From 00eb2393f40790ffea13f24a2dd0be7424894982 Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Sun, 17 Jul 2022 12:45:42 +0200 Subject: STUN: improve detection of Hangout/Duo and FB voip calls --- src/lib/protocols/stun.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index f6e6f0592..e6526e144 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -49,9 +49,9 @@ u_int32_t get_stun_lru_key(struct ndpi_packet_struct *packet, u_int8_t rev) { /* ************************************************************ */ -void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *ndpi_struct, - struct ndpi_flow_struct *flow, - u_int proto, u_int app_proto) { +static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *ndpi_struct, + struct ndpi_flow_struct *flow, + u_int proto, u_int app_proto) { struct ndpi_packet_struct *packet = &ndpi_struct->packet; ndpi_confidence_t confidence = NDPI_CONFIDENCE_DPI; @@ -531,6 +531,12 @@ void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct n if(ndpi_int_check_stun(ndpi_struct, flow, packet->payload, packet->payload_packet_len) == NDPI_IS_STUN) { udp_stun_match: + + if(flow->guessed_host_protocol_id == NDPI_PROTOCOL_GOOGLE) + flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO; + else if(flow->guessed_host_protocol_id == NDPI_PROTOCOL_FACEBOOK) + flow->guessed_host_protocol_id = NDPI_PROTOCOL_FACEBOOK_VOIP; + if(flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN) flow->guessed_protocol_id = NDPI_PROTOCOL_STUN; @@ -538,7 +544,7 @@ void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct n flow->guessed_host_protocol_id = flow->guessed_protocol_id; flow->guessed_protocol_id = NDPI_PROTOCOL_STUN; } - + ndpi_int_stun_add_connection(ndpi_struct, flow, flow->guessed_protocol_id, flow->guessed_host_protocol_id); -- cgit v1.2.3