aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--src/lib/ndpi_main.c13
-rw-r--r--src/lib/protocols/stun.c9
-rw-r--r--tests/cfgs/default/pcap/stun_msteams_unidir.pcapngbin0 -> 6472 bytes
-rw-r--r--tests/cfgs/default/result/stun_msteams_unidir.pcapng.out25
4 files changed, 40 insertions, 7 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 52d38ba79..ab5f7b6e8 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -6055,7 +6055,8 @@ static u_int32_t make_msteams_key(struct ndpi_flow_struct *flow, u_int8_t use_cl
/* ********************************************************************************* */
static void ndpi_reconcile_msteams_udp(struct ndpi_detection_module_struct *ndpi_str,
- struct ndpi_flow_struct *flow) {
+ struct ndpi_flow_struct *flow,
+ u_int16_t master) {
/* This function can NOT access &ndpi_str->packet since it is called also from ndpi_detection_giveup(), via ndpi_reconcile_protocols() */
@@ -6067,8 +6068,10 @@ static void ndpi_reconcile_msteams_udp(struct ndpi_detection_module_struct *ndpi
if(s_match || d_match) {
ndpi_int_change_protocol(ndpi_str, flow,
- NDPI_PROTOCOL_SKYPE_TEAMS, flow->detected_protocol_stack[1],
- NDPI_CONFIDENCE_DPI_PARTIAL);
+ NDPI_PROTOCOL_SKYPE_TEAMS, master,
+ /* Keep the same confidence */
+ flow->confidence);
+
if(ndpi_str->msteams_cache)
ndpi_lru_add_to_cache(ndpi_str->msteams_cache,
@@ -6136,7 +6139,7 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s
switch(ret->app_protocol) {
case NDPI_PROTOCOL_MICROSOFT_AZURE:
- ndpi_reconcile_msteams_udp(ndpi_str, flow);
+ ndpi_reconcile_msteams_udp(ndpi_str, flow, flow->detected_protocol_stack[1]);
break;
/*
@@ -6157,7 +6160,7 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s
case NDPI_PROTOCOL_STUN:
if(flow && (flow->guessed_protocol_id_by_ip == NDPI_PROTOCOL_MICROSOFT_AZURE))
- ndpi_reconcile_msteams_udp(ndpi_str, flow);
+ ndpi_reconcile_msteams_udp(ndpi_str, flow, NDPI_PROTOCOL_STUN);
break;
case NDPI_PROTOCOL_NETFLOW:
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index 3dab65770..81e90e94f 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -51,7 +51,8 @@ static int stun_monitoring(struct ndpi_detection_module_struct *ndpi_struct,
u_int8_t first_byte;
#ifdef DEBUG_MONITORING
- printf("[STUN-MON] Packet counter %d\n", flow->packet_counter);
+ printf("[STUN-MON] Packet counter %d protos %d/%d\n", flow->packet_counter,
+ flow->detected_protocol_stack[0], flow->detected_protocol_stack[1]);
#endif
if(packet->payload_packet_len == 0)
@@ -261,6 +262,10 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd
0 /* dummy */, ndpi_get_current_time(flow));
}
+
+#ifdef DEBUG_STUN
+ printf("[STUN] Setting %d\n", app_proto);
+#endif
ndpi_set_detected_protocol(ndpi_struct, flow, app_proto, NDPI_PROTOCOL_STUN, confidence);
if(ndpi_struct->monitoring_stun_pkts_to_process > 0 &&
@@ -268,7 +273,7 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd
* multiple msg in the same TCP segment
* same msg split across multiple segments */) {
if((ndpi_struct->monitoring_stun_flags & NDPI_MONITORING_STUN_SUBCLASSIFIED) ||
- app_proto == NDPI_PROTOCOL_UNKNOWN /* No-subclassification */) {
+ flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN /* No-subclassification */) {
flow->max_extra_packets_to_check = ndpi_struct->monitoring_stun_pkts_to_process;
flow->extra_packets_func = stun_monitoring;
}
diff --git a/tests/cfgs/default/pcap/stun_msteams_unidir.pcapng b/tests/cfgs/default/pcap/stun_msteams_unidir.pcapng
new file mode 100644
index 000000000..c1ea31f4e
--- /dev/null
+++ b/tests/cfgs/default/pcap/stun_msteams_unidir.pcapng
Binary files differ
diff --git a/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out b/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out
new file mode 100644
index 000000000..67ca9b748
--- /dev/null
+++ b/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out
@@ -0,0 +1,25 @@
+Guessed flow protos: 0
+
+DPI Packets (UDP): 7 (7.00 pkts/flow)
+Confidence DPI : 1 (flows)
+Num dissector calls: 190 (190.00 diss/flow)
+LRU cache ookla: 0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/3/0 (insert/search/found)
+LRU cache zoom: 0/0/0 (insert/search/found)
+LRU cache stun: 0/6/0 (insert/search/found)
+LRU cache tls_cert: 0/0/0 (insert/search/found)
+LRU cache mining: 0/0/0 (insert/search/found)
+LRU cache msteams: 1/0/0 (insert/search/found)
+LRU cache stun_zoom: 0/0/0 (insert/search/found)
+Automa host: 0/0 (search/found)
+Automa domain: 0/0 (search/found)
+Automa tls cert: 0/0 (search/found)
+Automa risk mask: 0/0 (search/found)
+Automa common alpns: 0/0 (search/found)
+Patricia risk mask: 2/0 (search/found)
+Patricia risk: 0/0 (search/found)
+Patricia protocols: 2/1 (search/found)
+
+Skype_Teams 12 5944 1
+
+ 1 UDP 52.115.136.55:3479 -> 10.0.0.1:50006 [proto: 78.125/STUN.Skype_Teams][IP: 276/Azure][ClearText][Confidence: DPI][DPI packets: 7][cat: VoIP/10][12 pkts/5944 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][4.53 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 453/0 1210/0 379/0][Pkt Len c2s/s2c min/avg/max/stddev: 81/0 495/0 1257/0 539/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][Plen Bins: 0,16,33,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0]
Powered by cgit, Themed by Ted Yin.