Implemented STUN peer_address, relayed_address, response_origin, other_address parsing

Added code to ignore invalid STUN realm
Extended JSON output with STUN information

1 files changed, 39 insertions, 0 deletions

diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
index b36007b98..7795f59d5 100644
--- a/src/lib/ndpi_utils.c
+++ b/src/lib/ndpi_utils.c
@@ -1242,6 +1242,24 @@ static void ndpi_tls2json(ndpi_serializer *serializer, struct ndpi_flow_struct *
   }
 }
 
+/* ********************************** */
+
+static char* print_ndpi_address_port(ndpi_address_port *ap, char *buf, u_int buf_len) {
+  char ipbuf[INET6_ADDRSTRLEN];
+  
+  if(ap->is_ipv6) {
+    inet_ntop(AF_INET6, &ap->address, ipbuf, sizeof(ipbuf));
+  } else {
+    inet_ntop(AF_INET, &ap->address, ipbuf, sizeof(ipbuf));
+  }
+  
+  snprintf(buf, buf_len, "%s:%u", ipbuf, ap->port);
+  
+  return(buf);
+}
+
+/* ********************************** */
+
 /* NOTE: serializer must have been already initialized */
 int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
 		  struct ndpi_flow_struct *flow,
@@ -1499,6 +1517,27 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
     ndpi_serialize_end_of_block(serializer);
     break;
 
+  case NDPI_PROTOCOL_STUN:
+    ndpi_serialize_start_of_block(serializer, "stun");
+
+    if(flow->stun.mapped_address.port)
+      ndpi_serialize_string_string(serializer,  "mapped_address", print_ndpi_address_port(&flow->stun.mapped_address, buf, sizeof(buf)));
+
+    if(flow->stun.peer_address.port)
+      ndpi_serialize_string_string(serializer,  "peer_address", print_ndpi_address_port(&flow->stun.peer_address, buf, sizeof(buf)));
+
+    if(flow->stun.relayed_address.port)
+      ndpi_serialize_string_string(serializer,  "relayed_address", print_ndpi_address_port(&flow->stun.relayed_address, buf, sizeof(buf)));
+
+    if(flow->stun.response_origin.port)
+      ndpi_serialize_string_string(serializer,  "response_origin", print_ndpi_address_port(&flow->stun.response_origin, buf, sizeof(buf)));
+
+    if(flow->stun.other_address.port)
+      ndpi_serialize_string_string(serializer,  "other_address", print_ndpi_address_port(&flow->stun.other_address, buf, sizeof(buf)));
+
+    ndpi_serialize_end_of_block(serializer);
+    break;
+
   case NDPI_PROTOCOL_TLS:
   case NDPI_PROTOCOL_DTLS:
     ndpi_tls2json(serializer, flow);