diff options
| -rw-r--r-- | src/lib/ndpi_content_match.c.inc | 7 | ||||
| -rw-r--r-- | src/lib/protocols/stun.c | 8 | ||||
| -rw-r--r-- | tests/cfgs/default/pcap/signal_multiparty.pcapng | bin | 0 -> 11096 bytes | |||
| -rw-r--r-- | tests/cfgs/default/result/signal_multiparty.pcapng.out | 27 |
4 files changed, 41 insertions, 1 deletions
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 39b063adc..8f76f3291 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -1067,7 +1067,12 @@ static ndpi_protocol_match host_match[] = { "ubuntu.com", "UbuntuONE", NDPI_PROTOCOL_UBUNTUONE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "signal.org", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, - { "whispersystems.org", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "whispersystems.org", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "signal.art", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "signal.group", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "signal.link", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "signal.me", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "signal.tube", "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "musical.ly", "TikTok", NDPI_PROTOCOL_TIKTOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "byteoversea.com", "TikTok", NDPI_PROTOCOL_TIKTOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index 3747d76d0..0ead2a0ea 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -485,6 +485,14 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct, break; } + /* See https://support.signal.org/hc/en-us/articles/360007320291-Firewall-and-Internet-settings. + Since the check is quite weak, give time to other applications to kick in */ + if(flow->packet_counter > 4 && !flow->stun.is_turn && + !is_subclassification_real(flow) && + (ntohs(flow->c_port) == 10000 || ntohs(flow->s_port) == 10000)) { + *app_proto = NDPI_PROTOCOL_SIGNAL_VOIP; + } + off = STUN_HDR_LEN; while(off + 4 < payload_length) { u_int16_t attribute = ntohs(*((u_int16_t *)&payload[off])); diff --git a/tests/cfgs/default/pcap/signal_multiparty.pcapng b/tests/cfgs/default/pcap/signal_multiparty.pcapng Binary files differnew file mode 100644 index 000000000..d88a678f8 --- /dev/null +++ b/tests/cfgs/default/pcap/signal_multiparty.pcapng diff --git a/tests/cfgs/default/result/signal_multiparty.pcapng.out b/tests/cfgs/default/result/signal_multiparty.pcapng.out new file mode 100644 index 000000000..fbbfa87c9 --- /dev/null +++ b/tests/cfgs/default/result/signal_multiparty.pcapng.out @@ -0,0 +1,27 @@ +DPI Packets (UDP): 7 (7.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 7 (7.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache stun: 4/8/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache fpc_dns: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 2/0 (search/found) +Patricia risk mask IPv6: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia risk IPv6: 0/0 (search/found) +Patricia protocols: 1/1 (search/found) +Patricia protocols IPv6: 0/0 (search/found) + +SignalVoip 30 9753 1 + +Acceptable 30 9753 1 + + 1 UDP 192.168.12.67:38303 <-> 35.207.138.135:10000 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Encrypted][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][24 pkts/9059 bytes <-> 6 pkts/694 bytes][Goodput ratio: 89/64][0.46 sec][bytes ratio: 0.858 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 21/23 213/46 46/22][Pkt Len c2s/s2c min/avg/max/stddev: 87/81 377/116 1036/142 286/27][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BCipr/LEZ)][Plen Bins: 0,23,10,20,0,0,3,3,0,3,0,0,0,0,26,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] |