1
# Yahoo messenger - an instant messenger protocol - http://yahoo.com
2
# Pattern quality: good veryfast
3
# Usually runs on port 5050
5
# This pattern has been tested and is believed to work well.
6
# Please post to l7-filter-developers@lists.sf.net as to whether it works
7
# for you or not. If you believe it could be improved please post your
8
# suggestions to that list as well. You may subscribe to this list at
9
# http://lists.sourceforge.net/lists/listinfo/l7-filter-developers
12
# http://www.venkydude.com/articles/yahoo.htm says:
13
# All Yahoo commands start with YMSG.
14
# (Well... http://ethereal.com/faq.html#q5.32 suggests that YPNS and YHOO
15
# are also possible, so let's allow those)
16
# The next 7 bytes contain command (packet?) length and version information
17
# which we won't currently try to match.
18
# L means "YAHOO_SERVICE_VERIFY" according to Ethereal
19
# W means "encryption challenge command" (YAHOO_SERVICE_AUTH)
20
# T means "login command" (YAHOO_SERVICE_AUTHRESP)
21
# (there are others, i.e. 0x01 "coming online", 0x02 "going offline",
22
# 0x04 "changing status to available", 0x06 "user message", but W and T
23
# should appear in the first few packets.)
24
# 0xC080 is the standard argument separator, it should appear not long
25
# after the "type of command" byte.
27
^(ymsg|ypns|yhoo).?.?.?.?.?.?.?[lwt].*\xc0\x80