3 files changed, 25 insertions, 21 deletions

diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index cc1836a9b..cf7a4d0a4 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -202,9 +202,8 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	total_len = ntohs(*((u_int16_t*) &packet->payload[11])) + 13;
 
 	if(payload_length == total_len) {
-	  /* This is DTLS and the only protocol we know behaves like this is signal */
-	  flow->guessed_host_protocol_id = NDPI_PROTOCOL_SIGNAL;
-	  return(NDPI_IS_STUN);
+	  flow->guessed_host_protocol_id = NDPI_PROTOCOL_DTLS;
+	  return(NDPI_IS_NOT_STUN);
 	}
       }
     }
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 1e2027712..9933ca8b2 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -858,7 +858,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct,
 
   // handshake_type = packet->payload[13];
   handshake_len  = (packet->payload[14] << 16) + (packet->payload[15] << 8) + packet->payload[16];
-
+  
   if((handshake_len+25) != packet->payload_packet_len)
     goto no_dtls;
 
@@ -871,7 +871,7 @@ static int ndpi_search_tls_udp(struct ndpi_detection_module_struct *ndpi_struct,
   packet->payload = p;
   packet->payload_packet_len = p_len; /* Restore */
 
-  ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS);
+  ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_DTLS);
 
   return(1); /* Keep working */
 }
@@ -895,6 +895,9 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
   printf("[TLS] %s()\n", __FUNCTION__);
 #endif
 
+  if((flow->packet.udp != NULL) && (protocol == NDPI_PROTOCOL_TLS))
+    protocol = NDPI_PROTOCOL_DTLS;
+    
   if((flow->detected_protocol_stack[0] == protocol)
      || (flow->detected_protocol_stack[1] == protocol)) {
     if(!flow->check_extra_packets)
@@ -907,7 +910,7 @@ static void ndpi_int_tls_add_connection(struct ndpi_detection_module_struct *ndp
   else
     protocol = ndpi_tls_refine_master_protocol(ndpi_struct, flow, protocol);
 
-  ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_TLS);
+  ndpi_set_detected_protocol(ndpi_struct, flow, protocol, protocol);
   tlsInitExtraPacketProcessing(ndpi_struct, flow);
 }
 
@@ -1637,8 +1640,8 @@ void init_tls_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 
   /* *************************************************** */
 
-  ndpi_set_bitmask_protocol_detection("TLS", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_TLS,
+  ndpi_set_bitmask_protocol_detection("DTLS", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_DTLS,
 				      ndpi_search_tls_wrapper,
 				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
diff --git a/src/lib/protocols/upnp.c b/src/lib/protocols/wsd.c
index 1706d021d..8732675b1 100644
--- a/src/lib/protocols/upnp.c
+++ b/src/lib/protocols/wsd.c
@@ -1,7 +1,7 @@
 /*
- * upnp.c
+ * wsd.c
  *
- * Copyright (C) 2018 - ntop.org
+ * Copyright (C) 2018-21 - ntop.org
  *
  * nDPI is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Lesser General Public License as published by
@@ -18,19 +18,21 @@
  *
  */
 
+/* https://en.wikipedia.org/wiki/WS-Discovery */
+
 #include "ndpi_protocol_ids.h"
 
-#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_UPNP
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_WSD
 
 #include "ndpi_api.h"
 
-#define UPNP_PORT 3702
+#define WSD_PORT 3702
 
-void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct,
+void ndpi_search_wsd(struct ndpi_detection_module_struct *ndpi_struct,
 		      struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
 
-  NDPI_LOG_DBG(ndpi_struct, "search upnp\n");
+  NDPI_LOG_DBG(ndpi_struct, "search wsd\n");
 
   if(packet->udp
      && (
@@ -40,23 +42,23 @@ void ndpi_search_upnp(struct ndpi_detection_module_struct *ndpi_struct,
 	 (packet->iphv6 && ntohl(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]) == 0xFF020000)
 #endif
 	 )
-     && (ntohs(packet->udp->dest) == UPNP_PORT)
+     && (ntohs(packet->udp->dest) == WSD_PORT)
      && (packet->payload_packet_len >= 40)
      && (strncmp((char*)packet->payload, "<?xml", 5) == 0)
      ) {
     NDPI_LOG_INFO(ndpi_struct,"found teredo\n");
-    ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UPNP, NDPI_PROTOCOL_UNKNOWN);
+    ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WSD, NDPI_PROTOCOL_UNKNOWN);
   } else {
     NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
   }
 }
 
 
-void init_upnp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
-			 NDPI_PROTOCOL_BITMASK *detection_bitmask) {
-  ndpi_set_bitmask_protocol_detection("UPNP", ndpi_struct, detection_bitmask, *id,
-				      NDPI_PROTOCOL_UPNP,
-				      ndpi_search_upnp,
+void init_wsd_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id,
+			NDPI_PROTOCOL_BITMASK *detection_bitmask) {
+  ndpi_set_bitmask_protocol_detection("WSD", ndpi_struct, detection_bitmask, *id,
+				      NDPI_PROTOCOL_WSD,
+				      ndpi_search_wsd,
 				      NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD,
 				      SAVE_DETECTION_BITMASK_AS_UNKNOWN,
 				      ADD_TO_DETECTION_BITMASK);