From 4d41588a7704fb89859fb708bcf526f1638eadb1 Mon Sep 17 00:00:00 2001
From: Luca Deri <deri@ntop.org>
Date: Wed, 2 Apr 2025 23:37:40 +0200
Subject: Implemented detection of the latest Signal video/audio calls
 leveraging on Cloudflare CDN

---
 src/lib/protocols/tls.c | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'src/lib/protocols/tls.c')

diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index c892c8961..c6d19775b 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -2860,6 +2860,11 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
 		      ndpi_set_risk(ndpi_struct, flow, NDPI_NUMERIC_IP_HOST, sni);
 		    }
 
+		    if(ndpi_str_endswith(sni, "signal.org")) {
+		      /* printf("[SIGNAL] SNI: [%s]\n", sni); */
+		      signal_add_to_cache(ndpi_struct, flow);
+		    }
+		      
 		    if(ndpi_check_dga_name(ndpi_struct, flow, sni, 1, 0, 0)) {
 #ifdef DEBUG_TLS
 		      printf("[TLS] SNI: (DGA) [%s]\n", sni);
-- 
cgit v1.2.3