + { + free(appid_info); + continue; + } + HASH_ADD_KEYPTR(hh_lpi_name, mapper->hash_name2appid, appid_info->lpi_name, strlen(appid_info->lpi_name), appid_info); + HASH_ADD(hh_appid, mapper->hash_appid2name, appid, sizeof(int), appid_info); + memset(line, 0, sizeof(line)); + } + fclose(fp); + return mapper; +} + +static void lpi_plus_mapper_free(struct lpi_plus_mapper *mapper) +{ + if(mapper==NULL)return; + + struct lpi_plus_appid_info *out=NULL, *tmp=NULL; + HASH_CLEAR(hh_appid, mapper->hash_appid2name); + HASH_ITER(hh_lpi_name, mapper->hash_name2appid, out ,tmp) + { + HASH_DELETE(hh_lpi_name, mapper->hash_name2appid, out); + free(out); + } + free(mapper); +} + +void lpi_plus_context_update(struct session *sess, struct lpi_plus_detect_context *ctx, + const char *scan_data, int scan_data_len) +{ + lpi_data_t *data = &ctx->lpi_data; + int l4_proto = 0; + enum session_type type = session_get_type(sess); + if (type == SESSION_TYPE_TCP) + { + l4_proto = IPPROTO_TCP; + } + if (type == SESSION_TYPE_UDP) + { + l4_proto = IPPROTO_UDP; + } + int cur_pkt_dir = session_get_flow_type(sess); + ctx->detected_pkt_cnt++; + (cur_pkt_dir == FLOW_TYPE_C2S) ? (ctx->detected_c2s_pkt++) : (ctx->detected_s2c_pkt++); + ctx->current_is_c2s_flow = ((cur_pkt_dir == FLOW_TYPE_C2S) ? 1 : 0); + uint32_t dir = 0; + if(ctx->current_is_c2s_flow) + { + dir = 0; + } + else + { + dir = 1; + } + uint32_t four_bytes; + + data->observed[dir] += scan_data_len; + + if (data->trans_proto == 0)data->trans_proto = l4_proto; + + if (scan_data_len < 4) + { + memcpy((char *)&four_bytes, scan_data, scan_data_len); + four_bytes = (ntohl(four_bytes)) >> (8 * (4 - scan_data_len)); + four_bytes = htonl(four_bytes << (8 * (4 - scan_data_len))); + } + else + { + four_bytes = (*(uint32_t *)scan_data); + } + + data->payload[dir] = four_bytes; + data->payload_len[dir] = scan_data_len; + + uint16_t source=0; + uint16_t dest=0; + lpi_plus_get_host_order_port(sess,&source ,&dest); + + data->client_port = source; + data->server_port = dest; + return; + +} + +static int lpi_plus_detect(struct lpi_plus_detect_context *ctx, struct lpi_plus_mapper *mapper, const char *payload, size_t payload_len) +{ + lpi_module_t *plpi_mod=lpi_guess_protocol(&(ctx->lpi_data)); + if(plpi_mod==NULL)return 0; + + lpi_module_t *extend_result = lpi_plus_extended_guess(ctx, plpi_mod->protocol, payload, payload_len); + if (extend_result)plpi_mod=extend_result; + + int new_appid=lpi_plus_name2appid(mapper, plpi_mod->name, strlen(plpi_mod->name)); + + //if appid won't be outer of tunnel, stop detecting + if (new_appid>0 + && (plpi_mod->category != LPI_CATEGORY_TUNNELLING + && plpi_mod->category != LPI_CATEGORY_NAT + && plpi_mod->protocol != LPI_PROTO_RDP + && plpi_mod->protocol != LPI_PROTO_UDP_RDP + && plpi_mod->protocol != LPI_PROTO_UDP_RTP + && plpi_mod->protocol != LPI_PROTO_UDP_RTCP)) + { + ctx->stop_detect=1; + } + return new_appid; +} + +static void lpi_plus_on_session(struct session *sess, struct packet *pkt, void *args) +{ + if(pkt==NULL)return; + struct lpi_plus_env *env=(struct lpi_plus_env *)args; + struct lpi_plus_exdata *exdata = (struct lpi_plus_exdata *)session_get_exdata(sess, env->lpip_session_exdata_idx); + if(exdata==NULL) + { + exdata= CALLOC(struct lpi_plus_exdata, 1); + session_set_exdata(sess, env->lpip_session_exdata_idx, exdata); + } + if(exdata->ctx.stop_detect==1)return; + if(exdata->ctx.detected_pkt_cnt>=env->max_pkts)return; + + uint16_t payload_len=packet_get_payload_len(pkt); + const char *payload=packet_get_payload(pkt); + if (payload!=NULL && payload_len>0)//detect packet with payload only + { + lpi_plus_context_update(sess, &exdata->ctx, payload, payload_len); + int appid=lpi_plus_detect(&exdata->ctx, env->mapper, payload, payload_len); + if(appid>0 && lpi_plus_appid_update(exdata->appid, &(exdata->appid_num), appid)) + { + struct appid_message *msg=lpi_plus_message_new(sess, exdata->appid, exdata->appid_num); + if(0 > mq_runtime_publish_message(stellar_module_manager_get_mq_runtime(env->mod_mgr), + env->topic_appid, + msg))FREE(msg); + } + } + return; +} + +static void lpi_plus_exdata_free(int idx __unused, void *ex_ptr, void *arg __unused) +{ + if(ex_ptr==NULL)return; + FREE(ex_ptr); +} + +void lpi_plus_exit(struct stellar_module_manager *mod_mgr, struct stellar_module *mod) +{ + if(mod_mgr==NULL)return; + if(mod) + { + struct lpi_plus_env *env=(struct lpi_plus_env *)stellar_module_get_ctx(mod); + lpi_free_library(); + lpi_plus_mapper_free(env->mapper); + FREE(env); + stellar_module_free(mod); + } +} + +struct stellar_module *lpi_plus_init(struct stellar_module_manager *mod_mgr) +{ + if(mod_mgr==NULL)return NULL; + + struct lpi_plus_env *env=CALLOC(struct lpi_plus_env, 1); + struct stellar_module *mod=stellar_module_new("LPI_PLUS", env); + env->mod_mgr=mod_mgr; + env->max_pkts=16;//TODO: load from toml + + struct session_manager *sess_mgr=stellar_module_get_session_manager(mod_mgr); + struct mq_schema *mq_s=stellar_module_manager_get_mq_schema(mod_mgr); + + if(sess_mgr==NULL || mq_s==NULL) + { + goto INIT_ERROR; + } + + if(lpi_init_library()<0) + { + goto INIT_ERROR; + } + env->mapper=lpi_plus_mapper_new(l7_protocol_file);// TODO: load path from toml + if(env->mapper == NULL) + { + goto INIT_ERROR; + } + + session_manager_subscribe_tcp(sess_mgr,lpi_plus_on_session, env); + session_manager_subscribe_udp(sess_mgr, lpi_plus_on_session, env); + + env->lpip_session_exdata_idx = session_manager_new_session_exdata_index(sess_mgr, "EXDATA_LPI", lpi_plus_exdata_free, NULL); + env->topic_appid=stellar_appid_create_topic(mod_mgr); + if(env->topic_appid<0) + { + goto INIT_ERROR; + } + + return mod; + +INIT_ERROR: + lpi_plus_exit(mod_mgr, mod); + exit(-1); + return NULL; + +} + +struct lpi_plus_mapper *stellar_module_get_lpip(struct stellar_module_manager *mod_mgr) +{ + if(mod_mgr==NULL)return NULL; + struct stellar_module *mod=stellar_module_manager_get_module(mod_mgr, "LPI_PLUS"); + if(mod==NULL)return NULL; + struct lpi_plus_env *lpi_p=(struct lpi_plus_env *)stellar_module_get_ctx(mod); + if(lpi_p==NULL)return NULL; + return lpi_p->mapper; +} \ No newline at end of file diff --git a/decoders/lpi_plus/version.map b/decoders/lpi_plus/version.map new file mode 100644 index 0000000..179b07f --- /dev/null +++ b/decoders/lpi_plus/version.map @@ -0,0 +1,11 @@ +VERS_2.4{ +global: +extern "C" { + lpi_plus_init; + lpi_plus_exit; + stellar_appid_subscribe; + GIT_VERSION_*; +}; + +local: *; +}; diff --git a/include/stellar/appid.h b/include/stellar/appid.h index 6d82d71..df30a8f 100644 --- a/include/stellar/appid.h +++ b/include/stellar/appid.h @@ -1,16 +1,19 @@ #pragma once +#ifdef __cplusplus +extern "C" +{ +#endif + #include #include -#define MESSAGE_MAGIC 0x12345678 +#include "stellar/session.h" +#include "stellar/module_manager.h" -#define MAX_APP_ID_NUM 8 -#define APP_ID_MESSAGE_TOPIC "TOPIC_APP_ID" - -enum APP_IDENTIFY_ORIGIN +enum APPID_ORIGIN { - ORIGIN_PROTO_IDENTIFY=0, + ORIGIN_LPI_PLUS=0, ORIGIN_APP_SKETCH_USER_DEFINE, ORIGIN_PROTO_ENGINE, ORIGIN_APP_SKETCH_BUILT_IN, @@ -20,12 +23,10 @@ enum APP_IDENTIFY_ORIGIN ORIGIN_MAX }; -struct app_id_message -{ - int magic; - enum APP_IDENTIFY_ORIGIN origin; - uint32_t app_id_num; - int32_t app_id[MAX_APP_ID_NUM]; - uint32_t surrogate_id[MAX_APP_ID_NUM]; - uint32_t packet_sequence[MAX_APP_ID_NUM]; -}; \ No newline at end of file +typedef void on_appid_callback(struct session *sess, enum APPID_ORIGIN origin, int appid[], size_t appid_num, void *args); +int stellar_appid_create_topic(struct stellar_module_manager *mod_mgr); +int stellar_appid_subscribe(struct stellar_module_manager *mod_mgr, on_appid_callback *cb, void *args); + +#ifdef __cplusplus +} +#endif \ No newline at end of file diff --git a/include/stellar/module_manager.h b/include/stellar/module_manager.h index a944186..70ee5a5 100644 --- a/include/stellar/module_manager.h +++ b/include/stellar/module_manager.h @@ -8,9 +8,6 @@ extern "C" #include "stellar/mq.h" #include "stellar/log.h" -#define PACKET_MANAGER_MODULE_NAME "packet_manager_module" -#define SESSION_MANAGER_MODULE_NAME "session_manager_module" - struct stellar_module; struct stellar_module *stellar_module_new(const char *name, void *ctx); void stellar_module_free(struct stellar_module *mod); diff --git a/include/stellar/packet_manager.h b/include/stellar/packet_manager.h index 8270c7b..dd90074 100644 --- a/include/stellar/packet_manager.h +++ b/include/stellar/packet_manager.h @@ -8,6 +8,8 @@ extern "C" #include "stellar/exdata.h" #include "stellar/packet.h" +#include "stellar/module_manager.h" + enum packet_stage { PACKET_STAGE_PREROUTING, @@ -20,6 +22,8 @@ enum packet_stage struct packet_manager; +struct packet_manager *stellar_module_get_packet_manager(struct stellar_module_manager *mod_mgr); + int packet_manager_new_packet_exdata_index(struct packet_manager *pkt_mgr, const char *name, exdata_free *func, void *arg); typedef void on_packet_stage_callback(enum packet_stage stage, struct packet *pkt, void *args); diff --git a/include/stellar/session_manager.h b/include/stellar/session_manager.h index 749ccbb..87d4b18 100644 --- a/include/stellar/session_manager.h +++ b/include/stellar/session_manager.h @@ -10,8 +10,12 @@ extern "C" #include "stellar/exdata.h" #include "stellar/session.h" +#include "stellar/module_manager.h" + struct session_manager; +struct session_manager *stellar_module_get_session_manager(struct stellar_module_manager *mod_mgr); + int session_manager_new_session_exdata_index(struct session_manager *sess_mgr, const char *name, exdata_free *func, void *arg); typedef void on_session_callback(struct session *sess, struct packet *pkt, void *args); diff --git a/include/stellar/stellar.h b/include/stellar/stellar.h index 9dfd711..0be4c6e 100644 --- a/include/stellar/stellar.h +++ b/include/stellar/stellar.h @@ -9,6 +9,7 @@ extern "C" #include "stellar/log.h" #include "stellar/packet.h" +#include "stellar/module_manager.h" struct stellar; @@ -26,6 +27,7 @@ void stellar_free(struct stellar *st); void stellar_loopbreak(struct stellar *st); void stellar_reload_log_level(struct stellar *st); struct logger *stellar_get_logger(struct stellar *st); +struct stellar_module_manager *stellar_get_module_manager(struct stellar *st); #ifdef __cplusplus } diff --git a/infra/CMakeLists.txt b/infra/CMakeLists.txt index 008713e..8dfa468 100644 --- a/infra/CMakeLists.txt +++ b/infra/CMakeLists.txt @@ -1,6 +1,6 @@ set(INFRA exdata mq tuple packet_manager packet_io ip_reassembly tcp_reassembly session_manager module_manager polling_manager) set(DEPS bitmap dablooms interval_tree logger nmx_pool rbtree timeout toml) -#set(DECODERS http lpi) +set(DECODERS appid lpi_plus) set(WHOLE_ARCHIVE ${DEPS} ${INFRA} ${DECODERS}) set(LIBS fieldstat4) diff --git a/infra/mq/mq.c b/infra/mq/mq.c index ff503a8..a054e19 100644 --- a/infra/mq/mq.c +++ b/infra/mq/mq.c @@ -122,7 +122,7 @@ static int mq_dispatch_one_message(struct mq_topic *topic, struct mq_message *mq -int mq_runtime_publish_message_at_once(struct mq_runtime *rt, int topic_id, void *msg) +int mq_runtime_publish_message_immediate(struct mq_runtime *rt, int topic_id, void *msg) { if(rt==NULL || rt->schema == NULL)return -1; diff --git a/infra/mq/mq_internal.h b/infra/mq/mq_internal.h index 4d60e37..146d222 100644 --- a/infra/mq/mq_internal.h +++ b/infra/mq/mq_internal.h @@ -71,7 +71,7 @@ struct mq_runtime }; int mq_runtime_publish_message_with_priority(struct mq_runtime *rt, int topic_id, void *msg, enum mq_property priority); -int mq_runtime_publish_message_at_once(struct mq_runtime *rt, int topic_id, void *msg); +int mq_runtime_publish_message_immediate(struct mq_runtime *rt, int topic_id, void *msg); #ifdef __cplusplus } diff --git a/infra/mq/test/gtest_mq_main.cpp b/infra/mq/test/gtest_mq_main.cpp index 2f16fcb..a2ee952 100644 --- a/infra/mq/test/gtest_mq_main.cpp +++ b/infra/mq/test/gtest_mq_main.cpp @@ -342,7 +342,7 @@ static void test_pub_on_msg_free(void *msg, void *msg_free_arg) if((long)msg!=env->N_round && (int)(long)msg==env->N_round-1) { EXPECT_EQ(mq_runtime_publish_message(env->rt, env->topic_id, (void *)(long)(env->N_round)), -1);//on message free, publish always failed - EXPECT_EQ(mq_runtime_publish_message_at_once(env->rt, env->topic_id, (void *)(long)(env->N_round)), 0);//on message free, publish at once success + EXPECT_EQ(mq_runtime_publish_message_immediate(env->rt, env->topic_id, (void *)(long)(env->N_round)), 0);//on message free, publish at once success } return; } diff --git a/infra/packet_manager/packet_manager.c b/infra/packet_manager/packet_manager.c index eba87ec..e492414 100644 --- a/infra/packet_manager/packet_manager.c +++ b/infra/packet_manager/packet_manager.c @@ -4,7 +4,8 @@ #include "packet_internal.h" #include "packet_manager_runtime.h" #include "packet_manager_internal.h" -#include "stellar/module_manager.h" + +#define PACKET_MANAGER_MODULE_NAME "packet_manager_module" struct packet_manager_config { @@ -290,6 +291,17 @@ void packet_manager_print_stat(struct packet_manager *pkt_mgr, uint16_t thread_i * packet manager module ******************************************************************************/ +struct packet_manager *stellar_module_get_packet_manager(struct stellar_module_manager *mod_mgr) +{ + assert(mod_mgr); + struct stellar_module *pkt_mgr_mod = stellar_module_manager_get_module(mod_mgr, PACKET_MANAGER_MODULE_NAME); + if (pkt_mgr_mod == NULL) + { + return NULL; + } + return (struct packet_manager*)stellar_module_get_ctx(pkt_mgr_mod); +} + struct stellar_module *packet_manager_on_init(struct stellar_module_manager *mod_mgr) { assert(mod_mgr); diff --git a/infra/session_manager/session_manager.c b/infra/session_manager/session_manager.c index a2b2fd7..5f3820f 100644 --- a/infra/session_manager/session_manager.c +++ b/infra/session_manager/session_manager.c @@ -11,9 +11,12 @@ #include "session_internal.h" #include "session_manager_runtime.h" +#define SESSION_MANAGER_MODULE_NAME "session_manager_module" + #pragma GCC diagnostic ignored "-Wunused-parameter" #pragma GCC diagnostic ignored "-Wunused-function" + struct session_manager_schema { struct exdata_schema *exdata; @@ -162,14 +165,11 @@ static void clean_session(struct session_manager_runtime *sess_mgr_rt, uint64_t #define MAX_CLEANED_SESS 1024 struct session *sess = NULL; struct session *cleaned_sess[MAX_CLEANED_SESS] = {NULL}; - struct exdata_runtime *exdata_rt = NULL; uint64_t used = session_manager_runtime_clean_session(sess_mgr_rt, now_ms, cleaned_sess, MAX_CLEANED_SESS); for (uint64_t j = 0; j < used; j++) { sess = cleaned_sess[j]; - exdata_rt = (struct exdata_runtime *)session_get_user_data(sess); - exdata_runtime_free(exdata_rt); session_manager_runtime_free_session(sess_mgr_rt, sess); } } @@ -421,12 +421,21 @@ int session_manager_subscribe_tcp_stream(struct session_manager *sess_mgr, on_tc * session manager module ******************************************************************************/ +struct session_manager *stellar_module_get_session_manager(struct stellar_module_manager *mod_mgr) +{ + assert(mod_mgr); + struct stellar_module *sess_mgr_mod = stellar_module_manager_get_module(mod_mgr, SESSION_MANAGER_MODULE_NAME); + if (sess_mgr_mod == NULL) + { + return NULL; + } + return stellar_module_get_ctx(sess_mgr_mod); +} + struct stellar_module *session_manager_on_init(struct stellar_module_manager *mod_mgr) { assert(mod_mgr); - struct stellar_module *pkt_mgr_mod = stellar_module_manager_get_module(mod_mgr, PACKET_MANAGER_MODULE_NAME); - assert(pkt_mgr_mod); - struct packet_manager *pkt_mgr = stellar_module_get_ctx(pkt_mgr_mod); + struct packet_manager *pkt_mgr = stellar_module_get_packet_manager(mod_mgr); assert(pkt_mgr); struct stellar_polling_manager *poll_mgr = stellar_module_get_polling_manager(mod_mgr); assert(poll_mgr); diff --git a/infra/session_manager/session_manager_runtime.c b/infra/session_manager/session_manager_runtime.c index f89176c..efb9e42 100644 --- a/infra/session_manager/session_manager_runtime.c +++ b/infra/session_manager/session_manager_runtime.c @@ -14,6 +14,12 @@ #include "session_transition.h" #include "session_manager_runtime.h" +#include "stellar/exdata.h" + +#define SESSION_MANAGER_RUNTIME_LOG_ERROR(format, ...) STELLAR_LOG_ERROR(__thread_local_logger, "session manager runtime", format, ##__VA_ARGS__) +#define SESSION_MANAGER_RUNTIME_LOG_DEBUG(format, ...) STELLAR_LOG_DEBUG(__thread_local_logger, "session manager runtime", format, ##__VA_ARGS__) +#define SESSION_MANAGER_RUNTIME_LOG_INFO(format, ...) STELLAR_LOG_INFO(__thread_local_logger, "session manager runtime", format, ##__VA_ARGS__) + struct snowflake { uint64_t seed; @@ -1060,6 +1066,10 @@ void session_manager_runtime_free_session(struct session_manager_runtime *sess_m { if (sess) { + struct exdata_runtime *exdata_rt = (struct exdata_runtime *)session_get_user_data(sess); + exdata_runtime_free(exdata_rt); + + SESSION_MANAGER_RUNTIME_LOG_DEBUG("session %lu closed (%s)", session_get_id(sess), closing_reason_to_str(session_get_closing_reason(sess))); SESSION_MANAGER_LOG_DEBUG("session %lu closed (%s)", session_get_id(sess), closing_reason_to_str(session_get_closing_reason(sess))); session_timer_del(sess_mgr_rt->sess_timer, sess); diff --git a/infra/stellar_core.c b/infra/stellar_core.c index a63a5bd..81c3c2a 100644 --- a/infra/stellar_core.c +++ b/infra/stellar_core.c @@ -52,8 +52,7 @@ static void *worker_thread(void *arg) struct stellar_module_manager *mod_mgr = st->mod_mgr; struct mq_runtime *mq_rt = mq_runtime_new(st->mq_schema); struct stellar_polling_manager *polling_mgr = stellar_module_get_polling_manager(mod_mgr); - struct stellar_module *pkt_mgr_mod = stellar_module_manager_get_module(mod_mgr, PACKET_MANAGER_MODULE_NAME); - struct packet_manager *pkt_mgr = stellar_module_get_ctx(pkt_mgr_mod); + struct packet_manager *pkt_mgr = stellar_module_get_packet_manager(mod_mgr); snprintf(thread_name, sizeof(thread_name), "stellar:%d", thread_id); prctl(PR_SET_NAME, (unsigned long long)thread_name, NULL, NULL, NULL); @@ -199,7 +198,7 @@ struct stellar *stellar_new(const char *toml_file) st->mod_mgr = stellar_module_manager_new(toml_file, st->thread_num, st->mq_schema, st->logger); if (st->mod_mgr == NULL) { - CORE_LOG_ERROR("unable to create module manager"); + CORE_LOG_ERROR("unable to create packet manager"); goto error_out; } @@ -290,4 +289,16 @@ struct logger *stellar_get_logger(struct stellar *st) { return NULL; } +} + +struct stellar_module_manager *stellar_get_module_manager(struct stellar *st) +{ + if (st) + { + return st->mod_mgr; + } + else + { + return NULL; + } } \ No newline at end of file diff --git a/infra/version.map b/infra/version.map index a6163bc..496011a 100644 --- a/infra/version.map +++ b/infra/version.map @@ -36,6 +36,12 @@ global: session_get_stat; session_get0_readable_addr; session_set_discard; + session_manager_new_session_exdata_index; + session_get_exdata; + session_set_exdata; + session_manager_subscribe_tcp; + session_manager_subscribe_udp; + session_manager_subscribe_tcp_stream; stellar_session_plugin_register; stellar_session_plugin_register_with_hooks; @@ -49,6 +55,10 @@ global: stellar_loopbreak; stellar_get_logger; stellar_reload_log_level; + stellar_get_module_manager; + + stellar_appid_subscribe; + log_print; log_check_level; @@ -61,14 +71,14 @@ global: session_manager_on_init; session_manager_on_exit; - http_message_*; - http_decoder_init; - http_decoder_exit; - http_decoder_tcp_stream_msg_cb; - http_url_decode; + http_message_*; + http_decoder_init; + http_decoder_exit; + http_decoder_tcp_stream_msg_cb; + http_url_decode; - lpi_plugin_load; - lpi_plugin_unload; + lpi_plus_init; + lpi_plus_exit; local: *; }; diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt index 1fdc838..7cf7e86 100644 --- a/test/CMakeLists.txt +++ b/test/CMakeLists.txt @@ -2,6 +2,8 @@ add_subdirectory(packet_tool) add_subdirectory(session_debugger) #add_subdirectory(lpi_plugin) +#add_subdirectory(debug_plugin) +add_subdirectory(lpi_plus) #add_subdirectory(decoders/http) #add_subdirectory(decoders/socks) #add_subdirectory(decoders/stratum) diff --git a/test/lpi_plugin/gtest_lpi_plugin.cpp b/test/lpi_plugin/gtest_lpi_plugin.cpp deleted file mode 100644 index 8618c2f..0000000 --- a/test/lpi_plugin/gtest_lpi_plugin.cpp +++ /dev/null @@ -1,176 +0,0 @@ -#pragma GCC diagnostic ignored "-Wunused-parameter" - -#include -#include -#include -#include - -#include "lpi_plugin.h" - -#include "stellar/stellar.h" -#include "stellar/session.h" -#include "stellar/stellar_exdata.h" -#include "stellar/stellar_mq.h" - -#include "cjson/cJSON.h" - - -#define MAX_APP_ID_VALUE 10000 -struct lpi_test_plugin_env -{ - int test_exdata_idx; - int l7_exdata_idx; - int test_app_plugin_id; - int expect_json_topic_id; - struct stellar *st; - char *g_proto_id2name[MAX_APP_ID_VALUE]; -}; - -static int load_l7_protocol_mapper(const char *filename, struct lpi_test_plugin_env *env) -{ - memset(env->g_proto_id2name, 0, sizeof(env->g_proto_id2name)); - int ret=0, proto_id=0;; - FILE *fp=NULL; - char line[1024]={0}; - char type_name[32]={0}; - char proto_name[32]={0}; - - fp=fopen(filename, "r"); - if(fp==NULL) - { - printf("Open %s failed ...", filename); - return -1; - } - - memset(line, 0, sizeof(line)); - - while((fgets(line, sizeof(line), fp))!=NULL) - { - if(line[0]=='#' || line[0]=='\n' || line[0]=='\r' ||line[0]=='\0') - { - continue; - } - - ret=sscanf(line, "%31s %31s %d", type_name, proto_name, &proto_id); - env->g_proto_id2name[proto_id] = (char*)calloc(strlen(proto_name)+1, 1); - strcpy(env->g_proto_id2name[proto_id], proto_name); - memset(line, 0, sizeof(line)); - } - - fclose(fp); - fp=NULL; - return ret; -} - -static void publish_session_test_result(struct lpi_test_plugin_env *env, cJSON *ctx, struct session *sess) -{ - assert(env->l7_exdata_idx >= 0 && ctx != NULL); - struct l7_protocol_label *label = (struct l7_protocol_label *)session_exdata_get(sess, env->l7_exdata_idx);; - if(label != NULL) - { - int proto_ids[8]; - const char* proto_names[8]; - for(int i = 0; i < label->protocol_id_num; i++) - { - proto_ids[i] = (int)(label->protocol_id[i]); - proto_names[i] = env->g_proto_id2name[proto_ids[i]]; - - } - cJSON *label_ids = cJSON_CreateIntArray(proto_ids, label->protocol_id_num); - cJSON_AddItemToObject(ctx, "l7_label_id", label_ids); - cJSON *label_names = cJSON_CreateStringArray(proto_names, label->protocol_id_num); - cJSON_AddItemToObject(ctx, "l7_label_name", label_names); - } - else - { - cJSON_AddStringToObject(ctx, "l7_label_id", "UNKNOWN"); - } - unsigned char dir_flag; - int is_symmetric=session_is_symmetric(sess, &dir_flag); - if(is_symmetric) - { - cJSON_AddStringToObject(ctx, "STREAM_DIR", "DOUBLE"); - } - else if(dir_flag == SESSION_SEEN_C2S_FLOW) - { - cJSON_AddStringToObject(ctx, "STREAM_DIR", "C2S"); - } - else if(dir_flag == SESSION_SEEN_S2C_FLOW) - { - cJSON_AddStringToObject(ctx, "STREAM_DIR", "S2C"); - } - else - { - assert(0); - } - session_mq_publish_message(sess, env->expect_json_topic_id, cJSON_Print(ctx)); - cJSON_Delete(ctx); - return; -} - -static void gtest_lpi_on_session_free(struct session *sess, void *per_session_ctx, void *plugin_env) -{ - cJSON *ctx =cJSON_CreateObject(); - cJSON_AddStringToObject(ctx, "Tuple4", session_get0_readable_addr(sess)); - enum session_type type= session_get_type(sess); - if (type == SESSION_TYPE_TCP) - { - cJSON_AddStringToObject(ctx, "STREAM_TYPE", "TCP"); - } - if (type == SESSION_TYPE_UDP) - { - cJSON_AddStringToObject(ctx, "STREAM_TYPE", "UDP"); - } - publish_session_test_result((struct lpi_test_plugin_env*)plugin_env, ctx, sess); -} - -extern "C" void *gtest_lpi_plugin_load(struct stellar *st) -{ - struct lpi_test_plugin_env *env = (struct lpi_test_plugin_env *)calloc(1, sizeof(struct lpi_test_plugin_env)); - env->st=st; - const char *l7_proto_name=(const char*)"./tsgconf/tsg_l7_protocol.conf"; - - env->l7_exdata_idx= stellar_exdata_new_index(st, "L7_PROTOCOL", stellar_exdata_free_default, NULL); - env->test_exdata_idx= stellar_exdata_new_index(st, "APP_PROTO_TEST", stellar_exdata_free_default, NULL); - if(env->l7_exdata_idx<0 || env->test_exdata_idx<0) - { - perror("gtest_lpi_plugin_load:stellar_session_get_ex_new_index faild!!!\n"); - exit(-1); - } - if(load_l7_protocol_mapper(l7_proto_name, env)<0) - { - perror("gtest_lpi_plugin_load:l7_protocol_mapper failed !!!\n"); - exit(-1); - } - env->test_app_plugin_id=stellar_plugin_register(st, NULL, NULL, NULL, gtest_lpi_on_session_free, env); - if(env->test_app_plugin_id < 0) - { - perror("gtest_lpi_plugin_load:stellar_plugin_register failed !!!\n"); - exit(-1); - } - - int tcp_topic_id=stellar_mq_get_topic_id(st, TOPIC_TCP_INPUT); - int udp_topic_id=stellar_mq_get_topic_id(st, TOPIC_UDP_INPUT); - if(tcp_topic_id < 0 || udp_topic_id < 0) - { - perror("gtest_lpi_plugin_load get tcp or udp topic id failed\n"); - exit(-1); - } - - env->expect_json_topic_id = stellar_mq_create_topic(st, "EXPECT_JSON", stellar_msg_free_default, NULL); - printf("gtest_lpi_plugin_load OK!\n"); - - return env; -} - -extern "C" void gtest_lpi_plugin_unload(void *plugin_env) -{ - struct lpi_test_plugin_env *env = (struct lpi_test_plugin_env *)plugin_env; - for(int i = 0; i < MAX_APP_ID_VALUE; i++) - { - if(env->g_proto_id2name[i])free(env->g_proto_id2name[i]); - } - free(env); - printf("gtest_lpi_plugin_unload OK!\n"); - return ; -} diff --git a/test/lpi_plugin/test_config/spec.toml b/test/lpi_plugin/test_config/spec.toml deleted file mode 100644 index 386346f..0000000 --- a/test/lpi_plugin/test_config/spec.toml +++ /dev/null @@ -1,11 +0,0 @@ -# stellar_plugin.toml -# -[[plugin]] -path = "" -init = "lpi_plugin_load" -exit = "lpi_plugin_unload" - -[[plugin]] -path = "" -init = "gtest_lpi_plugin_load" -exit = "gtest_lpi_plugin_unload" diff --git a/test/lpi_plugin/CMakeLists.txt b/test/lpi_plus/CMakeLists.txt similarity index 83% rename from test/lpi_plugin/CMakeLists.txt rename to test/lpi_plus/CMakeLists.txt index 813451f..9f63273 100644 --- a/test/lpi_plugin/CMakeLists.txt +++ b/test/lpi_plus/CMakeLists.txt @@ -1,10 +1,10 @@ -add_executable(gtest_lpi gtest_lpi_main.cpp gtest_lpi_plugin.cpp) +add_executable(gtest_lpip gtest_lpip_main.cpp gtest_lpip_module.c) -target_include_directories(gtest_lpi PRIVATE ${CMAKE_SOURCE_DIR}/deps/) -target_include_directories(gtest_lpi PRIVATE ${CMAKE_SOURCE_DIR}/decoders/lpi) +target_include_directories(gtest_lpip PRIVATE ${CMAKE_SOURCE_DIR}/deps/) +target_include_directories(gtest_lpip PRIVATE ${CMAKE_SOURCE_DIR}/decoders/) target_link_libraries( - gtest_lpi PRIVATE stellar_lib cjson-static + gtest_lpip PRIVATE stellar_lib cjson-static lpi_plus dl "-rdynamic" gtest gmock ) @@ -12,7 +12,7 @@ target_link_libraries( #target_link_libraries(gtest_lpi PRIVATE -Wl,--whole-archive lpi -Wl,--no-whole-archive) set(TEST_NAME "LPI_TEST") -set(TEST_MAIN ${CMAKE_CURRENT_BINARY_DIR}/gtest_lpi) +set(TEST_MAIN ${CMAKE_CURRENT_BINARY_DIR}/gtest_lpip) add_test(NAME ${TEST_NAME}.SETUP COMMAND sh -c " mkdir -p ${CMAKE_CURRENT_BINARY_DIR}/conf && @@ -20,8 +20,7 @@ add_test(NAME ${TEST_NAME}.SETUP COMMAND sh -c " mkdir -p ${CMAKE_CURRENT_BINARY_DIR}/log && mkdir -p ${CMAKE_CURRENT_BINARY_DIR}/tsgconf && cp ${CMAKE_SOURCE_DIR}/conf/stellar.toml ${CMAKE_CURRENT_BINARY_DIR}/conf/ && - cp ${CMAKE_CURRENT_SOURCE_DIR}/test_config/spec.toml ${CMAKE_CURRENT_BINARY_DIR}/plugin/ && - cp ${CMAKE_SOURCE_DIR}/conf/log.toml ${CMAKE_CURRENT_BINARY_DIR}/conf/ && + cat ${CMAKE_CURRENT_SOURCE_DIR}/test_config/spec.toml >> ${CMAKE_CURRENT_BINARY_DIR}/conf/stellar.toml && cp ${CMAKE_CURRENT_SOURCE_DIR}/test_config/tsg_l7_protocol.conf ${CMAKE_CURRENT_BINARY_DIR}/tsgconf/ && tomlq -t -i '.packet_io.pcap_path=\"-\"' ${CMAKE_CURRENT_BINARY_DIR}/conf/stellar.toml && tomlq -t -i '.packet_io.mode=\"pcaplist\"' ${CMAKE_CURRENT_BINARY_DIR}/conf/stellar.toml @@ -55,4 +54,5 @@ set_tests_properties(${TEST_NAME}.APP ${TEST_NAME}.OPENVPN ${TEST_NAME}.PPP ${TEST_NAME}.SOCKS - PROPERTIES FIXTURES_REQUIRED ${TEST_NAME}.SETUP) \ No newline at end of file + PROPERTIES FIXTURES_REQUIRED ${TEST_NAME}.SETUP + ) diff --git a/test/lpi_plus/gtest_lpip.h b/test/lpi_plus/gtest_lpip.h new file mode 100644 index 0000000..9b13571 --- /dev/null +++ b/test/lpi_plus/gtest_lpip.h @@ -0,0 +1,16 @@ +#pragma once + +#ifdef __cplusplus +extern "C" +{ +#endif + +int stellar_test_result_setup(); + +char *stellar_test_result_json_export(); + +void stellar_test_result_cleanup(); + +#ifdef __cplusplus +} +#endif \ No newline at end of file diff --git a/test/lpi_plugin/gtest_lpi_main.cpp b/test/lpi_plus/gtest_lpip_main.cpp similarity index 70% rename from test/lpi_plugin/gtest_lpi_main.cpp rename to test/lpi_plus/gtest_lpip_main.cpp index d244fac..6745832 100644 --- a/test/lpi_plugin/gtest_lpi_main.cpp +++ b/test/lpi_plus/gtest_lpip_main.cpp @@ -14,10 +14,9 @@ #include #include "stellar/stellar.h" -#include "stellar/session.h" -#include "stellar/stellar_mq.h" #include "cJSON.h" +#include "gtest_lpip.h" struct gtest_json_result @@ -30,7 +29,11 @@ struct gtest_json_result static struct gtest_json_result *gtest_result_new(const char *expect_json_path) { struct gtest_json_result *para = (struct gtest_json_result *)calloc(1, sizeof(struct gtest_json_result)); - para->test_json_root = cJSON_CreateArray(); + if(expect_json_path==NULL) + { + para->expect_json_root=cJSON_CreateArray(); + return para; + } FILE *file = fopen(expect_json_path, "rb"); if(file) @@ -105,22 +108,6 @@ static void gtest_result_free(struct gtest_json_result *para) return; } -void gtest_on_session_msg_expect_json(struct session *sess, int topic_id, const void *msg, void *per_session_ctx, - void *plugin_env) -{ - struct gtest_json_result *g_test_para = (struct gtest_json_result *)plugin_env; - - cJSON *per_session_json = cJSON_Parse((const char *)msg); - - if (g_test_para->test_json_root) - { - char result_name[128] = ""; - sprintf(result_name, "APP_PROTO_IDENTIFY_RESULT_%d", g_test_para->result_count); - cJSON_AddStringToObject(per_session_json, "name", result_name); - cJSON_AddItemToArray(g_test_para->test_json_root, per_session_json); - } - g_test_para->result_count += 1; -} /********************************************** * GTEST MAIN * @@ -130,35 +117,33 @@ int main(int argc, char ** argv) { ::testing::InitGoogleTest(&argc, argv); - EXPECT_EQ(argc, 2); + //EXPECT_EQ(argc, 2); - if(argc != 2) - { - printf("Invalid Argument!!!\n Usage: ./[gtest_main] [/path/to/expect_json]\n"); - return -1; - } + printf("Usage: ./[gtest_main] [/path/to/expect_json]\n"); char *expect_json_path=argv[1]; struct gtest_json_result *g_test_para = gtest_result_new(expect_json_path); - struct stellar *st=stellar_new("./conf/stellar.toml", "./plugin/spec.toml", "./conf/log.toml"); + struct stellar *st=stellar_new("./conf/stellar.toml"); + + stellar_test_result_setup(); + EXPECT_TRUE(st!=NULL); - - int plugin_id=stellar_session_plugin_register(st, NULL, NULL, g_test_para); - EXPECT_TRUE(plugin_id>=0); - - int expect_json_topic_id = stellar_mq_get_topic_id(st, "EXPECT_JSON"); - EXPECT_TRUE(expect_json_topic_id>=0); - - stellar_session_mq_subscribe(st, expect_json_topic_id, gtest_on_session_msg_expect_json, plugin_id); - stellar_run(st); + stellar_free(st); + char *test_result_json=stellar_test_result_json_export(); + g_test_para->test_json_root=cJSON_Parse(test_result_json); + free(test_result_json); + + EXPECT_TRUE(g_test_para->expect_json_root != NULL && g_test_para->test_json_root != NULL); EXPECT_EQ(gtest_result_compare(g_test_para), 1); gtest_result_free(g_test_para); + stellar_test_result_cleanup(); + return ::testing::Test::HasFailure() ? 1 : 0; } \ No newline at end of file diff --git a/test/lpi_plus/gtest_lpip_module.c b/test/lpi_plus/gtest_lpip_module.c new file mode 100644 index 0000000..31aabe3 --- /dev/null +++ b/test/lpi_plus/gtest_lpip_module.c @@ -0,0 +1,182 @@ +#include +#pragma GCC diagnostic ignored "-Wunused-parameter" + +#include +#include +#include +#include + +#include "stellar/appid.h" +#include "stellar/module_manager.h" +#include "stellar/session_manager.h" +#include "stellar/session.h" +#include "stellar/utils.h" + +#include "cjson/cJSON.h" + +#include "lpi_plus/lpi_plus.h" +#include "appid/appid_internal.h" + +struct test_lpip_env +{ + struct stellar_module_manager *mod_mgr; + struct lpi_plus_mapper *lpi_mapper; + int l7_exdata_idx; + int session_num; +}; + +struct test_lpip_exdata +{ + int appid[MAX_APPID_NUM]; + size_t appid_num; + struct session *sess; +}; + +cJSON *g_result_json=NULL; + +void stellar_test_result_setup() +{ + if(g_result_json!=NULL)return; + g_result_json=cJSON_CreateArray(); +} + +char *stellar_test_result_json_export() +{ + if(g_result_json==NULL)return NULL; + return cJSON_Print(g_result_json); +} + +void stellar_test_result_cleanup() +{ + if(g_result_json)cJSON_Delete(g_result_json); +} + +static void gtest_lpip_exdata_free(int idx __attribute__((unused)), void *ex_ptr, void *arg) +{ + struct test_lpip_env *env = (struct test_lpip_env *)arg; + struct test_lpip_exdata *test_appid_exdata=(struct test_lpip_exdata *)ex_ptr; + + if(env==NULL || test_appid_exdata ==NULL)return; + + cJSON *ctx = cJSON_CreateObject(); + cJSON_AddStringToObject(ctx, "Tuple4", session_get0_readable_addr(test_appid_exdata->sess)); + enum session_type type = session_get_type(test_appid_exdata->sess); + if (type == SESSION_TYPE_TCP) + { + cJSON_AddStringToObject(ctx, "STREAM_TYPE", "TCP"); + } + if (type == SESSION_TYPE_UDP) + { + cJSON_AddStringToObject(ctx, "STREAM_TYPE", "UDP"); + } + if (test_appid_exdata->appid_num > 0) + { + const char *proto_names[MAX_APPID_NUM] = {}; + for (unsigned int i = 0; i < test_appid_exdata->appid_num; i++) + { + proto_names[i] = lpi_plus_appid2name(env->lpi_mapper ,test_appid_exdata->appid[i]); + } + cJSON *label_ids = cJSON_CreateIntArray(test_appid_exdata->appid, test_appid_exdata->appid_num); + cJSON_AddItemToObject(ctx, "l7_label_id", label_ids); + cJSON *label_names = cJSON_CreateStringArray(proto_names, test_appid_exdata->appid_num); + cJSON_AddItemToObject(ctx, "l7_label_name", label_names); + } + else + { + cJSON_AddStringToObject(ctx, "l7_label_id", "UNKNOWN"); + } + unsigned char dir_flag; + int is_symmetric = session_is_symmetric(test_appid_exdata->sess, &dir_flag); + if (is_symmetric) + { + cJSON_AddStringToObject(ctx, "STREAM_DIR", "DOUBLE"); + } + else if (dir_flag == SESSION_SEEN_C2S_FLOW) + { + cJSON_AddStringToObject(ctx, "STREAM_DIR", "C2S"); + } + else if (dir_flag == SESSION_SEEN_S2C_FLOW) + { + cJSON_AddStringToObject(ctx, "STREAM_DIR", "S2C"); + } + else + { + assert(0); + } + char result_name[128] = ""; + env->session_num++; + sprintf(result_name, "APP_PROTO_IDENTIFY_RESULT_%d", env->session_num); + cJSON_AddStringToObject(ctx, "name", result_name); + + if(g_result_json)cJSON_AddItemToArray(g_result_json, ctx); + free(test_appid_exdata); + return; +} + + +static void gtest_lpip_on_appid_msg(struct session *sess, enum APPID_ORIGIN origin, int appid[], size_t appid_num, void *args) +{ + if(sess==NULL || appid==NULL || args==NULL)return; + struct test_lpip_env *env = (struct test_lpip_env *)args; + struct test_lpip_exdata *test_appid_exdata=session_get_exdata(sess, env->l7_exdata_idx); + if(test_appid_exdata==NULL) + { + test_appid_exdata = CALLOC(struct test_lpip_exdata, 1); + test_appid_exdata->sess=sess; + + } + memcpy(test_appid_exdata->appid, appid, appid_num*sizeof(appid[0])); + test_appid_exdata->appid_num=appid_num; + session_set_exdata(sess, env->l7_exdata_idx, test_appid_exdata); + return; +} + +static void on_session(struct session *sess, struct packet *pkt, void *args) +{ + if(sess==NULL || pkt==NULL || args==NULL)return; + struct test_lpip_env *env = (struct test_lpip_env *)args; + if (session_get_current_state(sess) == SESSION_STATE_OPENING) + { + struct test_lpip_exdata *test_appid_exdata = session_get_exdata(sess, env->l7_exdata_idx); + if (test_appid_exdata == NULL) + { + test_appid_exdata = CALLOC(struct test_lpip_exdata, 1); + test_appid_exdata->sess=sess; + session_set_exdata(sess, env->l7_exdata_idx, test_appid_exdata); + } + } + return; +} + +struct stellar_module *gtest_lpip_module_init(struct stellar_module_manager *mod_mgr) +{ + struct test_lpip_env *env = (struct test_lpip_env *)calloc(1, sizeof(struct test_lpip_env)); + + env->lpi_mapper=stellar_module_get_lpip(mod_mgr); + struct session_manager *sess_mgr = stellar_module_get_session_manager(mod_mgr); + if(sess_mgr == NULL) + { + perror("gtest_lpi_plugin_load:stellar_module_get_session_manager failed !!!\n"); + exit(-1); + } + + session_manager_subscribe_udp(sess_mgr, on_session, env); + session_manager_subscribe_tcp(sess_mgr, on_session, env); + + env->l7_exdata_idx = session_manager_new_session_exdata_index(sess_mgr, "EXDATA_L7", gtest_lpip_exdata_free, env); + + stellar_appid_subscribe(mod_mgr, gtest_lpip_on_appid_msg, env); + printf("gtest_lpip_module_init OK!\n"); + + return stellar_module_new("TEST_LPIP", env); +} + +void gtest_lpip_module_exit(struct stellar_module_manager *mod_mgr, struct stellar_module *mod) +{ + assert(mod_mgr!=NULL); + struct test_lpip_env *env = (struct test_lpip_env *)stellar_module_get_ctx(mod); + free(env); + printf("gtest_lpip_module_exit OK!\n"); + stellar_module_free(mod); + return ; +} diff --git a/test/lpi_plus/test_config/spec.toml b/test/lpi_plus/test_config/spec.toml new file mode 100644 index 0000000..329f401 --- /dev/null +++ b/test/lpi_plus/test_config/spec.toml @@ -0,0 +1,11 @@ +# stellar_plugin.toml +# +[[module]] +path = "" +init = "lpi_plus_init" +exit = "lpi_plus_exit" + +[[module]] +path = "" +init = "gtest_lpip_module_init" +exit = "gtest_lpip_module_exit" diff --git a/test/lpi_plugin/test_config/tsg_l7_protocol.conf b/test/lpi_plus/test_config/tsg_l7_protocol.conf similarity index 55% rename from test/lpi_plugin/test_config/tsg_l7_protocol.conf rename to test/lpi_plus/test_config/tsg_l7_protocol.conf index 4e5f3ab..bfad125 100644 --- a/test/lpi_plugin/test_config/tsg_l7_protocol.conf +++ b/test/lpi_plus/test_config/tsg_l7_protocol.conf @@ -1,12 +1,15 @@ -#TYPE：1:UCHAR,2:USHORT,3:USTRING,4:ULOG,5:USTRING,6:FILE,7:UBASE64,8:PACKET -#TYPE FIELD VALUE +#TYPE LPI_NAME APPID APP_NAME STRING UNCATEGORIZED 8000 -#STRING UNCATEGORIZED 8001 -#STRING UNKNOWN_OTHER 8002 STRING DNS 32 +STRING DNS_TCP 32 DNS STRING FTP 45 +STRING FTP_Control 45 FTP +STRING FTP_Data 45 FTP STRING FTPS 751 STRING HTTP 67 +STRING HTTP_443 67 HTTP +STRING HTTP_Tunnel 67 HTTP +STRING HTTP_NonStandard 67 HTTP STRING HTTPS 68 STRING ICMP 70 STRING IKE 8003 @@ -14,6 +17,7 @@ STRING MAIL 8004 STRING IMAP 75 STRING IMAPS 76 STRING IPSEC 85 +STRING ESP_UDP 85 IPSEC STRING XMPP 94 STRING L2TP 98 STRING NTP 137 @@ -22,25 +26,36 @@ STRING POP3S 148 STRING PPTP 153 STRING QUIC 2521 STRING SIP 182 +STRING SIP_UDP 182 SIP STRING SMB 185 STRING SMTP 186 STRING SMTPS 187 STRING SPDY 1469 STRING SSH 198 STRING SSL 199 +STRING SSL/TLS 199 SSL STRING SOCKS 8005 +STRING SOCKS4 8005 SOCKS +STRING SOCKS5 8005 SOCKS STRING TELNET 209 +STRING Telnet 209 TELNET STRING DHCP 29 -STRING RADIUS 158 -STRING OPENVPN 336 +STRING Radius 158 RADIUS +STRING OpenVPN 336 OPENVPN +STRING OpenVPN_UDP 336 OPENVPN STRING STUN 201 +STRING STUN_TCP 201 STUN STRING TEREDO 555 +STRING Teredo 555 TEREDO STRING DTLS 1291 STRING DoH 8006 STRING ISAKMP 92 STRING MDNS 3835 -STRING NETBIOS 129 +STRING mDNS 3835 MDNS +STRING NetBIOS 129 NETBIOS +STRING NetBIOS_UDP 129 NETBIOS STRING NETFLOW 130 +STRING NetFlow 130 NETFLOW STRING RDP 159 STRING RTCP 174 STRING RTP 175 @@ -49,13 +64,17 @@ STRING SNMP 190 STRING SSDP 197 STRING TFTP 211 STRING BJNP 2481 +STRING Canon_BJNP 2481 BJNP STRING LDAP 100 +STRING LDAP_AD 100 LDAP STRING RTMP 337 STRING RTSP 176 STRING ESNI 8008 STRING Stratum 8169 STRING QQ 156 STRING WeChat 1296 -STRING WIREGUARD 3700 +STRING WeChat_UDP 1296 WeChat +STRING WireGuard 3700 WIREGUARD STRING MMS 115 STRING RSYNC 173 +STRING Rsync 173 RSYNC diff --git a/test/lpi_plugin/test_expect/app_pcap.json b/test/lpi_plus/test_expect/app_pcap.json similarity index 100% rename from test/lpi_plugin/test_expect/app_pcap.json rename to test/lpi_plus/test_expect/app_pcap.json diff --git a/test/lpi_plugin/test_expect/dns_pcap.json b/test/lpi_plus/test_expect/dns_pcap.json similarity index 100% rename from test/lpi_plugin/test_expect/dns_pcap.json rename to test/lpi_plus/test_expect/dns_pcap.json diff --git a/test/lpi_plugin/test_expect/empty_array.json b/test/lpi_plus/test_expect/empty_array.json similarity index 100% rename from test/lpi_plugin/test_expect/empty_array.json rename to test/lpi_plus/test_expect/empty_array.json diff --git a/test/lpi_plugin/test_expect/mixed_pcap.json b/test/lpi_plus/test_expect/mixed_pcap.json similarity index 100% rename from test/lpi_plugin/test_expect/mixed_pcap.json rename to test/lpi_plus/test_expect/mixed_pcap.json diff --git a/test/lpi_plugin/test_expect/openvpn_pcap.json b/test/lpi_plus/test_expect/openvpn_pcap.json similarity index 100% rename from test/lpi_plugin/test_expect/openvpn_pcap.json rename to test/lpi_plus/test_expect/openvpn_pcap.json diff --git a/test/lpi_plugin/test_expect/ppp_pcap.json b/test/lpi_plus/test_expect/ppp_pcap.json similarity index 100% rename from test/lpi_plugin/test_expect/ppp_pcap.json rename to test/lpi_plus/test_expect/ppp_pcap.json diff --git a/test/lpi_plugin/test_expect/socks_pcap.json b/test/lpi_plus/test_expect/socks_pcap.json similarity index 99% rename from test/lpi_plugin/test_expect/socks_pcap.json rename to test/lpi_plus/test_expect/socks_pcap.json index 5282661..9673199 100644 --- a/test/lpi_plugin/test_expect/socks_pcap.json +++ b/test/lpi_plus/test_expect/socks_pcap.json @@ -15,8 +15,8 @@ }, { "Tuple4": "10.0.0.1:1637-10.0.0.2:21477-6-0", "STREAM_TYPE": "TCP", - "l7_label_id": [8005, 67], - "l7_label_name": ["SOCKS", "HTTP"], + "l7_label_id": [8005], + "l7_label_name": ["SOCKS"], "STREAM_DIR": "DOUBLE", "name": "APP_PROTO_IDENTIFY_RESULT_3" }, { diff --git a/test/lpi_plugin/test_pcap/app_pcap/1-qq_59361.pcap b/test/lpi_plus/test_pcap/app_pcap/1-qq_59361.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/app_pcap/1-qq_59361.pcap rename to test/lpi_plus/test_pcap/app_pcap/1-qq_59361.pcap diff --git a/test/lpi_plugin/test_pcap/app_pcap/2-qq_8758.pcap b/test/lpi_plus/test_pcap/app_pcap/2-qq_8758.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/app_pcap/2-qq_8758.pcap rename to test/lpi_plus/test_pcap/app_pcap/2-qq_8758.pcap diff --git a/test/lpi_plugin/test_pcap/app_pcap/3-wechat_51876.pcap b/test/lpi_plus/test_pcap/app_pcap/3-wechat_51876.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/app_pcap/3-wechat_51876.pcap rename to test/lpi_plus/test_pcap/app_pcap/3-wechat_51876.pcap diff --git a/test/lpi_plugin/test_pcap/app_pcap/4-wechat_8080.pcap b/test/lpi_plus/test_pcap/app_pcap/4-wechat_8080.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/app_pcap/4-wechat_8080.pcap rename to test/lpi_plus/test_pcap/app_pcap/4-wechat_8080.pcap diff --git a/test/lpi_plugin/test_pcap/app_pcap/5-wireguard.pcap b/test/lpi_plus/test_pcap/app_pcap/5-wireguard.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/app_pcap/5-wireguard.pcap rename to test/lpi_plus/test_pcap/app_pcap/5-wireguard.pcap diff --git a/test/lpi_plugin/test_pcap/app_pcap/6-wireguard1.pcap b/test/lpi_plus/test_pcap/app_pcap/6-wireguard1.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/app_pcap/6-wireguard1.pcap rename to test/lpi_plus/test_pcap/app_pcap/6-wireguard1.pcap diff --git a/test/lpi_plugin/test_pcap/app_pcap/7-wireguard2.pcap b/test/lpi_plus/test_pcap/app_pcap/7-wireguard2.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/app_pcap/7-wireguard2.pcap rename to test/lpi_plus/test_pcap/app_pcap/7-wireguard2.pcap diff --git a/test/lpi_plugin/test_pcap/dns_pcap/1-dns-tcp-single-53-124.88.175.201-8.8.8.8.pcap b/test/lpi_plus/test_pcap/dns_pcap/1-dns-tcp-single-53-124.88.175.201-8.8.8.8.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/dns_pcap/1-dns-tcp-single-53-124.88.175.201-8.8.8.8.pcap rename to test/lpi_plus/test_pcap/dns_pcap/1-dns-tcp-single-53-124.88.175.201-8.8.8.8.pcap diff --git a/test/lpi_plugin/test_pcap/dns_pcap/2-dns-tcp-single-53-60.13.179.249-8.8.8.8.pcap b/test/lpi_plus/test_pcap/dns_pcap/2-dns-tcp-single-53-60.13.179.249-8.8.8.8.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/dns_pcap/2-dns-tcp-single-53-60.13.179.249-8.8.8.8.pcap rename to test/lpi_plus/test_pcap/dns_pcap/2-dns-tcp-single-53-60.13.179.249-8.8.8.8.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/01-http-not-ftp.pcap b/test/lpi_plus/test_pcap/mixed_pcap/01-http-not-ftp.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/01-http-not-ftp.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/01-http-not-ftp.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/02-stun-rtcp-rtp-22005-8000-39.144.206.199-117.156.19.31.pcap b/test/lpi_plus/test_pcap/mixed_pcap/02-stun-rtcp-rtp-22005-8000-39.144.206.199-117.156.19.31.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/02-stun-rtcp-rtp-22005-8000-39.144.206.199-117.156.19.31.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/02-stun-rtcp-rtp-22005-8000-39.144.206.199-117.156.19.31.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/03-ftp-37923-21121-117.145.115.74-218.31.124.234.pcap b/test/lpi_plus/test_pcap/mixed_pcap/03-ftp-37923-21121-117.145.115.74-218.31.124.234.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/03-ftp-37923-21121-117.145.115.74-218.31.124.234.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/03-ftp-37923-21121-117.145.115.74-218.31.124.234.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/04-mail_smtp_port_18867_25.pcap b/test/lpi_plus/test_pcap/mixed_pcap/04-mail_smtp_port_18867_25.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/04-mail_smtp_port_18867_25.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/04-mail_smtp_port_18867_25.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/05-ftp_port_21121-double.pcap b/test/lpi_plus/test_pcap/mixed_pcap/05-ftp_port_21121-double.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/05-ftp_port_21121-double.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/05-ftp_port_21121-double.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/06-ftp_port_21121-s2c.pcap b/test/lpi_plus/test_pcap/mixed_pcap/06-ftp_port_21121-s2c.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/06-ftp_port_21121-s2c.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/06-ftp_port_21121-s2c.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/07-ftp_port_21121-c2s.pcap b/test/lpi_plus/test_pcap/mixed_pcap/07-ftp_port_21121-c2s.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/07-ftp_port_21121-c2s.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/07-ftp_port_21121-c2s.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/08-gquic-023-85.117.117.169.47762-173.194.73.95.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/08-gquic-023-85.117.117.169.47762-173.194.73.95.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/08-gquic-023-85.117.117.169.47762-173.194.73.95.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/08-gquic-023-85.117.117.169.47762-173.194.73.95.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/09-gquic-025-85.117.113.98.4340-74.125.131.95.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/09-gquic-025-85.117.113.98.4340-74.125.131.95.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/09-gquic-025-85.117.113.98.4340-74.125.131.95.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/09-gquic-025-85.117.113.98.4340-74.125.131.95.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/10-gquic-033-90.143.189.5.8026-173.194.188.40.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/10-gquic-033-90.143.189.5.8026-173.194.188.40.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/10-gquic-033-90.143.189.5.8026-173.194.188.40.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/10-gquic-033-90.143.189.5.8026-173.194.188.40.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/11-gquic-034-85.117.125.8.21243-173.194.73.102.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/11-gquic-034-85.117.125.8.21243-173.194.73.102.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/11-gquic-034-85.117.125.8.21243-173.194.73.102.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/11-gquic-034-85.117.125.8.21243-173.194.73.102.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/12-gquic-035-redirector.googlevideo.com-85.117.122.194.32370-173.194.220.138.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/12-gquic-035-redirector.googlevideo.com-85.117.122.194.32370-173.194.220.138.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/12-gquic-035-redirector.googlevideo.com-85.117.122.194.32370-173.194.220.138.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/12-gquic-035-redirector.googlevideo.com-85.117.122.194.32370-173.194.220.138.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/13-gquic-037-10.32.121.249.33765-64.233.161.95.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/13-gquic-037-10.32.121.249.33765-64.233.161.95.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/13-gquic-037-10.32.121.249.33765-64.233.161.95.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/13-gquic-037-10.32.121.249.33765-64.233.161.95.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/14-gquic-039-redirector.googlevideo.com-85.117.119.45.22495-173.194.73.101.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/14-gquic-039-redirector.googlevideo.com-85.117.119.45.22495-173.194.73.101.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/14-gquic-039-redirector.googlevideo.com-85.117.119.45.22495-173.194.73.101.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/14-gquic-039-redirector.googlevideo.com-85.117.119.45.22495-173.194.73.101.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/15-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/15-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/15-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/15-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/16-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/16-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/16-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/16-gquic-041-90.143.180.56.28496-64.233.165.113.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/17-gquic-044-146.158.67.194.1044-108.177.14.138.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/17-gquic-044-146.158.67.194.1044-108.177.14.138.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/17-gquic-044-146.158.67.194.1044-108.177.14.138.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/17-gquic-044-146.158.67.194.1044-108.177.14.138.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/18-gquic-046-36.142.158.169.16385-36.189.11.71.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/18-gquic-046-36.142.158.169.16385-36.189.11.71.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/18-gquic-046-36.142.158.169.16385-36.189.11.71.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/18-gquic-046-36.142.158.169.16385-36.189.11.71.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/19-gquic-048-103.3.138.59.12521-123.125.116.52.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/19-gquic-048-103.3.138.59.12521-123.125.116.52.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/19-gquic-048-103.3.138.59.12521-123.125.116.52.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/19-gquic-048-103.3.138.59.12521-123.125.116.52.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/20-gquic-050-i.ytimg.com-172.20.9.135.65045-64.233.162.119.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/20-gquic-050-i.ytimg.com-172.20.9.135.65045-64.233.162.119.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/20-gquic-050-i.ytimg.com-172.20.9.135.65045-64.233.162.119.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/20-gquic-050-i.ytimg.com-172.20.9.135.65045-64.233.162.119.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/21-iquic-29-192.168.50.29.61891-31.13.77.35.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/21-iquic-29-192.168.50.29.61891-31.13.77.35.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/21-iquic-29-192.168.50.29.61891-31.13.77.35.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/21-iquic-29-192.168.50.29.61891-31.13.77.35.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/22-mvfst-01-i.instagram.com-192.168.60.9.55659-69.171.250.63.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/22-mvfst-01-i.instagram.com-192.168.60.9.55659-69.171.250.63.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/22-mvfst-01-i.instagram.com-192.168.60.9.55659-69.171.250.63.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/22-mvfst-01-i.instagram.com-192.168.60.9.55659-69.171.250.63.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/23-mvfst-02-192.168.137.141.50006-31.13.77.17.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/23-mvfst-02-192.168.137.141.50006-31.13.77.17.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/23-mvfst-02-192.168.137.141.50006-31.13.77.17.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/23-mvfst-02-192.168.137.141.50006-31.13.77.17.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/23-prox-quic-217.76.77.70.33232-173.194.220.105.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/23-prox-quic-217.76.77.70.33232-173.194.220.105.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/23-prox-quic-217.76.77.70.33232-173.194.220.105.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/23-prox-quic-217.76.77.70.33232-173.194.220.105.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/24-ietf-rfc9000-192.168.60.32.59699-64.233.164.84.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/24-ietf-rfc9000-192.168.60.32.59699-64.233.164.84.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/24-ietf-rfc9000-192.168.60.32.59699-64.233.164.84.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/24-ietf-rfc9000-192.168.60.32.59699-64.233.164.84.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/25-tquic-51-195.12.120.14.41803-173.194.222.101.443.pcap b/test/lpi_plus/test_pcap/mixed_pcap/25-tquic-51-195.12.120.14.41803-173.194.222.101.443.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/25-tquic-51-195.12.120.14.41803-173.194.222.101.443.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/25-tquic-51-195.12.120.14.41803-173.194.222.101.443.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/26-smtp-55426-587-10.130.2.104-67.225.241.247.pcap b/test/lpi_plus/test_pcap/mixed_pcap/26-smtp-55426-587-10.130.2.104-67.225.241.247.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/26-smtp-55426-587-10.130.2.104-67.225.241.247.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/26-smtp-55426-587-10.130.2.104-67.225.241.247.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/27-pop-54776-110-196.188.12.179-192.185.31.244.pcap b/test/lpi_plus/test_pcap/mixed_pcap/27-pop-54776-110-196.188.12.179-192.185.31.244.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/27-pop-54776-110-196.188.12.179-192.185.31.244.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/27-pop-54776-110-196.188.12.179-192.185.31.244.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/28-Bole-IGW-SMTP-57719-26-10.130.13.155-50.87.145.154-2.pcap b/test/lpi_plus/test_pcap/mixed_pcap/28-Bole-IGW-SMTP-57719-26-10.130.13.155-50.87.145.154-2.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/28-Bole-IGW-SMTP-57719-26-10.130.13.155-50.87.145.154-2.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/28-Bole-IGW-SMTP-57719-26-10.130.13.155-50.87.145.154-2.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/29-Bole-IGW-SMTP-14636-25-196.189.57.105-68.232.159.216-2.pcap b/test/lpi_plus/test_pcap/mixed_pcap/29-Bole-IGW-SMTP-14636-25-196.189.57.105-68.232.159.216-2.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/29-Bole-IGW-SMTP-14636-25-196.189.57.105-68.232.159.216-2.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/29-Bole-IGW-SMTP-14636-25-196.189.57.105-68.232.159.216-2.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/30-Bole-IGW-SMTP-20997-25-196.190.160.6-64.225.54.152.pcap b/test/lpi_plus/test_pcap/mixed_pcap/30-Bole-IGW-SMTP-20997-25-196.190.160.6-64.225.54.152.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/30-Bole-IGW-SMTP-20997-25-196.190.160.6-64.225.54.152.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/30-Bole-IGW-SMTP-20997-25-196.190.160.6-64.225.54.152.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/31-Bole-IGW-POP3-50020-110-196.188.3.8-82.98.178.159.pcap b/test/lpi_plus/test_pcap/mixed_pcap/31-Bole-IGW-POP3-50020-110-196.188.3.8-82.98.178.159.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/31-Bole-IGW-POP3-50020-110-196.188.3.8-82.98.178.159.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/31-Bole-IGW-POP3-50020-110-196.188.3.8-82.98.178.159.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/32-Bole-IGW-POP3-53357-110-196.189.0.15-39.156.6.106.pcap b/test/lpi_plus/test_pcap/mixed_pcap/32-Bole-IGW-POP3-53357-110-196.189.0.15-39.156.6.106.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/32-Bole-IGW-POP3-53357-110-196.189.0.15-39.156.6.106.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/32-Bole-IGW-POP3-53357-110-196.189.0.15-39.156.6.106.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/33-Bole-IGW-IMAP-36734-143-196.189.5.89-101.32.113.90.pcap b/test/lpi_plus/test_pcap/mixed_pcap/33-Bole-IGW-IMAP-36734-143-196.189.5.89-101.32.113.90.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/33-Bole-IGW-IMAP-36734-143-196.189.5.89-101.32.113.90.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/33-Bole-IGW-IMAP-36734-143-196.189.5.89-101.32.113.90.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/34-Bole-IGW-IMAP-50415-143-196.188.28.149-69.195.110.51.pcap b/test/lpi_plus/test_pcap/mixed_pcap/34-Bole-IGW-IMAP-50415-143-196.188.28.149-69.195.110.51.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/34-Bole-IGW-IMAP-50415-143-196.188.28.149-69.195.110.51.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/34-Bole-IGW-IMAP-50415-143-196.188.28.149-69.195.110.51.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/35-Bole-IGW-SMTP-587-1440-587-196.189.45.189-40.101.92.178.pcap b/test/lpi_plus/test_pcap/mixed_pcap/35-Bole-IGW-SMTP-587-1440-587-196.189.45.189-40.101.92.178.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/35-Bole-IGW-SMTP-587-1440-587-196.189.45.189-40.101.92.178.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/35-Bole-IGW-SMTP-587-1440-587-196.189.45.189-40.101.92.178.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/36-Bole-IGW-SMTP-587-37943-587-196.191.120.240-81.19.77.166.pcap b/test/lpi_plus/test_pcap/mixed_pcap/36-Bole-IGW-SMTP-587-37943-587-196.191.120.240-81.19.77.166.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/36-Bole-IGW-SMTP-587-37943-587-196.191.120.240-81.19.77.166.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/36-Bole-IGW-SMTP-587-37943-587-196.191.120.240-81.19.77.166.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/37-dns-response-4029-53-115.24.235.11-8.210.152.150.pcap b/test/lpi_plus/test_pcap/mixed_pcap/37-dns-response-4029-53-115.24.235.11-8.210.152.150.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/37-dns-response-4029-53-115.24.235.11-8.210.152.150.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/37-dns-response-4029-53-115.24.235.11-8.210.152.150.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/38-stun-dtls.pcap b/test/lpi_plus/test_pcap/mixed_pcap/38-stun-dtls.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/38-stun-dtls.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/38-stun-dtls.pcap diff --git a/test/lpi_plugin/test_pcap/mixed_pcap/39-pop3-mistake-redis.pcap b/test/lpi_plus/test_pcap/mixed_pcap/39-pop3-mistake-redis.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/mixed_pcap/39-pop3-mistake-redis.pcap rename to test/lpi_plus/test_pcap/mixed_pcap/39-pop3-mistake-redis.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/01-openvpn-udp-port-1198-first.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/01-openvpn-udp-port-1198-first.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/01-openvpn-udp-port-1198-first.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/01-openvpn-udp-port-1198-first.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/02-openvpn-nDPI.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/02-openvpn-nDPI.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/02-openvpn-nDPI.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/02-openvpn-nDPI.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/03-openvpn_onestream.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/03-openvpn_onestream.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/03-openvpn_onestream.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/03-openvpn_onestream.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/04-openvpn-udp-63111.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/04-openvpn-udp-63111.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/04-openvpn-udp-63111.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/04-openvpn-udp-63111.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/05-openvpn-udp-34400.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/05-openvpn-udp-34400.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/05-openvpn-udp-34400.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/05-openvpn-udp-34400.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/06-openvpn-udp-40914.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/06-openvpn-udp-40914.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/06-openvpn-udp-40914.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/06-openvpn-udp-40914.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/07-openvpn.tcp.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/07-openvpn.tcp.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/07-openvpn.tcp.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/07-openvpn.tcp.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/08-ovpntcp_hmac.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/08-ovpntcp_hmac.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/08-ovpntcp_hmac.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/08-ovpntcp_hmac.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/09-ovpntcp_nohmac.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/09-ovpntcp_nohmac.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/09-ovpntcp_nohmac.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/09-ovpntcp_nohmac.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/10-openvpn-udp-49941.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/10-openvpn-udp-49941.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/10-openvpn-udp-49941.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/10-openvpn-udp-49941.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/11-ipv6_openvpn.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/11-ipv6_openvpn.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/11-ipv6_openvpn.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/11-ipv6_openvpn.pcap diff --git a/test/lpi_plugin/test_pcap/openvpn_pcap/12-quic-openvpn.pcap b/test/lpi_plus/test_pcap/openvpn_pcap/12-quic-openvpn.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/openvpn_pcap/12-quic-openvpn.pcap rename to test/lpi_plus/test_pcap/openvpn_pcap/12-quic-openvpn.pcap diff --git a/test/lpi_plugin/test_pcap/ppp_pcap/01-l2tp_netbios.pcap b/test/lpi_plus/test_pcap/ppp_pcap/01-l2tp_netbios.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/ppp_pcap/01-l2tp_netbios.pcap rename to test/lpi_plus/test_pcap/ppp_pcap/01-l2tp_netbios.pcap diff --git a/test/lpi_plugin/test_pcap/ppp_pcap/02-l2tp-without-l7_protocol-62176-33445-192.168.10.91-220.43.148.189.pcap b/test/lpi_plus/test_pcap/ppp_pcap/02-l2tp-without-l7_protocol-62176-33445-192.168.10.91-220.43.148.189.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/ppp_pcap/02-l2tp-without-l7_protocol-62176-33445-192.168.10.91-220.43.148.189.pcap rename to test/lpi_plus/test_pcap/ppp_pcap/02-l2tp-without-l7_protocol-62176-33445-192.168.10.91-220.43.148.189.pcap diff --git a/test/lpi_plugin/test_pcap/ppp_pcap/03-l2tp_http.pcap b/test/lpi_plus/test_pcap/ppp_pcap/03-l2tp_http.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/ppp_pcap/03-l2tp_http.pcap rename to test/lpi_plus/test_pcap/ppp_pcap/03-l2tp_http.pcap diff --git a/test/lpi_plugin/test_pcap/ppp_pcap/04-l2tp_ctrl_data_full.pcap b/test/lpi_plus/test_pcap/ppp_pcap/04-l2tp_ctrl_data_full.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/ppp_pcap/04-l2tp_ctrl_data_full.pcap rename to test/lpi_plus/test_pcap/ppp_pcap/04-l2tp_ctrl_data_full.pcap diff --git a/test/lpi_plugin/test_pcap/ppp_pcap/05-pptp_encrypt.pcap b/test/lpi_plus/test_pcap/ppp_pcap/05-pptp_encrypt.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/ppp_pcap/05-pptp_encrypt.pcap rename to test/lpi_plus/test_pcap/ppp_pcap/05-pptp_encrypt.pcap diff --git a/test/lpi_plugin/test_pcap/ppp_pcap/06-pptp_http.pcap b/test/lpi_plus/test_pcap/ppp_pcap/06-pptp_http.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/ppp_pcap/06-pptp_http.pcap rename to test/lpi_plus/test_pcap/ppp_pcap/06-pptp_http.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/1-socks45-http-example.pcap b/test/lpi_plus/test_pcap/socks_pcap/1-socks45-http-example.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/1-socks45-http-example.pcap rename to test/lpi_plus/test_pcap/socks_pcap/1-socks45-http-example.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/10-socks5-http-302-frag.pcap b/test/lpi_plus/test_pcap/socks_pcap/10-socks5-http-302-frag.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/10-socks5-http-302-frag.pcap rename to test/lpi_plus/test_pcap/socks_pcap/10-socks5-http-302-frag.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/11-socks5-http-302.pcap b/test/lpi_plus/test_pcap/socks_pcap/11-socks5-http-302.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/11-socks5-http-302.pcap rename to test/lpi_plus/test_pcap/socks_pcap/11-socks5-http-302.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/12-socks5-rdp.pcap b/test/lpi_plus/test_pcap/socks_pcap/12-socks5-rdp.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/12-socks5-rdp.pcap rename to test/lpi_plus/test_pcap/socks_pcap/12-socks5-rdp.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/13-socks5-reverse.pcap b/test/lpi_plus/test_pcap/socks_pcap/13-socks5-reverse.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/13-socks5-reverse.pcap rename to test/lpi_plus/test_pcap/socks_pcap/13-socks5-reverse.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/14-socks5-smtp-503.pcap b/test/lpi_plus/test_pcap/socks_pcap/14-socks5-smtp-503.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/14-socks5-smtp-503.pcap rename to test/lpi_plus/test_pcap/socks_pcap/14-socks5-smtp-503.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/15-socks-http-pass.pcap b/test/lpi_plus/test_pcap/socks_pcap/15-socks-http-pass.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/15-socks-http-pass.pcap rename to test/lpi_plus/test_pcap/socks_pcap/15-socks-http-pass.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/16-socks-https-example.pcap b/test/lpi_plus/test_pcap/socks_pcap/16-socks-https-example.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/16-socks-https-example.pcap rename to test/lpi_plus/test_pcap/socks_pcap/16-socks-https-example.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/2-socks5_ftp.pcap b/test/lpi_plus/test_pcap/socks_pcap/2-socks5_ftp.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/2-socks5_ftp.pcap rename to test/lpi_plus/test_pcap/socks_pcap/2-socks5_ftp.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/3-POP3_Sock5_subject.pcap b/test/lpi_plus/test_pcap/socks_pcap/3-POP3_Sock5_subject.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/3-POP3_Sock5_subject.pcap rename to test/lpi_plus/test_pcap/socks_pcap/3-POP3_Sock5_subject.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/4-SMTP_Sock5_subject.pcap b/test/lpi_plus/test_pcap/socks_pcap/4-SMTP_Sock5_subject.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/4-SMTP_Sock5_subject.pcap rename to test/lpi_plus/test_pcap/socks_pcap/4-SMTP_Sock5_subject.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/5-T3-HTTP-URL-SOCKS5.pcap b/test/lpi_plus/test_pcap/socks_pcap/5-T3-HTTP-URL-SOCKS5.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/5-T3-HTTP-URL-SOCKS5.pcap rename to test/lpi_plus/test_pcap/socks_pcap/5-T3-HTTP-URL-SOCKS5.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/6-T7-HTTP-CONT-SOCKS5.pcap b/test/lpi_plus/test_pcap/socks_pcap/6-T7-HTTP-CONT-SOCKS5.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/6-T7-HTTP-CONT-SOCKS5.pcap rename to test/lpi_plus/test_pcap/socks_pcap/6-T7-HTTP-CONT-SOCKS5.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/7-T86-FTP-URL-PORT-BIN-SOCKS5.pcap b/test/lpi_plus/test_pcap/socks_pcap/7-T86-FTP-URL-PORT-BIN-SOCKS5.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/7-T86-FTP-URL-PORT-BIN-SOCKS5.pcap rename to test/lpi_plus/test_pcap/socks_pcap/7-T86-FTP-URL-PORT-BIN-SOCKS5.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/8-socks4_http.pcap b/test/lpi_plus/test_pcap/socks_pcap/8-socks4_http.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/8-socks4_http.pcap rename to test/lpi_plus/test_pcap/socks_pcap/8-socks4_http.pcap diff --git a/test/lpi_plugin/test_pcap/socks_pcap/9-socks4-https.pcap b/test/lpi_plus/test_pcap/socks_pcap/9-socks4-https.pcap similarity index 100% rename from test/lpi_plugin/test_pcap/socks_pcap/9-socks4-https.pcap rename to test/lpi_plus/test_pcap/socks_pcap/9-socks4-https.pcap diff --git a/test/session_debugger/session_debugger.c b/test/session_debugger/session_debugger.c index b54d739..80f5302 100644 --- a/test/session_debugger/session_debugger.c +++ b/test/session_debugger/session_debugger.c @@ -287,9 +287,8 @@ struct stellar_module *session_debugger_on_init(struct stellar_module_manager *m { assert(mod_mgr); - struct stellar_module *sess_mgr_mod = stellar_module_manager_get_module(mod_mgr, SESSION_MANAGER_MODULE_NAME); - assert(sess_mgr_mod); - struct session_manager *sess_mgr = stellar_module_get_ctx(sess_mgr_mod); + + struct session_manager *sess_mgr = stellar_module_get_session_manager(mod_mgr); assert(sess_mgr); struct logger *logger = stellar_module_manager_get_logger(mod_mgr); assert(logger);