diff options
Diffstat (limited to 'src/lib/protocols')
| -rw-r--r-- | src/lib/protocols/btlib.c | 10 | ||||
| -rw-r--r-- | src/lib/protocols/stun.c | 24 |
2 files changed, 26 insertions, 8 deletions
diff --git a/src/lib/protocols/btlib.c b/src/lib/protocols/btlib.c index ea06a6348..309a10717 100644 --- a/src/lib/protocols/btlib.c +++ b/src/lib/protocols/btlib.c @@ -64,7 +64,8 @@ static char *print20b(char *s,const u_int8_t *b) { } static char *print_id_ip_p(char *s, const struct bt_nodes_data *b) { - u_int8_t *p = (void*)b; + u_int8_t *p = (u_int8_t*)b; + print20b(s,b->id); snprintf(s+40,39," %d.%d.%d.%d:%u", p[20], p[21], p[22], p[23], htons(b->port)); @@ -72,14 +73,16 @@ static char *print_id_ip_p(char *s, const struct bt_nodes_data *b) { } static char *print_ip_p(char *s, const struct bt_ipv4p *b,int np) { - const u_int8_t *p = (const void*)b; + const u_int8_t *p = (const u_int8_t*)b; + snprintf(s,39,!np ? "%d.%d.%d.%d:%u":"%d.%d.%d.%d", p[0], p[1], p[2], p[3], htons(b->port)); return s; } static char *print_ip6_p(char *s, const struct bt_ipv6p *b,int np) { - u_int16_t *p = (void*)b; + u_int16_t *p = (u_int16_t*)b; + snprintf(s,79,!np ? "%x:%x:%x:%x:%x:%x:%x:%x.%u":"%x:%x:%x:%x:%x:%x:%x:%x", htons(p[0]), htons(p[1]), htons(p[2]), htons(p[3]), htons(p[4]), htons(p[5]), htons(p[6]), htons(p[7]), @@ -507,6 +510,7 @@ const u_int8_t *bt_decode(const u_int8_t *b, size_t *l, int *ret, bt_parse_data_ cbd->level--; return b; } + bad_data: *ret=-1; return b; diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index c169a47db..dc6a3cfd5 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -28,7 +28,7 @@ #include "ndpi_api.h" -#define MAX_NUM_STUN_PKTS 10 +#define MAX_NUM_STUN_PKTS 8 struct stun_packet_header { u_int16_t msg_type, msg_len; @@ -53,7 +53,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * u_int8_t *is_whatsapp) { u_int16_t msg_type, msg_len; struct stun_packet_header *h = (struct stun_packet_header*)payload; - u_int8_t can_this_be_whatsapp_voice = 1; + u_int8_t can_this_be_whatsapp_voice = 1, wa = 0; flow->protos.stun_ssl.stun.num_processed_pkts++; @@ -75,14 +75,26 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * if(ntohs(h->msg_type) == 0x01 /* Binding Request */) flow->protos.stun_ssl.stun.num_binding_requests++; + + // printf("[%02X][%02X][payload_length: %u]\n", payload[0], payload[1], payload_length); + if(((payload[0] == 0x80) && ((msg_len+20) <= payload_length)) /* WhatsApp Voice */) { + *is_whatsapp = 1; + return NDPI_IS_STUN; /* This is WhatsApp Voice */ + } else if((payload[0] == 0x90) && ((msg_len+11) == payload_length) /* WhatsApp Video */) { + *is_whatsapp = 2; + return NDPI_IS_STUN; /* This is WhatsApp Video */ + } + if((payload[0] != 0x80) && ((msg_len+20) > payload_length)) return(NDPI_IS_NOT_STUN); - - if((payload_length == (msg_len+20)) - && ((msg_type <= 0x000b) /* http://www.3cx.com/blog/voip-howto/stun-details/ */)) { + + if(((payload_length == (msg_len+20)) + && ((msg_type <= 0x000b) /* http://www.3cx.com/blog/voip-howto/stun-details/ */))) { u_int offset = 20; + // printf("[%02X][%02X][%02X][%02X][payload_length: %u]\n", payload[offset], payload[offset+1], payload[offset+2], payload[offset+3],payload_length); + /* This can either be the standard RTCP or Ms Lync RTCP that later will become Ms Lync RTP. In this case we need to @@ -103,6 +115,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * switch(attribute) { case 0x0008: /* Message Integrity */ case 0x0020: /* XOR-MAPPED-ADDRESSES */ + case 0x4000: case 0x4002: /* These are the only messages apparently whatsapp voice can use */ break; @@ -148,6 +161,7 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * default: /* This means this STUN packet cannot be confused with whatsapp voice */ + printf("==> %04X\n", attribute); can_this_be_whatsapp_voice = 0; break; } |