diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 52d38ba7900..ab5f7b6e877 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -6055,7 +6055,8 @@ static u_int32_t make_msteams_key(struct ndpi_flow_struct *flow, u_int8_t use_cl /* ********************************************************************************* */ static void ndpi_reconcile_msteams_udp(struct ndpi_detection_module_struct *ndpi_str, - struct ndpi_flow_struct *flow) { + struct ndpi_flow_struct *flow, + u_int16_t master) { /* This function can NOT access &ndpi_str->packet since it is called also from ndpi_detection_giveup(), via ndpi_reconcile_protocols() */ @@ -6067,8 +6068,10 @@ static void ndpi_reconcile_msteams_udp(struct ndpi_detection_module_struct *ndpi if(s_match || d_match) { ndpi_int_change_protocol(ndpi_str, flow, - NDPI_PROTOCOL_SKYPE_TEAMS, flow->detected_protocol_stack[1], - NDPI_CONFIDENCE_DPI_PARTIAL); + NDPI_PROTOCOL_SKYPE_TEAMS, master, + /* Keep the same confidence */ + flow->confidence); + if(ndpi_str->msteams_cache) ndpi_lru_add_to_cache(ndpi_str->msteams_cache, @@ -6136,7 +6139,7 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s switch(ret->app_protocol) { case NDPI_PROTOCOL_MICROSOFT_AZURE: - ndpi_reconcile_msteams_udp(ndpi_str, flow); + ndpi_reconcile_msteams_udp(ndpi_str, flow, flow->detected_protocol_stack[1]); break; /* @@ -6157,7 +6160,7 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s case NDPI_PROTOCOL_STUN: if(flow && (flow->guessed_protocol_id_by_ip == NDPI_PROTOCOL_MICROSOFT_AZURE)) - ndpi_reconcile_msteams_udp(ndpi_str, flow); + ndpi_reconcile_msteams_udp(ndpi_str, flow, NDPI_PROTOCOL_STUN); break; case NDPI_PROTOCOL_NETFLOW: diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index 3dab65770b8..81e90e94f84 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -51,7 +51,8 @@ static int stun_monitoring(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t first_byte; #ifdef DEBUG_MONITORING - printf("[STUN-MON] Packet counter %d\n", flow->packet_counter); + printf("[STUN-MON] Packet counter %d protos %d/%d\n", flow->packet_counter, + flow->detected_protocol_stack[0], flow->detected_protocol_stack[1]); #endif if(packet->payload_packet_len == 0) @@ -261,6 +262,10 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd 0 /* dummy */, ndpi_get_current_time(flow)); } + +#ifdef DEBUG_STUN + printf("[STUN] Setting %d\n", app_proto); +#endif ndpi_set_detected_protocol(ndpi_struct, flow, app_proto, NDPI_PROTOCOL_STUN, confidence); if(ndpi_struct->monitoring_stun_pkts_to_process > 0 && @@ -268,7 +273,7 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd * multiple msg in the same TCP segment * same msg split across multiple segments */) { if((ndpi_struct->monitoring_stun_flags & NDPI_MONITORING_STUN_SUBCLASSIFIED) || - app_proto == NDPI_PROTOCOL_UNKNOWN /* No-subclassification */) { + flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN /* No-subclassification */) { flow->max_extra_packets_to_check = ndpi_struct->monitoring_stun_pkts_to_process; flow->extra_packets_func = stun_monitoring; } diff --git a/tests/cfgs/default/pcap/stun_msteams_unidir.pcapng b/tests/cfgs/default/pcap/stun_msteams_unidir.pcapng new file mode 100644 index 00000000000..c1ea31f4e61 Binary files /dev/null and b/tests/cfgs/default/pcap/stun_msteams_unidir.pcapng differ diff --git a/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out b/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out new file mode 100644 index 00000000000..67ca9b748fd --- /dev/null +++ b/tests/cfgs/default/result/stun_msteams_unidir.pcapng.out @@ -0,0 +1,25 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 7 (7.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 190 (190.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/3/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/6/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 1/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 2/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia protocols: 2/1 (search/found) + +Skype_Teams 12 5944 1 + + 1 UDP 52.115.136.55:3479 -> 10.0.0.1:50006 [proto: 78.125/STUN.Skype_Teams][IP: 276/Azure][ClearText][Confidence: DPI][DPI packets: 7][cat: VoIP/10][12 pkts/5944 bytes -> 0 pkts/0 bytes][Goodput ratio: 92/0][4.53 sec][bytes ratio: 1.000 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 453/0 1210/0 379/0][Pkt Len c2s/s2c min/avg/max/stddev: 81/0 495/0 1257/0 539/0][Risk: ** Known Proto on Non Std Port **** Unidirectional Traffic **][Risk Score: 60][Risk Info: No server to client traffic][Plen Bins: 0,16,33,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0]