diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/include/ndpi_typedefs.h | 7 | ||||
| -rw-r--r-- | src/lib/protocols/stun.c | 22 |
2 files changed, 25 insertions, 4 deletions
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index b7b0d525a..57a7d9993 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -1369,10 +1369,11 @@ struct ndpi_flow_struct { } kerberos_buf; struct { - u_int8_t maybe_dtls : 1, is_turn : 1, pad : 6; + u_int8_t maybe_dtls:1, rtcp_seen:1, is_turn : 1, is_client_controlling:1, pad : 4; ndpi_address_port mapped_address, peer_address, relayed_address, response_origin, other_address; u_int8_t num_xor_relayed_addresses, num_xor_mapped_addresses; u_int8_t num_non_stun_pkt, non_stun_pkt_len[2]; + u_int16_t rtp_counters[2]; } stun; struct { @@ -1628,8 +1629,8 @@ struct ndpi_flow_struct { _Static_assert(sizeof(((struct ndpi_flow_struct *)0)->protos) <= 264, "Size of the struct member protocols increased to more than 264 bytes, " "please check if this change is necessary."); -_Static_assert(sizeof(struct ndpi_flow_struct) <= 1224, - "Size of the flow struct increased to more than 1224 bytes, " +_Static_assert(sizeof(struct ndpi_flow_struct) <= 1232, + "Size of the flow struct increased to more than 1232 bytes, " "please check if this change is necessary."); #endif #endif diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index f7c1ab512..ff4fe8805 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -597,6 +597,20 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct, *app_proto = NDPI_PROTOCOL_SKYPE_TEAMS_CALL; break; + case 0x8029: /* ICE-CONTROLLED */ + if(current_pkt_from_client_to_server(ndpi_struct, flow)) + flow->stun.is_client_controlling = 0; + else + flow->stun.is_client_controlling = 1; + break; + + case 0x802A: /* ICE-CONTROLLING */ + if(current_pkt_from_client_to_server(ndpi_struct, flow)) + flow->stun.is_client_controlling = 1; + else + flow->stun.is_client_controlling = 0; + break; + case 0xFF03: *app_proto = NDPI_PROTOCOL_GOOGLE_CALL; break; @@ -928,7 +942,12 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct, rtp_rtcp = is_rtp_or_rtcp(ndpi_struct, packet->payload, packet->payload_packet_len, NULL); if(rtp_rtcp == IS_RTP) { - NDPI_LOG_DBG(ndpi_struct, "RTP (dir %d)\n", packet->packet_direction); + + NDPI_LOG_DBG(ndpi_struct, "RTP (dir %d) [%d/%d]\n", packet->packet_direction, + flow->stun.rtp_counters[0], flow->stun.rtp_counters[1]); + + flow->stun.rtp_counters[packet->packet_direction]++; + NDPI_LOG_INFO(ndpi_struct, "Found RTP over STUN\n"); rtp_get_stream_type(packet->payload[1] & 0x7F, &flow->flow_multimedia_types, flow->detected_protocol_stack[0]); @@ -963,6 +982,7 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct, } } else if(rtp_rtcp == IS_RTCP) { NDPI_LOG_DBG(ndpi_struct, "RTCP\n"); + flow->stun.rtcp_seen = 1; } else { NDPI_LOG_DBG(ndpi_struct, "Unexpected\n"); } |