Improve skype detection (#1039)

* Add new skype pcap

PCAP extracted from SkypeIRC.cap (available in https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=SkypeIRC.cap)

* Improve skype detection

3 files changed, 60 insertions, 11 deletions

diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 0c22a02fb..9cea5116c 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -775,6 +775,7 @@ struct ndpi_flow_udp_struct {
 
   /* NDPI_PROTOCOL_SKYPE */
   u_int8_t skype_packet_id;
+  u_int8_t skype_crc[4];
 
   /* NDPI_PROTOCOL_TEAMVIEWER */
   u_int8_t teamviewer_stage;
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 65f1db852..ae5ed22f4 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -4607,17 +4607,15 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
   if(flow->server_id == NULL)
     flow->server_id = dst; /* Default */
 
-  if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
-    if(flow->check_extra_packets) {
-      ndpi_process_extra_packet(ndpi_str, flow, packet, packetlen, current_time_ms, src, dst);
-      /* Update in case of new match */
-      ret.master_protocol = flow->detected_protocol_stack[1],
-	ret.app_protocol = flow->detected_protocol_stack[0],
-	ret.category = flow->category;
-      goto invalidate_ptr;
-    } else
-      goto ret_protocols;
-  }
+  if(flow->check_extra_packets) {
+    ndpi_process_extra_packet(ndpi_str, flow, packet, packetlen, current_time_ms, src, dst);
+    /* Update in case of new match */
+    ret.master_protocol = flow->detected_protocol_stack[1],
+    ret.app_protocol = flow->detected_protocol_stack[0],
+    ret.category = flow->category;
+    goto invalidate_ptr;
+  } else if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN)
+    goto ret_protocols;
 
   /* need at least 20 bytes for ip header */
   if(packetlen < 20) {
@@ -6538,6 +6536,11 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
     if(!flow->protos.telnet.password_detected)
       return(1);
     break;
+
+  case NDPI_PROTOCOL_SKYPE:
+    if (flow->extra_packets_func)
+      return(1);
+    break;
   }
 
   return(0);
diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 01d93bda7..22d94c021 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -27,6 +27,36 @@ static int is_port(u_int16_t a, u_int16_t b, u_int16_t c) {
   return(((a == c) || (b == c)) ? 1 : 0);
 }
 
+static int ndpi_check_skype_udp_again(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+  struct ndpi_packet_struct *packet = &flow->packet;
+  u_int32_t payload_len = packet->payload_packet_len;
+
+  const uint8_t id_flags_iv_crc_len = 11;
+  const uint8_t crc_len = sizeof(flow->l4.udp.skype_crc);
+  const uint8_t crc_offset = id_flags_iv_crc_len - crc_len;
+
+  if ((payload_len >= id_flags_iv_crc_len) && (packet->payload[2] == 0x02 /* Payload flag */ )) {
+    u_int8_t detected = 1;
+
+    /* Check if both packets have the same CRC */
+    for (int i = 0; i < crc_len && detected; i++) {
+      if (packet->payload[crc_offset + i] != flow->l4.udp.skype_crc[i])
+        detected = 0;
+    }
+
+    if (detected) {
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+      flow->extra_packets_func = NULL;
+
+      /* Stop checking extra packets */
+      return 0;
+    }
+  }
+
+  /* Check more packets */
+  return 1;
+}
+
 static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
   // const u_int8_t *packet_payload = packet->payload;
@@ -73,6 +103,21 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
 	    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_CALL, NDPI_PROTOCOL_SKYPE);
 	  }
 	}
+
+        if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
+          const uint8_t id_flags_iv_crc_len = 11;
+          const uint8_t crc_len = sizeof(flow->l4.udp.skype_crc);
+          const uint8_t crc_offset = id_flags_iv_crc_len - crc_len;
+          if ((payload_len >= id_flags_iv_crc_len) && (packet->payload[2] == 0x02 /* Payload flag */ ) && !flow->extra_packets_func) {
+            flow->check_extra_packets = 1;
+            flow->max_extra_packets_to_check = 5;
+            flow->extra_packets_func = ndpi_check_skype_udp_again;
+
+            memcpy(flow->l4.udp.skype_crc, &packet->payload[crc_offset], crc_len);
+            return;
+          }
+        }
+
       }
       
       // return;