1 files changed, 27 insertions, 11 deletions

diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c
index 698fff052..35dcb0161 100644
--- a/src/lib/protocols/skype.c
+++ b/src/lib/protocols/skype.c
@@ -23,14 +23,22 @@
 
 #include "ndpi_api.h"
 
+static void ndpi_skype_report_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
+  //printf("-> payload_len=%u\n", flow->packet.payload_packet_len);
+  
+  NDPI_LOG_INFO(ndpi_struct, "found skype\n");
+  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_CALL, NDPI_PROTOCOL_SKYPE);
+}
 
-static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+static int is_port(u_int16_t a, u_int16_t b, u_int16_t c) {
+  return(((a == c) || (b == c)) ? 1 : 0);
+}
+
+static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
   // const u_int8_t *packet_payload = packet->payload;
   u_int32_t payload_len = packet->payload_packet_len;
 
-
   if(flow->host_server_name[0] != '\0')
     return;
 
@@ -39,25 +47,33 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
     flow->l4.udp.skype_packet_id++;
 
     if(flow->l4.udp.skype_packet_id < 5) {
+      u_int16_t sport = ntohs(packet->udp->source);
       u_int16_t dport = ntohs(packet->udp->dest);
 
       /* skype-to-skype */
-      if(dport != 1119) /* It can be confused with battle.net */ {
+      if(is_port(sport, dport, 1119) /* It can be confused with battle.net */
+	 || is_port(sport, dport, 80) /* No HTTP-like protocols UDP/80 */
+	 ) {
+	;
+      } else {
 	if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d)) ||
 	   ((payload_len >= 16)
 	    && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */
 	    && (packet->payload[2] == 0x02))) {
-	  NDPI_LOG_INFO(ndpi_struct, "found skype\n");
-	  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+	  ndpi_skype_report_protocol(ndpi_struct, flow);
 	}
       }
-      return;
+      
+      // return;
     }
+    
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
     return;
-
     // TCP check
-  } else if(packet->tcp != NULL) {
+  } else if((packet->tcp != NULL)
+	    /* As the TCP skype heuristic is weak, we need to make sure no other protocols overlap */
+	    && (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN)
+	    && (flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN)) {
     flow->l4.tcp.skype_packet_id++;
 
     if(flow->l4.tcp.skype_packet_id < 3) {
@@ -71,9 +87,9 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s
       if((payload_len == 8) || (payload_len == 3) || (payload_len == 17)) {
 	// printf("[SKYPE] payload_len=%u\n", payload_len);
 	/* printf("[SKYPE] %u/%u\n", ntohs(packet->tcp->source), ntohs(packet->tcp->dest)); */
-
+	
 	NDPI_LOG_INFO(ndpi_struct, "found skype\n");
-	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN);
+	ndpi_skype_report_protocol(ndpi_struct, flow);
       } else {
 	// printf("NO [SKYPE] payload_len=%u\n", payload_len);
       }