Improved RTP dissection with EVS and other mobile voice codecs

1 files changed, 125 insertions, 25 deletions

diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
index ffd2049d6..8e216bde6 100644
--- a/src/lib/protocols/rtp.c
+++ b/src/lib/protocols/rtp.c
@@ -32,6 +32,11 @@
 #define RTP_MIN_HEADER	12
 #define RTCP_MIN_HEADER	8
 
+static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
+			    struct ndpi_flow_struct *flow);
+
+/* *************************************************************** */
+
 /* https://www.iana.org/assignments/rtp-parameters/rtp-parameters.xhtml */
 int is_valid_rtp_payload_type(uint8_t type)
 {
@@ -40,6 +45,8 @@ int is_valid_rtp_payload_type(uint8_t type)
   return 1;
 }
 
+/* *************************************************************** */
+
 u_int8_t rtp_get_stream_type(u_int8_t payloadType, u_int8_t *s_type, u_int16_t sub_proto)
 {
   /* General, from IANA */
@@ -201,10 +208,14 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, u_int8_t *s_type, u_int16_t s
   return(0);
 }
 
+/* *************************************************************** */
+
 static int is_valid_rtcp_payload_type(uint8_t type) {
   return (type >= 192 && type <= 213);
 }
 
+/* *************************************************************** */
+
 int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct,
                    const u_int8_t *payload, u_int16_t payload_len, u_int16_t *seq)
 {
@@ -214,7 +225,7 @@ int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct,
 
   if(payload_len < 2)
     return NO_RTP_RTCP;
-  
+
   if((payload[0] & 0xC0) != 0x80) { /* Version 2 */
     NDPI_LOG_DBG(ndpi_struct, "Not version 2\n");
     return NO_RTP_RTCP;
@@ -239,8 +250,8 @@ int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct,
       return NO_RTP_RTCP;
     }
     /* Check on padding doesn't work because:
-       * we may have multiple RTP packets in the same TCP/UDP datagram
-       * with SRTP, padding_length field is encrypted */
+     * we may have multiple RTP packets in the same TCP/UDP datagram
+     * with SRTP, padding_length field is encrypted */
     if(seq)
       *seq = ntohs(*(unsigned short *)&payload[2]);
     return IS_RTP;
@@ -257,6 +268,17 @@ int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct,
   return NO_RTP_RTCP;
 }
 
+/* ************************************************************ */
+
+static int rtp_search_again(struct ndpi_detection_module_struct *ndpi_struct,
+			    struct ndpi_flow_struct *flow) {
+  /* printf("***** AGAIN *****\n"); */
+  ndpi_rtp_search(ndpi_struct, flow);
+
+  return(((flow->protos.rtp[0].payload_detected && flow->protos.rtp[1].payload_detected)) ? false :true);
+}
+
+/* *************************************************************** */
 
 static void ndpi_int_rtp_add_connection(struct ndpi_detection_module_struct *ndpi_struct,
                                         struct ndpi_flow_struct *flow,
@@ -272,6 +294,16 @@ static void ndpi_int_rtp_add_connection(struct ndpi_detection_module_struct *ndp
       NDPI_LOG_DBG(ndpi_struct, "Enabling (STUN) extra dissection\n");
       switch_extra_dissection_to_stun(ndpi_struct, flow, 1);
     }
+  } else if(proto == NDPI_PROTOCOL_RTP) {
+    if(flow->protos.rtp[0].payload_detected && flow->protos.rtp[1].payload_detected)
+      ; /* Nothing to do */
+    else {
+      if(!flow->extra_packets_func) {
+	NDPI_LOG_DBG(ndpi_struct, "Enabling extra dissection\n");
+	flow->max_extra_packets_to_check = ndpi_struct->cfg.rtp_max_packets_extra_dissection;
+	flow->extra_packets_func = rtp_search_again;
+      }
+    }
   }
 }
 
@@ -286,15 +318,15 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
   u_int16_t seq;
 
   if(packet->tcp != NULL) {
-      payload += 2; /* Skip the length field */
-      payload_len -= 2;
+    payload += 2; /* Skip the length field */
+    payload_len -= 2;
   }
   NDPI_LOG_DBG(ndpi_struct, "search RTP (stage %d/%d)\n", flow->rtp_stage, flow->rtcp_stage);
 
   /* * Let some "unknown" packets at the beginning:
-     * search for 3/4 consecutive RTP/RTCP packets.
-     * Wait a little longer (4 vs 3 pkts) for RTCP to try to tell if there are only
-     * RTCP packets in the flow or if RTP/RTCP are multiplexed together */
+   * search for 3/4 consecutive RTP/RTCP packets.
+   * Wait a little longer (4 vs 3 pkts) for RTCP to try to tell if there are only
+   * RTCP packets in the flow or if RTP/RTCP are multiplexed together */
 
   if(flow->packet_counter > 3 &&
      flow->rtp_stage == 0 &&
@@ -307,8 +339,75 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
   is_rtp = is_rtp_or_rtcp(ndpi_struct, payload, payload_len, &seq);
 
   if(is_rtp == IS_RTP) {
-    flow->protos.rtp.payload_type = payload[1] & 0x7F;
+    u_int8_t packet_direction = current_pkt_from_client_to_server(ndpi_struct, flow) ? 0 : 1;
     
+    if(flow->protos.rtp[packet_direction].payload_type == 0x0) {
+      flow->protos.rtp[packet_direction].payload_type = payload[1] & 0x7F;
+      flow->protos.rtp[packet_direction].payload_detected = true;
+      
+      /* printf("********* [direction: %d] payload_type=%u\n", packet_direction, flow->protos.rtp[packet_direction].payload_type);  */
+      
+      if(((flow->protos.rtp[packet_direction].payload_type == 126 /* Enhanced Voice Services (EVS) */)
+	  || (flow->protos.rtp[packet_direction].payload_type == 127 /* Enhanced Voice Services (EVS) */))
+	 && (payload_len > 12 /* RTP header */)) {
+	const u_int8_t *evs = &payload[12];
+	u_int packet_len = payload_len - 12;
+	u_int num_bits = packet_len * 8;
+
+	flow->flow_multimedia_types = ndpi_multimedia_audio_flow;
+	/* printf("********* %02X [bits %u]\n", evs[0], num_bits); */
+	  
+	if(num_bits == 56) {
+	  /* A.2.1.3 Special case for 56 bit payload size (EVS Primary or EVS AMR-WB IO SID) */
+
+	  if((evs[0] & 0x80) == 0)
+	    flow->protos.rtp[packet_direction].evs_subtype = evs[0] & 0xF;
+	  else
+	    flow->protos.rtp[packet_direction].evs_subtype = evs[1] & 0xF;
+	} else {
+
+	  /* See ndpi_rtp_payload_type2str() */
+	  switch(num_bits) {
+	  case    48:
+	  case   136:
+	  case   144:
+	  case   160:
+	  case   184:
+	  case   192:
+	  case   256:
+	  case   264:
+	  case   288:
+	  case   320:
+	  case   328:
+	  case   368:
+	  case   400:
+	  case   464:
+	  case   480:
+	  case   488:
+	  case   640:
+	  case   960:
+	  case  1280:
+	  case  1920:
+	  case  2560:
+	    flow->protos.rtp[packet_direction].evs_subtype = num_bits;
+	    break;
+
+	  default:
+	    if((evs[0] >> 7) == 1) {
+	      /* EVS Codec Mode Request (EVS-CMR) */
+	      u_int8_t d_bits = evs[0] & 0X0F;
+	      
+	      flow->protos.rtp[packet_direction].evs_subtype = d_bits + 30 /* dummy offset */;
+	    }
+	    break;
+	  }
+	}	
+
+	if(flow->protos.rtp[0].payload_detected && flow->protos.rtp[1].payload_detected)
+	  flow->extra_packets_func = NULL; /* Nothing to do */	 
+      }
+    }
+
     if(flow->rtp_stage == 2) {
       if(flow->l4_proto == IPPROTO_UDP &&
          flow->l4.udp.line_pkts[0] >= 2 && flow->l4.udp.line_pkts[1] >= 2) {
@@ -318,15 +417,16 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
       } else if(flow->rtp_seq_set[packet->packet_direction] &&
                 flow->rtp_seq[packet->packet_direction] == seq) {
         /* Simple heuristic to avoid false positives. tradeoff between:
-	   * consecutive RTP packets should have different sequence number
-	   * we should handle duplicated traffic */
+	 * consecutive RTP packets should have different sequence number
+	 * we should handle duplicated traffic */
         NDPI_LOG_DBG(ndpi_struct, "Same seq on consecutive pkts\n");
         flow->rtp_stage = 0;
         flow->rtcp_stage = 0;
         NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
         NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
       } else {
-        rtp_get_stream_type(flow->protos.rtp.payload_type, &flow->flow_multimedia_types, NDPI_PROTOCOL_UNKNOWN);
+        rtp_get_stream_type(flow->protos.rtp[packet->packet_direction].payload_type,
+			    &flow->flow_multimedia_types, NDPI_PROTOCOL_UNKNOWN);
 
         NDPI_LOG_INFO(ndpi_struct, "Found RTP\n");
         ndpi_int_rtp_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_RTP);
@@ -360,7 +460,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
         NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
         NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
       }
-    }      
+    }
   }
 }
 
@@ -374,11 +474,11 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
  *      ---------------------------------------------------------------
  */
 static void ndpi_search_rtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
-                struct ndpi_flow_struct *flow)
+				struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
   const u_int8_t *payload = packet->payload;
-  
+
   if(packet->payload_packet_len < 4){ /* (2) len field + (2) min rtp/rtcp*/
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
     NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
@@ -397,12 +497,12 @@ static void ndpi_search_rtp_tcp(struct ndpi_detection_module_struct *ndpi_struct
 
 /* *************************************************************** */
 static void ndpi_search_rtp_udp(struct ndpi_detection_module_struct *ndpi_struct,
-                struct ndpi_flow_struct *flow)
+				struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
   u_int16_t source = ntohs(packet->udp->source);
   u_int16_t dest = ntohs(packet->udp->dest);
-  /* 
+  /*
    * XXX: not sure if rtp/rtcp over tcp will also mix with Ethereum
    * for now, will not add it unitl we have a false positive.
    */
@@ -424,9 +524,9 @@ static void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, st
   struct ndpi_packet_struct *packet = &ndpi_struct->packet;
   if(packet->tcp != NULL) {
     ndpi_search_rtp_tcp(ndpi_struct, flow);
-   } else {
-      ndpi_search_rtp_udp(ndpi_struct, flow);
-   }
+  } else {
+    ndpi_search_rtp_udp(ndpi_struct, flow);
+  }
 }
 
 /* *************************************************************** */
@@ -434,11 +534,11 @@ static void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, st
 void init_rtp_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 			u_int32_t *id) {
   ndpi_set_bitmask_protocol_detection("RTP", ndpi_struct, *id,
-				                      NDPI_PROTOCOL_RTP,
-				                      ndpi_search_rtp,
-                                      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, 
-				                      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
-				                      ADD_TO_DETECTION_BITMASK);
+				      NDPI_PROTOCOL_RTP,
+				      ndpi_search_rtp,
+                                      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION,
+				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
+				      ADD_TO_DETECTION_BITMASK);
 
   *id += 1;
 }