1 files changed, 74 insertions, 43 deletions

diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index caebeb066..bb4780aab 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -18,13 +18,17 @@
  * GNU Lesser General Public License for more details.
  *
  * You should have received a copy of the GNU Lesser General Public License
- * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
  *
  */
-#include "ndpi_protocols.h"
+
+#include "ndpi_protocol_ids.h"
 
 #ifdef NDPI_PROTOCOL_STUN
 
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_STUN
+
+#include "ndpi_api.h"
 
 #define MAX_NUM_STUN_PKTS     10
 
@@ -49,11 +53,11 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 					   const u_int8_t * payload,
 					   const u_int16_t payload_length,
 					   u_int8_t *is_whatsapp,
-					   u_int8_t *is_lync) {
+					   u_int8_t *is_skype) {
   u_int16_t msg_type, msg_len;
   struct stun_packet_header *h = (struct stun_packet_header*)payload;
   u_int8_t can_this_be_whatsapp_voice = 1;
-	  
+
   if(payload_length < sizeof(struct stun_packet_header)) {
     if(flow->num_stun_udp_pkts > 0) {
       *is_whatsapp = 1;
@@ -64,7 +68,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 
   if((strncmp((const char*)payload, (const char*)"RSP/", 4) == 0)
      && (strncmp((const char*)&payload[7], (const char*)" STUN_", 6) == 0)) {
-    NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "Found stun.\n");
+    NDPI_LOG_INFO(ndpi_struct, "found stun\n");
     goto udp_stun_found;
   }
 
@@ -73,23 +77,27 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
   if((payload[0] != 0x80) && ((msg_len+20) > payload_length))
     return(NDPI_IS_NOT_STUN);
 
-  /* printf("msg_type=%04X, msg_len=%u\n", msg_type, msg_len); */
-
   if((payload_length == (msg_len+20))
      && ((msg_type <= 0x000b) /* http://www.3cx.com/blog/voip-howto/stun-details/ */)) {
     u_int offset = 20;
 
     /*
       This can either be the standard RTCP or Ms Lync RTCP that
-      later will becomg Ms Lync RTP. In this case we need to
+      later will become Ms Lync RTP. In this case we need to
       be careful before deciding about the protocol before dissecting the packet
+      
+      MS Lync = Skype
+      https://en.wikipedia.org/wiki/Skype_for_Business
     */
 
-    while(offset < payload_length) {
-
+    while((offset+2) < payload_length) {
       u_int16_t attribute = ntohs(*((u_int16_t*)&payload[offset]));
       u_int16_t len = ntohs(*((u_int16_t*)&payload[offset+2]));
+      u_int16_t x = (len + 4) % 4;
 
+      if(x != 0)
+	len += 4-x;
+      
       switch(attribute) {
       case 0x0008: /* Message Integrity */
       case 0x0020: /* XOR-MAPPED-ADDRESSES */
@@ -99,22 +107,25 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	      
       case 0x8054: /* Candidate Identifier */
 	if((len == 4)
-	   && (payload[offset+4] == 0x31)
+	   && ((offset+7) < payload_length)
 	   && (payload[offset+5] == 0x00)
 	   && (payload[offset+6] == 0x00)
 	   && (payload[offset+7] == 0x00)) {
-	  *is_lync = 1;
+	  /* Either skype for business or "normal" skype with multiparty call */
+	  *is_skype = 1;
 	  return(NDPI_IS_STUN);
 	}
 	break;
 
       case 0x8070: /* Implementation Version */
 	if((len == 4)
+	   && ((offset+7) < payload_length)
 	   && (payload[offset+4] == 0x00)
 	   && (payload[offset+5] == 0x00)
 	   && (payload[offset+6] == 0x00)
-	   && (payload[offset+7] == 0x02)) {
-	  *is_lync = 1;
+	   && ((payload[offset+7] == 0x02) || (payload[offset+7] == 0x03))
+	   ) {
+	  *is_skype = 1;
 	  return(NDPI_IS_STUN);
 	}
 	break;
@@ -124,6 +135,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	can_this_be_whatsapp_voice = 0;
 	break;
       }
+     
       offset += len + 4;
     }
     goto udp_stun_found;
@@ -153,10 +165,10 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
     u_int8_t mod;
     u_int8_t old = 1;
     u_int8_t padding = 0;
-    NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "len and type match.\n");
+    NDPI_LOG_DBG2(ndpi_struct, "len and type match\n");
 
     if(payload_length == 20) {
-      NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found stun.\n");
+      NDPI_LOG_INFO(ndpi_struct, "found stun\n");
       goto udp_stun_found;
     }
 
@@ -177,7 +189,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 		  || payload[a + 1] == 0x2a || payload[a + 1] == 0x29 || payload[a + 1] == 0x50
 		  || payload[a + 1] == 0x54 || payload[a + 1] == 0x55)))) {
 
-	NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "attribute match.\n");
+	NDPI_LOG_DBG2(ndpi_struct, "attribute match\n");
 
 	a += ((payload[a + 2] << 8) + payload[a + 3] + 4);
 	mod = a % 4;
@@ -185,7 +197,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	  padding = 4 - mod;
 	}
 	if(a == payload_length || (padding && (a + padding) == payload_length)) {
-	  NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found stun.\n");
+	  NDPI_LOG_INFO(ndpi_struct, "found stun\n");
 	  goto udp_stun_found;
 	}
 
@@ -209,7 +221,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	if((payload[a + padding] == 0x40) && (payload[a + padding + 1] == 0x00))
 	  goto udp_stun_found;
 
-	NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "New STUN - attribute match.\n");
+	NDPI_LOG_DBG2(ndpi_struct, "New STUN - attribute match\n");
 
 	old = 0;
 	a += ((payload[a + 2 + padding] << 8) + payload[a + 3 + padding] + 4);
@@ -219,7 +231,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	  a += 4 - mod;
 	}
 	if(a == payload_length) {
-	  NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found stun.\n");
+	  NDPI_LOG_INFO(ndpi_struct, "found stun\n");
 	  goto udp_stun_found;
 	}
       } else {
@@ -229,7 +241,6 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
   }
 #endif
 
-
   if((flow->num_stun_udp_pkts > 0) && (msg_type <= 0x00FF)) {
     *is_whatsapp = 1;
     return NDPI_IS_STUN; /* This is WhatsApp Voice */
@@ -237,63 +248,83 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
     return NDPI_IS_NOT_STUN;
 
  udp_stun_found:
-  if(can_this_be_whatsapp_voice)
+  if(can_this_be_whatsapp_voice) {
     flow->num_stun_udp_pkts++;
 
-  return((flow->num_stun_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN);
+    return((flow->num_stun_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN);
+  } else {
+    /*
+      We cannot immediately say that this is STUN as there are other protocols
+      like GoogleHangout that might be candidates, thus we set the
+      guessed protocol to STUN      
+    */
+    flow->guessed_protocol_id = NDPI_PROTOCOL_STUN;
+    return(NDPI_IS_NOT_STUN);
+  }  
 }
 
 void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
-  u_int8_t is_whatsapp = 0, is_lync = 0;
+  u_int8_t is_whatsapp = 0, is_skype = 0;
 
-  NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "search stun.\n");
+  NDPI_LOG_DBG(ndpi_struct, "search stun\n");
 
+  if(packet->payload == NULL) return;
+    
   if(packet->tcp) {
     /* STUN may be encapsulated in TCP packets */
-
-    if(packet->payload_packet_len >= 2 + 20 &&
-       ntohs(get_u_int16_t(packet->payload, 0)) + 2 == packet->payload_packet_len) {
-
+    if((packet->payload_packet_len >= 22)
+       && ((ntohs(get_u_int16_t(packet->payload, 0)) + 2) == packet->payload_packet_len)) {      
       /* TODO there could be several STUN packets in a single TCP packet so maybe the detection could be
        * improved by checking only the STUN packet of given length */
 
       if(ndpi_int_check_stun(ndpi_struct, flow, packet->payload + 2,
-			     packet->payload_packet_len - 2, &is_whatsapp, &is_lync) == NDPI_IS_STUN) {
-	NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found TCP stun.\n");
-	ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_STUN, flow);
+			     packet->payload_packet_len - 2, &is_whatsapp, &is_skype) == NDPI_IS_STUN) {
+	if(is_skype) {
+	  NDPI_LOG_INFO(ndpi_struct, "found Skype\n");
+	  ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_SKYPE, flow);
+	} else {
+	  NDPI_LOG_INFO(ndpi_struct, "found UDP stun\n"); /* Ummmmm we're in the TCP branch. This code looks bad */
+	  ndpi_int_stun_add_connection(ndpi_struct,
+				       is_whatsapp ? NDPI_PROTOCOL_WHATSAPP_VOICE : NDPI_PROTOCOL_STUN, flow);
+	}
+	
 	return;
       }
     }
   }
 
   if(ndpi_int_check_stun(ndpi_struct, flow, packet->payload,
-			 packet->payload_packet_len, &is_whatsapp, &is_lync) == NDPI_IS_STUN) {
-    if(is_lync) {
-      NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "Found MS Lync\n");
-      ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_MS_LYNC, flow);
+			 packet->payload_packet_len, &is_whatsapp, &is_skype) == NDPI_IS_STUN) {
+    if(is_skype) {
+      NDPI_LOG_INFO(ndpi_struct, "Found Skype\n");
+      ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_SKYPE, flow);
     } else {
-      NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found UDP stun.\n");
+      NDPI_LOG_INFO(ndpi_struct, "found UDP stun\n");
       ndpi_int_stun_add_connection(ndpi_struct,
 				   is_whatsapp ? NDPI_PROTOCOL_WHATSAPP_VOICE : NDPI_PROTOCOL_STUN, flow);
     }
+    
     return;
   }
 
-  if(flow->num_stun_udp_pkts >= MAX_NUM_STUN_PKTS) {
-    NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "exclude stun.\n");
-    NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STUN);
+  if(flow->num_stun_udp_pkts >= MAX_NUM_STUN_PKTS)
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);  
+
+  if(flow->packet_counter > 0) {
+    /* This might be a RTP stream: let's make sure we check it */
+    NDPI_CLR(&flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP);
   }
 }
 
 
-void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
+void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+			 NDPI_PROTOCOL_BITMASK *detection_bitmask) {
   ndpi_set_bitmask_protocol_detection("STUN", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_STUN,
 				      ndpi_search_stun,
-				      NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD,
+				      NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);