Update `flow->flow_multimedia_types` to a bitmask (#2625)

In the same flow, we can have multiple multimedia types

8 files changed, 77 insertions, 39 deletions

diff --git a/src/include/ndpi_api.h b/src/include/ndpi_api.h
index 612f66662..f1f016be0 100644
--- a/src/include/ndpi_api.h
+++ b/src/include/ndpi_api.h
@@ -1133,6 +1133,7 @@ extern "C" {
                                  ndpi_protocol const * const l7_protocol);
   char* ndpi_ssl_version2str(char *buf, int buf_len,
                              u_int16_t version, u_int8_t *unknown_tls_version);
+  char *ndpi_multimedia_flowtype2str(char *buf, int buf_len, u_int8_t m_types);
   char *ndpi_quic_version2str(char *buf, int buf_len, u_int32_t version);
   int ndpi_netbios_name_interpret(u_char *in, u_int in_len, u_char *out, u_int out_len);
   void ndpi_patchIPv6Address(char *str);
diff --git a/src/include/ndpi_private.h b/src/include/ndpi_private.h
index cf557ae34..a8399f65a 100644
--- a/src/include/ndpi_private.h
+++ b/src/include/ndpi_private.h
@@ -691,7 +691,7 @@ const uint8_t *get_crypto_data(struct ndpi_detection_module_struct *ndpi_struct,
 int is_valid_rtp_payload_type(uint8_t type);
 int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct,
                    const u_int8_t *payload, u_int16_t payload_len, u_int16_t *seq);
-u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_type, u_int16_t sub_proto);
+u_int8_t rtp_get_stream_type(u_int8_t payloadType, u_int8_t *s_type, u_int16_t sub_proto);
 
 /* Bittorrent */
 u_int64_t make_bittorrent_host_key(struct ndpi_flow_struct *flow, int client, int offset);
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index afc25b30c..6d2373a76 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -72,10 +72,10 @@ typedef enum {
 } ndpi_log_level_t;
 
 typedef enum {
-  ndpi_multimedia_unknown_flow = 0,
-  ndpi_multimedia_audio_flow,
-  ndpi_multimedia_video_flow,
-  ndpi_multimedia_screen_sharing_flow,
+  ndpi_multimedia_unknown_flow          = 0x00,
+  ndpi_multimedia_audio_flow            = 0x01,
+  ndpi_multimedia_video_flow            = 0x02,
+  ndpi_multimedia_screen_sharing_flow   = 0x04,
 } ndpi_multimedia_flow_type;
 
 typedef enum {
@@ -1358,7 +1358,7 @@ struct ndpi_flow_struct {
     char *username, *password;
   } http;
 
-  ndpi_multimedia_flow_type flow_multimedia_type;
+  u_int8_t flow_multimedia_types;
 
   /*
      Put outside of the union to avoid issues in case the protocol
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index de20eb887..80a4c94c5 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -7728,13 +7728,13 @@ static int ndpi_reconcile_msteams_call_udp_port(struct ndpi_flow_struct *flow,
   */
 
   if((dport == 3478) || (dport == 3479) || ((sport >= 50000) && (sport <= 50019)))
-    flow->flow_multimedia_type = ndpi_multimedia_audio_flow;
+    flow->flow_multimedia_types |= ndpi_multimedia_audio_flow;
   else if((dport == 3480) || ((sport >= 50020) && (sport <= 50039)))
-    flow->flow_multimedia_type = ndpi_multimedia_video_flow;
+    flow->flow_multimedia_types |= ndpi_multimedia_video_flow;
   else if((dport == 3481) || ((sport >= 50040) && (sport <= 50059)))
-    flow->flow_multimedia_type = ndpi_multimedia_screen_sharing_flow;
+    flow->flow_multimedia_types |= ndpi_multimedia_screen_sharing_flow;
   else {
-    flow->flow_multimedia_type = ndpi_multimedia_unknown_flow;
+    flow->flow_multimedia_types = ndpi_multimedia_unknown_flow;
     return(0);
   }
 
diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
index 0bade89f5..bbe42bd21 100644
--- a/src/lib/ndpi_utils.c
+++ b/src/lib/ndpi_utils.c
@@ -831,6 +831,38 @@ const char* ndpi_get_flow_info(struct ndpi_flow_struct const * const flow,
 
 /* ********************************** */
 
+char *ndpi_multimedia_flowtype2str(char *buf, int buf_len, u_int8_t m_types)
+{
+  int rc, len = 0;
+
+  if(buf == NULL || buf_len <= 1)
+    return NULL;
+
+  buf[0] = '\0';
+
+  if(m_types == ndpi_multimedia_unknown_flow) {
+    rc = ndpi_snprintf(buf + len, buf_len - len, "Unknown", len > 0 ? ", " : "");
+    if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
+  }
+
+  if(m_types & ndpi_multimedia_audio_flow) {
+    rc = ndpi_snprintf(buf + len, buf_len - len, "%sAudio", len > 0 ? ", " : "");
+    if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
+  }
+  if(m_types & ndpi_multimedia_video_flow) {
+    rc = ndpi_snprintf(buf + len, buf_len - len, "%sVideo", len > 0 ? ", " : "");
+    if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
+  }
+  if(m_types & ndpi_multimedia_screen_sharing_flow) {
+    rc = ndpi_snprintf(buf + len, buf_len - len, "%sScreen Sharing", len > 0 ? ", " : "");
+    if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
+  }
+
+  return buf;
+}
+
+/* ********************************** */
+
 char* ndpi_ssl_version2str(char *buf, int buf_len,
                            u_int16_t version, u_int8_t *unknown_tls_version) {
   if(unknown_tls_version)
@@ -1260,6 +1292,7 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
   char buf[64];
   char const *host_server_name;
   char quic_version[16];
+  char content[64] = {0};
   u_int i;
 
   if(flow == NULL) return(-1);
@@ -1274,6 +1307,10 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
     ndpi_serialize_string_string(serializer, "domainame", ndpi_get_host_domain(ndpi_struct, host_server_name));
   }
 
+  if(flow->flow_multimedia_types != ndpi_multimedia_unknown_flow) {
+    ndpi_serialize_string_string(serializer, "stream_content", ndpi_multimedia_flowtype2str(content, sizeof(content), flow->flow_multimedia_types));
+  }
+
   switch(l7_protocol.proto.master_protocol ? l7_protocol.proto.master_protocol : l7_protocol.proto.app_protocol) {
   case NDPI_PROTOCOL_IP_ICMP:
     if(flow->entropy > 0.0f) {
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c
index db041f76b..5a27d887b 100644
--- a/src/lib/protocols/rtp.c
+++ b/src/lib/protocols/rtp.c
@@ -40,7 +40,7 @@ int is_valid_rtp_payload_type(uint8_t type)
   return 1;
 }
 
-u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_type, u_int16_t sub_proto)
+u_int8_t rtp_get_stream_type(u_int8_t payloadType, u_int8_t *s_type, u_int16_t sub_proto)
 {
   /* General, from IANA */
   switch(payloadType) {
@@ -61,7 +61,7 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
   case 16: /* DVI4 */
   case 17: /* DVI4 */
   case 18: /* G729 */
-    *s_type = ndpi_multimedia_audio_flow;
+    *s_type |= ndpi_multimedia_audio_flow;
     return(1);
 
   case 25: /* CelB */
@@ -70,7 +70,7 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
   case 31: /* H261 */
   case 32: /* MPV */
   case 34: /* H263 */
-    *s_type = ndpi_multimedia_video_flow;
+    *s_type |= ndpi_multimedia_video_flow;
     return(1);
   }
 
@@ -87,18 +87,18 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
     case 116: /* G.726 */
     case 117: /* G.722 */
     case 118: /* Comfort Noise Wideband */
-      *s_type = ndpi_multimedia_audio_flow;
+      *s_type |= ndpi_multimedia_audio_flow;
       return(1);
 
     case 34: /* H.263 [MS-H26XPF] */
     case 121: /* RT Video */
     case 122: /* H.264 [MS-H264PF] */
     case 123: /* H.264 FEC [MS-H264PF] */
-      *s_type = ndpi_multimedia_video_flow;
+      *s_type |= ndpi_multimedia_video_flow;
       return(1);
 
     default:
-      *s_type = ndpi_multimedia_unknown_flow;
+      *s_type |= ndpi_multimedia_unknown_flow;
       return(0);
     }
   }
@@ -114,16 +114,16 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
   if(sub_proto == NDPI_PROTOCOL_GOOGLE_CALL) {
     switch(payloadType) {
     case 111:
-      *s_type = ndpi_multimedia_audio_flow;
+      *s_type |= ndpi_multimedia_audio_flow;
       return(1);
 
     case 96:
     case 100:
-      *s_type = ndpi_multimedia_video_flow;
+      *s_type |= ndpi_multimedia_video_flow;
       return(1);
 
     default:
-      *s_type = ndpi_multimedia_unknown_flow;
+      *s_type |= ndpi_multimedia_unknown_flow;
       return(0);
     }
   }
@@ -131,16 +131,16 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
   if(sub_proto == NDPI_PROTOCOL_WHATSAPP_CALL) {
     switch(payloadType) {
     case 120:
-      *s_type = ndpi_multimedia_audio_flow;
+      *s_type |= ndpi_multimedia_audio_flow;
       return(1);
 
     case 97:
     case 102:
-      *s_type = ndpi_multimedia_video_flow;
+      *s_type |= ndpi_multimedia_video_flow;
       return(1);
 
     default:
-      *s_type = ndpi_multimedia_unknown_flow;
+      *s_type |= ndpi_multimedia_unknown_flow;
       return(0);
     }
   }
@@ -151,15 +151,15 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
     case 97:
     case 101:
     case 109:
-      *s_type = ndpi_multimedia_audio_flow;
+      *s_type |= ndpi_multimedia_audio_flow;
       return(1);
 
     case 127:
-      *s_type = ndpi_multimedia_video_flow;
+      *s_type |= ndpi_multimedia_video_flow;
       return(1);
 
     default:
-      *s_type = ndpi_multimedia_unknown_flow;
+      *s_type |= ndpi_multimedia_unknown_flow;
       return(0);
     }
   }
@@ -167,15 +167,15 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
   if(sub_proto == NDPI_PROTOCOL_TELEGRAM_VOIP) {
     switch(payloadType) {
     case 111:
-      *s_type = ndpi_multimedia_audio_flow;
+      *s_type |= ndpi_multimedia_audio_flow;
       return(1);
 
     case 106:
-      *s_type = ndpi_multimedia_video_flow;
+      *s_type |= ndpi_multimedia_video_flow;
       return(1);
 
     default:
-      *s_type = ndpi_multimedia_unknown_flow;
+      *s_type |= ndpi_multimedia_unknown_flow;
       return(0);
     }
   }
@@ -183,20 +183,20 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
   if(sub_proto == NDPI_PROTOCOL_SIGNAL_VOIP) {
     switch(payloadType) {
     case 102:
-      *s_type = ndpi_multimedia_audio_flow;
+      *s_type |= ndpi_multimedia_audio_flow;
       return(1);
 
     case 120:
-      *s_type = ndpi_multimedia_video_flow;
+      *s_type |= ndpi_multimedia_video_flow;
       return(1);
 
     default:
-      *s_type = ndpi_multimedia_unknown_flow;
+      *s_type |= ndpi_multimedia_unknown_flow;
       return(0);
     }
   }
 
-  *s_type = ndpi_multimedia_unknown_flow;
+  *s_type |= ndpi_multimedia_unknown_flow;
   return(0);
 }
 
@@ -324,7 +324,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
         NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
         NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
       } else {
-        rtp_get_stream_type(payload[1] & 0x7F, &flow->flow_multimedia_type, NDPI_PROTOCOL_UNKNOWN);
+        rtp_get_stream_type(payload[1] & 0x7F, &flow->flow_multimedia_types, NDPI_PROTOCOL_UNKNOWN);
 
         NDPI_LOG_INFO(ndpi_struct, "Found RTP\n");
         ndpi_int_rtp_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_RTP);
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 9a5b122a2..3b80a4767 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -877,7 +877,7 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct,
       NDPI_LOG_DBG(ndpi_struct, "RTP (dir %d)\n", packet->packet_direction);
       NDPI_LOG_INFO(ndpi_struct, "Found RTP over STUN\n");
 
-      rtp_get_stream_type(packet->payload[1] & 0x7F, &flow->flow_multimedia_type, flow->detected_protocol_stack[0]);
+      rtp_get_stream_type(packet->payload[1] & 0x7F, &flow->flow_multimedia_types, flow->detected_protocol_stack[0]);
 
       if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_RTP &&
          flow->detected_protocol_stack[0] != NDPI_PROTOCOL_RTCP &&
diff --git a/src/lib/protocols/zoom.c b/src/lib/protocols/zoom.c
index 5b65dab69..a115fe37b 100644
--- a/src/lib/protocols/zoom.c
+++ b/src/lib/protocols/zoom.c
@@ -53,7 +53,7 @@ static void ndpi_int_zoom_add_connection(struct ndpi_detection_module_struct *nd
 					 struct ndpi_flow_struct *flow) {
   u_int16_t master;
 
-  if(flow->flow_multimedia_type != ndpi_multimedia_unknown_flow)
+  if(flow->flow_multimedia_types != ndpi_multimedia_unknown_flow)
     master = NDPI_PROTOCOL_SRTP;
   else
     master = NDPI_PROTOCOL_UNKNOWN;
@@ -91,7 +91,7 @@ static int is_zme(struct ndpi_detection_module_struct *ndpi_struct,
     case 13: /* Screen Share: RTP is not always there, expecially at the beginning of the flow */
       if(payload_len > 27) {
          if(is_rtp_or_rtcp(ndpi_struct, payload + 27, payload_len - 27, NULL) == IS_RTP) {
-           flow->flow_multimedia_type = ndpi_multimedia_screen_sharing_flow;
+           flow->flow_multimedia_types |= ndpi_multimedia_screen_sharing_flow;
          }
          return 1;
       }
@@ -100,7 +100,7 @@ static int is_zme(struct ndpi_detection_module_struct *ndpi_struct,
     case 30: /* P2P Screen Share: it seems RTP is always present */
       if(payload_len > 20 &&
          is_rtp_or_rtcp(ndpi_struct, payload + 20, payload_len - 20, NULL) == IS_RTP) {
-        flow->flow_multimedia_type = ndpi_multimedia_screen_sharing_flow;
+        flow->flow_multimedia_types |= ndpi_multimedia_screen_sharing_flow;
         return 1;
       }
       break;
@@ -108,7 +108,7 @@ static int is_zme(struct ndpi_detection_module_struct *ndpi_struct,
     case 15: /* RTP Audio */
       if(payload_len > 19 &&
          is_rtp_or_rtcp(ndpi_struct, payload + 19, payload_len - 19, NULL) == IS_RTP) {
-        flow->flow_multimedia_type = ndpi_multimedia_audio_flow;
+        flow->flow_multimedia_types |= ndpi_multimedia_audio_flow;
         return 1;
       }
       break;
@@ -116,7 +116,7 @@ static int is_zme(struct ndpi_detection_module_struct *ndpi_struct,
     case 16: /* RTP Video */
       if(payload_len > 24 &&
          is_rtp_or_rtcp(ndpi_struct, payload + 24, payload_len - 24, NULL) == IS_RTP) {
-        flow->flow_multimedia_type = ndpi_multimedia_video_flow;
+        flow->flow_multimedia_types |= ndpi_multimedia_video_flow;
         return 1;
       }
       break;