STUN/RTP: improve metadata extraction (#2641)

2 files changed, 25 insertions, 4 deletions

diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index b7b0d525a..57a7d9993 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -1369,10 +1369,11 @@ struct ndpi_flow_struct {
   } kerberos_buf;
 
   struct {
-    u_int8_t maybe_dtls : 1, is_turn : 1, pad : 6;
+    u_int8_t maybe_dtls:1, rtcp_seen:1, is_turn : 1, is_client_controlling:1, pad : 4;
     ndpi_address_port mapped_address, peer_address, relayed_address, response_origin, other_address;
     u_int8_t num_xor_relayed_addresses, num_xor_mapped_addresses;
     u_int8_t num_non_stun_pkt, non_stun_pkt_len[2];
+    u_int16_t rtp_counters[2];
   } stun;
 
   struct {
@@ -1628,8 +1629,8 @@ struct ndpi_flow_struct {
 _Static_assert(sizeof(((struct ndpi_flow_struct *)0)->protos) <= 264,
                "Size of the struct member protocols increased to more than 264 bytes, "
                "please check if this change is necessary.");
-_Static_assert(sizeof(struct ndpi_flow_struct) <= 1224,
-               "Size of the flow struct increased to more than 1224 bytes, "
+_Static_assert(sizeof(struct ndpi_flow_struct) <= 1232,
+               "Size of the flow struct increased to more than 1232 bytes, "
                "please check if this change is necessary.");
 #endif
 #endif
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index f7c1ab512..ff4fe8805 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -597,6 +597,20 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct,
       *app_proto = NDPI_PROTOCOL_SKYPE_TEAMS_CALL;
       break;
 
+    case 0x8029: /* ICE-CONTROLLED */
+      if(current_pkt_from_client_to_server(ndpi_struct, flow))
+        flow->stun.is_client_controlling = 0;
+      else
+        flow->stun.is_client_controlling = 1;
+      break;
+
+    case 0x802A: /* ICE-CONTROLLING */
+      if(current_pkt_from_client_to_server(ndpi_struct, flow))
+        flow->stun.is_client_controlling = 1;
+      else
+        flow->stun.is_client_controlling = 0;
+      break;
+
     case 0xFF03:
       *app_proto = NDPI_PROTOCOL_GOOGLE_CALL;
       break;
@@ -928,7 +942,12 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct,
 
     rtp_rtcp = is_rtp_or_rtcp(ndpi_struct, packet->payload, packet->payload_packet_len, NULL);
     if(rtp_rtcp == IS_RTP) {
-      NDPI_LOG_DBG(ndpi_struct, "RTP (dir %d)\n", packet->packet_direction);
+
+      NDPI_LOG_DBG(ndpi_struct, "RTP (dir %d) [%d/%d]\n", packet->packet_direction,
+                                 flow->stun.rtp_counters[0], flow->stun.rtp_counters[1]);
+
+      flow->stun.rtp_counters[packet->packet_direction]++;
+
       NDPI_LOG_INFO(ndpi_struct, "Found RTP over STUN\n");
 
       rtp_get_stream_type(packet->payload[1] & 0x7F, &flow->flow_multimedia_types, flow->detected_protocol_stack[0]);
@@ -963,6 +982,7 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct,
       }
     } else if(rtp_rtcp == IS_RTCP) {
       NDPI_LOG_DBG(ndpi_struct, "RTCP\n");
+      flow->stun.rtcp_seen = 1;
     } else {
       NDPI_LOG_DBG(ndpi_struct, "Unexpected\n");
     }