diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2021-12-18 13:24:51 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-12-18 13:24:51 +0100 |
| commit | 7153b8933ca6a3df3f6de7d47cbb25e66a8970d4 (patch) | |
| tree | 1c85b93b96cb78648ec60628afe5a728a5a1d43b /src/lib/protocols/sip.c | |
| parent | 58b33dcb2d60faf3d0fa8f7a482752b4664c5344 (diff) | |
Improve/add several protocols (#1383)
Improve Microsoft, GMail, Likee, Whatsapp, DisneyPlus and Tiktok
detection.
Add Vimeo, Fuze, Alibaba and Firebase Crashlytics detection.
Try to differentiate between Messenger/Signal standard flows (i.e chat)
and their VOIP (video)calls (like we already do for Whatsapp and
Snapchat).
Add a partial list of some ADS/Tracking stuff.
Fix Cassandra, Radius and GTP false positives.
Fix DNS, Syslog and SIP false negatives.
Improve GTP (sub)classification: differentiate among GTP-U, GTP_C and
GTP_PRIME.
Fix 3 LGTM warnings.
Diffstat (limited to 'src/lib/protocols/sip.c')
| -rw-r--r-- | src/lib/protocols/sip.c | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/src/lib/protocols/sip.c b/src/lib/protocols/sip.c index 6c159afdd..bd9fb03d2 100644 --- a/src/lib/protocols/sip.c +++ b/src/lib/protocols/sip.c @@ -153,6 +153,20 @@ void ndpi_search_sip_handshake(struct ndpi_detection_module_struct ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } + + if((memcmp(packet_payload, "REFER ", 6) == 0 || memcmp(packet_payload, "refer ", 6) == 0) + && (memcmp(&packet_payload[6], "SIP:", 4) == 0 || memcmp(&packet_payload[6], "sip:", 4) == 0)) { + NDPI_LOG_INFO(ndpi_struct, "found sip REFER\n"); + ndpi_int_sip_add_connection(ndpi_struct, flow, 0); + return; + } + + if((memcmp(packet_payload, "PRACK ", 6) == 0 || memcmp(packet_payload, "prack ", 6) == 0) + && (memcmp(&packet_payload[6], "SIP:", 4) == 0 || memcmp(&packet_payload[6], "sip:", 4) == 0)) { + NDPI_LOG_INFO(ndpi_struct, "found sip REFER\n"); + ndpi_int_sip_add_connection(ndpi_struct, flow, 0); + return; + } } /* add bitmask for tcp only, some stupid udp programs |