diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2023-07-03 17:21:32 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-07-03 17:21:32 +0200 |
| commit | dff1f251939935b43943dea00ef24ef85261b94a (patch) | |
| tree | c3aa083972d1c9182eb6d2e0b083e5325e3fa9a4 /src | |
| parent | 86e89b4e230371b2de92e3a3cda6fdea42fff614 (diff) | |
STUN: fix Skype/MsTeams detection and monitoring logic (#2028)
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/ndpi_main.c | 13 | ||||
| -rw-r--r-- | src/lib/protocols/stun.c | 9 |
2 files changed, 15 insertions, 7 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 52d38ba79..ab5f7b6e8 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -6055,7 +6055,8 @@ static u_int32_t make_msteams_key(struct ndpi_flow_struct *flow, u_int8_t use_cl /* ********************************************************************************* */ static void ndpi_reconcile_msteams_udp(struct ndpi_detection_module_struct *ndpi_str, - struct ndpi_flow_struct *flow) { + struct ndpi_flow_struct *flow, + u_int16_t master) { /* This function can NOT access &ndpi_str->packet since it is called also from ndpi_detection_giveup(), via ndpi_reconcile_protocols() */ @@ -6067,8 +6068,10 @@ static void ndpi_reconcile_msteams_udp(struct ndpi_detection_module_struct *ndpi if(s_match || d_match) { ndpi_int_change_protocol(ndpi_str, flow, - NDPI_PROTOCOL_SKYPE_TEAMS, flow->detected_protocol_stack[1], - NDPI_CONFIDENCE_DPI_PARTIAL); + NDPI_PROTOCOL_SKYPE_TEAMS, master, + /* Keep the same confidence */ + flow->confidence); + if(ndpi_str->msteams_cache) ndpi_lru_add_to_cache(ndpi_str->msteams_cache, @@ -6136,7 +6139,7 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s switch(ret->app_protocol) { case NDPI_PROTOCOL_MICROSOFT_AZURE: - ndpi_reconcile_msteams_udp(ndpi_str, flow); + ndpi_reconcile_msteams_udp(ndpi_str, flow, flow->detected_protocol_stack[1]); break; /* @@ -6157,7 +6160,7 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s case NDPI_PROTOCOL_STUN: if(flow && (flow->guessed_protocol_id_by_ip == NDPI_PROTOCOL_MICROSOFT_AZURE)) - ndpi_reconcile_msteams_udp(ndpi_str, flow); + ndpi_reconcile_msteams_udp(ndpi_str, flow, NDPI_PROTOCOL_STUN); break; case NDPI_PROTOCOL_NETFLOW: diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index 3dab65770..81e90e94f 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -51,7 +51,8 @@ static int stun_monitoring(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t first_byte; #ifdef DEBUG_MONITORING - printf("[STUN-MON] Packet counter %d\n", flow->packet_counter); + printf("[STUN-MON] Packet counter %d protos %d/%d\n", flow->packet_counter, + flow->detected_protocol_stack[0], flow->detected_protocol_stack[1]); #endif if(packet->payload_packet_len == 0) @@ -261,6 +262,10 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd 0 /* dummy */, ndpi_get_current_time(flow)); } + +#ifdef DEBUG_STUN + printf("[STUN] Setting %d\n", app_proto); +#endif ndpi_set_detected_protocol(ndpi_struct, flow, app_proto, NDPI_PROTOCOL_STUN, confidence); if(ndpi_struct->monitoring_stun_pkts_to_process > 0 && @@ -268,7 +273,7 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd * multiple msg in the same TCP segment * same msg split across multiple segments */) { if((ndpi_struct->monitoring_stun_flags & NDPI_MONITORING_STUN_SUBCLASSIFIED) || - app_proto == NDPI_PROTOCOL_UNKNOWN /* No-subclassification */) { + flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN /* No-subclassification */) { flow->max_extra_packets_to_check = ndpi_struct->monitoring_stun_pkts_to_process; flow->extra_packets_func = stun_monitoring; } |