diff options
| -rw-r--r-- | src/include/ndpi_typedefs.h | 1 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 25 | ||||
| -rw-r--r-- | src/lib/protocols/skype.c | 45 | ||||
| -rw-r--r-- | tests/pcap/skype_udp.pcap | bin | 0 -> 443 bytes | |||
| -rw-r--r-- | tests/result/skype_udp.pcap.out | 3 |
5 files changed, 63 insertions, 11 deletions
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 0c22a02fb..9cea5116c 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -775,6 +775,7 @@ struct ndpi_flow_udp_struct { /* NDPI_PROTOCOL_SKYPE */ u_int8_t skype_packet_id; + u_int8_t skype_crc[4]; /* NDPI_PROTOCOL_TEAMVIEWER */ u_int8_t teamviewer_stage; diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 65f1db852..ae5ed22f4 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -4607,17 +4607,15 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct if(flow->server_id == NULL) flow->server_id = dst; /* Default */ - if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { - if(flow->check_extra_packets) { - ndpi_process_extra_packet(ndpi_str, flow, packet, packetlen, current_time_ms, src, dst); - /* Update in case of new match */ - ret.master_protocol = flow->detected_protocol_stack[1], - ret.app_protocol = flow->detected_protocol_stack[0], - ret.category = flow->category; - goto invalidate_ptr; - } else - goto ret_protocols; - } + if(flow->check_extra_packets) { + ndpi_process_extra_packet(ndpi_str, flow, packet, packetlen, current_time_ms, src, dst); + /* Update in case of new match */ + ret.master_protocol = flow->detected_protocol_stack[1], + ret.app_protocol = flow->detected_protocol_stack[0], + ret.category = flow->category; + goto invalidate_ptr; + } else if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) + goto ret_protocols; /* need at least 20 bytes for ip header */ if(packetlen < 20) { @@ -6538,6 +6536,11 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp if(!flow->protos.telnet.password_detected) return(1); break; + + case NDPI_PROTOCOL_SKYPE: + if (flow->extra_packets_func) + return(1); + break; } return(0); diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c index 01d93bda7..22d94c021 100644 --- a/src/lib/protocols/skype.c +++ b/src/lib/protocols/skype.c @@ -27,6 +27,36 @@ static int is_port(u_int16_t a, u_int16_t b, u_int16_t c) { return(((a == c) || (b == c)) ? 1 : 0); } +static int ndpi_check_skype_udp_again(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { + struct ndpi_packet_struct *packet = &flow->packet; + u_int32_t payload_len = packet->payload_packet_len; + + const uint8_t id_flags_iv_crc_len = 11; + const uint8_t crc_len = sizeof(flow->l4.udp.skype_crc); + const uint8_t crc_offset = id_flags_iv_crc_len - crc_len; + + if ((payload_len >= id_flags_iv_crc_len) && (packet->payload[2] == 0x02 /* Payload flag */ )) { + u_int8_t detected = 1; + + /* Check if both packets have the same CRC */ + for (int i = 0; i < crc_len && detected; i++) { + if (packet->payload[crc_offset + i] != flow->l4.udp.skype_crc[i]) + detected = 0; + } + + if (detected) { + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN); + flow->extra_packets_func = NULL; + + /* Stop checking extra packets */ + return 0; + } + } + + /* Check more packets */ + return 1; +} + static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; @@ -73,6 +103,21 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_CALL, NDPI_PROTOCOL_SKYPE); } } + + if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { + const uint8_t id_flags_iv_crc_len = 11; + const uint8_t crc_len = sizeof(flow->l4.udp.skype_crc); + const uint8_t crc_offset = id_flags_iv_crc_len - crc_len; + if ((payload_len >= id_flags_iv_crc_len) && (packet->payload[2] == 0x02 /* Payload flag */ ) && !flow->extra_packets_func) { + flow->check_extra_packets = 1; + flow->max_extra_packets_to_check = 5; + flow->extra_packets_func = ndpi_check_skype_udp_again; + + memcpy(flow->l4.udp.skype_crc, &packet->payload[crc_offset], crc_len); + return; + } + } + } // return; diff --git a/tests/pcap/skype_udp.pcap b/tests/pcap/skype_udp.pcap Binary files differnew file mode 100644 index 000000000..4c8d76874 --- /dev/null +++ b/tests/pcap/skype_udp.pcap diff --git a/tests/result/skype_udp.pcap.out b/tests/result/skype_udp.pcap.out new file mode 100644 index 000000000..99569f10f --- /dev/null +++ b/tests/result/skype_udp.pcap.out @@ -0,0 +1,3 @@ +Skype 5 339 1 + + 1 UDP 192.168.1.2:35990 <-> 24.224.190.149:39262 [proto: 125/Skype][4 pkts/279 bytes <-> 1 pkts/60 bytes][Goodput ratio: 40/30][72.51 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |