From 3a087e951d96f509c75344ad6791591e10e4f1cd Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Tue, 11 Jan 2022 15:23:39 +0100
Subject: Add a "confidence" field about the reliability of the classification.
 (#1395)

As a general rule, the higher the confidence value, the higher the
"reliability/precision" of the classification.

In other words, this new field provides an hint about "how" the flow
classification has been obtained.
For example, the application may want to ignore classification "by-port"
(they are not real DPI classifications, after all) or give a second
glance at flows classified via LRU caches (because of false positives).

Setting only one value for the confidence field is a bit tricky: more
work is probably needed in the next future to tweak/fix/improve the logic.
---
 src/lib/protocols/csgo.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'src/lib/protocols/csgo.c')

diff --git a/src/lib/protocols/csgo.c b/src/lib/protocols/csgo.c
index 47b32658c..f48636ef4 100644
--- a/src/lib/protocols/csgo.c
+++ b/src/lib/protocols/csgo.c
@@ -50,7 +50,7 @@ void ndpi_search_csgo(struct ndpi_detection_module_struct* ndpi_struct, struct n
     if(flow->l4.udp.csgo_state == 1 && packet->payload_packet_len >= 42 && w == 0xfffffffful) {
       if(!memcmp(packet->payload + 24, flow->l4.udp.csgo_strid, 18)) {
         flow->l4.udp.csgo_state++;
-        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN);
+        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
         NDPI_LOG_INFO( ndpi_struct, "found csgo connect0x reply\n");
         return;
       }
@@ -58,13 +58,13 @@ void ndpi_search_csgo(struct ndpi_detection_module_struct* ndpi_struct, struct n
 
     if(packet->payload_packet_len == 8 && ( w == 0x3a180000 || w == 0x39180000) ) {
       NDPI_LOG_INFO( ndpi_struct, "found csgo udp 8b\n");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN);
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
       return;
     }
 
     if(packet->payload_packet_len >= 36 && w == 0x56533031ul) {
       NDPI_LOG_INFO( ndpi_struct, "found csgo udp\n");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN);
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
       return;
     }
 
@@ -72,7 +72,7 @@ void ndpi_search_csgo(struct ndpi_detection_module_struct* ndpi_struct, struct n
       uint32_t w2 = htonl(get_u_int32_t(packet->payload, 4));
       if(w2 == 0x70696e67) {
         NDPI_LOG_INFO( ndpi_struct, "found csgo udp ping\n");
-        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN);
+        ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
         return;
       }
     }
@@ -98,7 +98,7 @@ void ndpi_search_csgo(struct ndpi_detection_module_struct* ndpi_struct, struct n
       if(packet->payload_packet_len == 15) {
         if(flow->l4.udp.csgo_s2 == 1 && flow->l4.udp.csgo_id2 == w2) {
           NDPI_LOG_INFO( ndpi_struct, "found csgo udp 0d1d\n");
-          ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN);
+          ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
           return;
         }
       }
@@ -108,14 +108,14 @@ void ndpi_search_csgo(struct ndpi_detection_module_struct* ndpi_struct, struct n
     if(packet->payload_packet_len >= 140 && (w == 0x02124c6c || w == 0x02125c6c) &&
         !memcmp(&packet->payload[3], "lta\000mob\000tpc\000bhj\000bxd\000tae\000urg\000gkh\000", 32)) {
       NDPI_LOG_INFO( ndpi_struct, "found csgo dictionary udp\n");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN);
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
       return;
     }
     
     if(packet->payload_packet_len >= 33 && packet->iph && packet->iph->daddr == 0xffffffff &&
         !memcmp(&packet->payload[17], "LanSearch", 9)) {
       NDPI_LOG_INFO( ndpi_struct, "found csgo LanSearch udp\n");
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN);
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
       return;
     }
 
-- 
cgit v1.2.3