mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-05-02 17:00:16 +00:00
Fixed wrong detection of RTP as WhatsApp voice
This commit is contained in:
Luca
parent
fbe87ed640
commit
a0be9ea639
2 changed files with 58 additions and 57 deletions
|
|
@ -58,14 +58,14 @@ static u_int8_t isValidMSRTPType(u_int8_t payloadType) {
|
|||
case 127: /* x-data */
|
||||
return(1 /* RTP */);
|
||||
break;
|
||||
|
||||
|
||||
case 200: /* RTCP PACKET SENDER */
|
||||
case 201: /* RTCP PACKET RECEIVER */
|
||||
case 202: /* RTCP Source Description */
|
||||
case 203: /* RTCP Bye */
|
||||
return(2 /* RTCP */);
|
||||
break;
|
||||
|
||||
|
||||
default:
|
||||
return(0);
|
||||
}
|
||||
|
|
@ -78,8 +78,10 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
const u_int8_t * payload, const u_int16_t payload_len) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "search RTP\n");
|
||||
|
||||
if (payload_len < 2)
|
||||
if((payload_len < 2) || flow->protos.stun_ssl.stun.num_binding_requests) {
|
||||
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
|
||||
return;
|
||||
}
|
||||
|
||||
//struct ndpi_packet_struct *packet = &flow->packet;
|
||||
u_int8_t payloadType, payload_type = payload[1] & 0x7F;
|
||||
|
|
@ -91,17 +93,17 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
&& ((payload_type <= 34)
|
||||
|| ((payload_type >= 96) && (payload_type <= 127))
|
||||
/* http://www.iana.org/assignments/rtp-parameters/rtp-parameters.xhtml */
|
||||
)
|
||||
) {
|
||||
)
|
||||
) {
|
||||
struct ndpi_packet_struct *packet = &flow->packet;
|
||||
|
||||
|
||||
if(packet->iph) {
|
||||
/* 125.209.252.xxx */
|
||||
if(((ntohl(packet->iph->saddr) & 0xFFFFFF00 /* 255.255.255.0 */) == 0x7DD1FC00)
|
||||
|| ((ntohl(packet->iph->daddr) & 0xFFFFFF00 /* 255.255.255.0 */) == 0x7DD1FC00)) {
|
||||
if((flow->packet.payload[0] == 0x80)
|
||||
&& ((flow->packet.payload[1] == 0x78) || (flow->packet.payload[1] == 0xE8))
|
||||
) {
|
||||
) {
|
||||
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_LINE, NDPI_PROTOCOL_LINE);
|
||||
return;
|
||||
}
|
||||
|
|
@ -112,7 +114,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTP, NDPI_PROTOCOL_UNKNOWN);
|
||||
return;
|
||||
} else if((payload_len >= 12)
|
||||
&& (((payload[0] & 0xFF) == 0x80) || ((payload[0] & 0xFF) == 0xA0)) /* RTP magic byte[1] */
|
||||
&& (((payload[0] & 0xFF) == 0x80) || ((payload[0] & 0xFF) == 0xA0)) /* RTP magic byte[1] */
|
||||
&& (payloadType = isValidMSRTPType(payload[1] & 0xFF))) {
|
||||
if(payloadType == 1 /* RTP */) {
|
||||
NDPI_LOG_INFO(ndpi_struct, "Found Skype for Business (former MS Lync)\n");
|
||||
|
|
@ -126,7 +128,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
return;
|
||||
#endif
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
/* No luck this time */
|
||||
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
|
||||
|
|
@ -139,7 +141,7 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
|
|||
struct ndpi_packet_struct *packet = &flow->packet;
|
||||
|
||||
/* printf("*** %s(pkt=%d)\n", __FUNCTION__, flow->packet_counter); */
|
||||
|
||||
|
||||
if((packet->udp != NULL)
|
||||
/* && (ntohs(packet->udp->source) > 1023) */
|
||||
&& (ntohs(packet->udp->dest) > 1023))
|
||||
|
|
@ -204,14 +206,14 @@ u_int16_t update_seq(struct ndpi_detection_module_struct *ndpi_struct, struct nd
|
|||
u_int16_t delta = seq - flow->rtp_seqnum[direction];
|
||||
|
||||
|
||||
if (delta < RTP_MAX_OUT_OF_ORDER) { /* in order, with permissible gap */
|
||||
if(delta < RTP_MAX_OUT_OF_ORDER) { /* in order, with permissible gap */
|
||||
flow->rtp_seqnum[direction] = seq;
|
||||
NDPI_LOG_DBG(ndpi_struct, "rtp_seqnum[%u] = %u (increased by %u)\n",
|
||||
direction, seq, delta);
|
||||
direction, seq, delta);
|
||||
return delta;
|
||||
} else {
|
||||
NDPI_LOG_DBG(ndpi_struct, "retransmission (dir %u, seqnum %u)\n",
|
||||
direction, seq);
|
||||
direction, seq);
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
|
@ -227,51 +229,51 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
|
||||
NDPI_LOG_DBG(ndpi_struct, "search rtp\n");
|
||||
|
||||
if (payload_len == 4 && get_u_int32_t(packet->payload, 0) == 0 && flow->packet_counter < 8) {
|
||||
if(payload_len == 4 && get_u_int32_t(packet->payload, 0) == 0 && flow->packet_counter < 8) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "need next packet, maybe ClearSea out calls\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (payload_len == 5 && memcmp(payload, "hello", 5) == 0) {
|
||||
if(payload_len == 5 && memcmp(payload, "hello", 5) == 0) {
|
||||
NDPI_LOG_DBG(ndpi_struct,
|
||||
"need next packet, initial hello packet of SIP out calls.\n");
|
||||
"need next packet, initial hello packet of SIP out calls.\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (payload_len == 1 && payload[0] == 0) {
|
||||
if(payload_len == 1 && payload[0] == 0) {
|
||||
NDPI_LOG_DBG(ndpi_struct,
|
||||
"need next packet, payload_packet_len == 1 && payload[0] == 0.\n");
|
||||
"need next packet, payload_packet_len == 1 && payload[0] == 0.\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (payload_len == 3 && memcmp(payload, "png", 3) == 0) {
|
||||
if(payload_len == 3 && memcmp(payload, "png", 3) == 0) {
|
||||
/* weird packet found in Ninja GlobalIP trace */
|
||||
NDPI_LOG_DBG(ndpi_struct, "skipping packet with len = 3 and png payload\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if (payload_len < 12) {
|
||||
if(payload_len < 12) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "minimal packet size for rtp packets: 12\n");
|
||||
goto exclude_rtp;
|
||||
}
|
||||
|
||||
if (payload_len == 12 && get_u_int32_t(payload, 0) == 0 && get_u_int32_t(payload, 4) == 0 && get_u_int32_t(payload, 8) == 0) {
|
||||
if(payload_len == 12 && get_u_int32_t(payload, 0) == 0 && get_u_int32_t(payload, 4) == 0 && get_u_int32_t(payload, 8) == 0) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "skipping packet with len = 12 and only 0-bytes\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if ((payload[0] & 0xc0) == 0xc0 || (payload[0] & 0xc0) == 0x40 || (payload[0] & 0xc0) == 0x00) {
|
||||
if((payload[0] & 0xc0) == 0xc0 || (payload[0] & 0xc0) == 0x40 || (payload[0] & 0xc0) == 0x00) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "version = 3 || 1 || 0, maybe first rtp packet\n");
|
||||
return;
|
||||
}
|
||||
|
||||
if ((payload[0] & 0xc0) != 0x80) {
|
||||
if((payload[0] & 0xc0) != 0x80) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "rtp version must be 2, first two bits of a packets must be 10\n");
|
||||
goto exclude_rtp;
|
||||
}
|
||||
|
||||
/* rtp_payload_type are the last seven bits of the second byte */
|
||||
if (flow->rtp_payload_type[packet->packet_direction] != (payload[1] & 0x7F)) {
|
||||
if(flow->rtp_payload_type[packet->packet_direction] != (payload[1] & 0x7F)) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "payload_type has changed, reset stages\n");
|
||||
packet->packet_direction == 0 ? (flow->rtp_stage1 = 0) : (flow->rtp_stage2 = 0);
|
||||
}
|
||||
|
|
@ -280,56 +282,56 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
|
||||
stage = (packet->packet_direction == 0 ? flow->rtp_stage1 : flow->rtp_stage2);
|
||||
|
||||
if (stage > 0) {
|
||||
if(stage > 0) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "stage = %u\n", packet->packet_direction == 0 ? flow->rtp_stage1 : flow->rtp_stage2);
|
||||
if (flow->rtp_ssid[packet->packet_direction] != get_u_int32_t(payload, 8)) {
|
||||
if(flow->rtp_ssid[packet->packet_direction] != get_u_int32_t(payload, 8)) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "ssid has changed, goto exclude rtp\n");
|
||||
goto exclude_rtp;
|
||||
}
|
||||
|
||||
if (seqnum == flow->rtp_seqnum[packet->packet_direction]) {
|
||||
if(seqnum == flow->rtp_seqnum[packet->packet_direction]) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "maybe \"retransmission\", need next packet\n");
|
||||
return;
|
||||
} else if ((u_int16_t) (seqnum - flow->rtp_seqnum[packet->packet_direction]) < RTP_MAX_OUT_OF_ORDER) {
|
||||
} else if((u_int16_t) (seqnum - flow->rtp_seqnum[packet->packet_direction]) < RTP_MAX_OUT_OF_ORDER) {
|
||||
NDPI_LOG_DBG(ndpi_struct,
|
||||
"new packet has larger sequence number (within valid range)\n");
|
||||
"new packet has larger sequence number (within valid range)\n");
|
||||
update_seq(ndpi_struct, flow, packet->packet_direction, seqnum);
|
||||
} else if ((u_int16_t) (flow->rtp_seqnum[packet->packet_direction] - seqnum) < RTP_MAX_OUT_OF_ORDER) {
|
||||
} else if((u_int16_t) (flow->rtp_seqnum[packet->packet_direction] - seqnum) < RTP_MAX_OUT_OF_ORDER) {
|
||||
NDPI_LOG_DBG(ndpi_struct,
|
||||
"new packet has smaller sequence number (within valid range)\n");
|
||||
"new packet has smaller sequence number (within valid range)\n");
|
||||
init_seq(ndpi_struct, flow, packet->packet_direction, seqnum, 1);
|
||||
} else {
|
||||
NDPI_LOG_DBG(ndpi_struct,
|
||||
"sequence number diff is too big, goto exclude rtp.\n");
|
||||
"sequence number diff is too big, goto exclude rtp.\n");
|
||||
goto exclude_rtp;
|
||||
}
|
||||
} else {
|
||||
NDPI_LOG_DBG(ndpi_struct, "rtp_ssid[%u] = %u\n", packet->packet_direction,
|
||||
flow->rtp_ssid[packet->packet_direction]);
|
||||
flow->rtp_ssid[packet->packet_direction]);
|
||||
flow->rtp_ssid[packet->packet_direction] = get_u_int32_t(payload, 8);
|
||||
if (flow->packet_counter < 3) {
|
||||
if(flow->packet_counter < 3) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "packet_counter < 3, need next packet\n");
|
||||
}
|
||||
init_seq(ndpi_struct, flow, packet->packet_direction, seqnum, 1);
|
||||
}
|
||||
if (seqnum <= 3) {
|
||||
if(seqnum <= 3) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "sequence_number = %u, too small, need next packet, return\n", seqnum);
|
||||
return;
|
||||
}
|
||||
|
||||
if (stage == 3) {
|
||||
if(stage == 3) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "add connection I\n");
|
||||
ndpi_int_rtp_add_connection(ndpi_struct, flow);
|
||||
} else {
|
||||
packet->packet_direction == 0 ? flow->rtp_stage1++ : flow->rtp_stage2++;
|
||||
NDPI_LOG_DBG(ndpi_struct, "stage[%u]++; need next packet\n",
|
||||
packet->packet_direction);
|
||||
packet->packet_direction);
|
||||
}
|
||||
return;
|
||||
|
||||
exclude_rtp:
|
||||
if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
|
||||
|| /* packet->real_protocol_read_only == NDPI_PROTOCOL_STUN */) {
|
||||
exclude_rtp:
|
||||
if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
|
||||
|| /* packet->real_protocol_read_only == NDPI_PROTOCOL_STUN */) {
|
||||
NDPI_LOG_DBG(ndpi_struct, "STUN: is detected, need next packet\n");
|
||||
return;
|
||||
}
|
||||
|
|
@ -344,17 +346,17 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
|
|||
struct ndpi_packet_struct *packet = &flow->packet;
|
||||
|
||||
|
||||
if (packet->udp) {
|
||||
if(packet->udp) {
|
||||
ndpi_rtp_search(ndpi_struct, flow, packet->payload, packet->payload_packet_len);
|
||||
} else if (packet->tcp) {
|
||||
} else if(packet->tcp) {
|
||||
|
||||
/* skip special packets seen at yahoo traces */
|
||||
if (packet->payload_packet_len >= 20 && ntohs(get_u_int16_t(packet->payload, 2)) + 20 == packet->payload_packet_len &&
|
||||
packet->payload[0] == 0x90 && packet->payload[1] >= 0x01 && packet->payload[1] <= 0x07) {
|
||||
if (flow->packet_counter == 2)
|
||||
if(packet->payload_packet_len >= 20 && ntohs(get_u_int16_t(packet->payload, 2)) + 20 == packet->payload_packet_len &&
|
||||
packet->payload[0] == 0x90 && packet->payload[1] >= 0x01 && packet->payload[1] <= 0x07) {
|
||||
if(flow->packet_counter == 2)
|
||||
flow->l4.tcp.rtp_special_packets_seen = 1;
|
||||
NDPI_LOG_DBG(ndpi_struct,
|
||||
"skipping STUN-like, special yahoo packets with payload[0] == 0x90.\n");
|
||||
"skipping STUN-like, special yahoo packets with payload[0] == 0x90.\n");
|
||||
return;
|
||||
}
|
||||
|
||||
|
|
@ -365,12 +367,12 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
|
|||
* we can remove this restriction
|
||||
*/
|
||||
|
||||
if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
|
||||
|| packet->detected_protocol_stack[0] == NDPI_PROTOCOL_RTP) {
|
||||
if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN
|
||||
|| packet->detected_protocol_stack[0] == NDPI_PROTOCOL_RTP) {
|
||||
|
||||
/* RTP may be encapsulated in TCP packets */
|
||||
|
||||
if (packet->payload_packet_len >= 2 && ntohs(get_u_int16_t(packet->payload, 0)) + 2 == packet->payload_packet_len) {
|
||||
if(packet->payload_packet_len >= 2 && ntohs(get_u_int16_t(packet->payload, 0)) + 2 == packet->payload_packet_len) {
|
||||
|
||||
/* TODO there could be several RTP packets in a single TCP packet so maybe the detection could be
|
||||
* improved by checking only the RTP packet of given length */
|
||||
|
|
@ -381,9 +383,9 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
|
|||
}
|
||||
}
|
||||
|
||||
if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && flow->l4.tcp.rtp_special_packets_seen == 1) {
|
||||
if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && flow->l4.tcp.rtp_special_packets_seen == 1) {
|
||||
|
||||
if (packet->payload_packet_len >= 4 && ntohl(get_u_int32_t(packet->payload, 0)) + 4 == packet->payload_packet_len) {
|
||||
if(packet->payload_packet_len >= 4 && ntohl(get_u_int32_t(packet->payload, 0)) + 4 == packet->payload_packet_len) {
|
||||
|
||||
/* TODO there could be several RTP packets in a single TCP packet so maybe the detection could be
|
||||
* improved by checking only the RTP packet of given length */
|
||||
|
|
@ -394,7 +396,7 @@ void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct nd
|
|||
}
|
||||
}
|
||||
|
||||
if (NDPI_FLOW_PROTOCOL_EXCLUDED(ndpi_struct, flow, NDPI_PROTOCOL_STUN)) {
|
||||
if(NDPI_FLOW_PROTOCOL_EXCLUDED(ndpi_struct, flow, NDPI_PROTOCOL_STUN)) {
|
||||
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
|
||||
} else {
|
||||
NDPI_LOG_DBG(ndpi_struct, "STUN not yet excluded, need next packet\n");
|
||||
|
|
@ -416,4 +418,3 @@ void init_rtp_dissector(struct ndpi_detection_module_struct *ndpi_struct,
|
|||
|
||||
*id += 1;
|
||||
}
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue