Skip to content

Commit

Permalink
Update flow->flow_multimedia_types to a bitmask (#2625)
Browse files Browse the repository at this point in the history 
In the same flow, we can have multiple multimedia types
  • Loading branch information
@IvanNardi
IvanNardi authored Nov 25, 2024
1 parent 5c4061d commit cff8bd1
Show file tree
Hide file tree
Showing 20 changed files with 97 additions and 71 deletions.
24 changes: 3 additions & 21 deletions example/ndpiReader.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1810,28 +1810,10 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
ndpi_get_proto_name(ndpi_thread_info[thread_id].workflow->ndpi_struct,
flow->detected_protocol.protocol_by_ip));

if(flow->multimedia_flow_type != ndpi_multimedia_unknown_flow) {
const char *content;
if(flow->multimedia_flow_types != ndpi_multimedia_unknown_flow) {
char content[64] = {0};

switch(flow->multimedia_flow_type) {
case ndpi_multimedia_audio_flow:
content = "Audio";
break;

case ndpi_multimedia_video_flow:
content = "Video";
break;

case ndpi_multimedia_screen_sharing_flow:
content = "Screen Sharing";
break;

default:
content = "???";
break;
}

fprintf(out, "[Stream Content: %s]", content);
fprintf(out, "[Stream Content: %s]", ndpi_multimedia_flowtype2str(content, sizeof(content), flow->multimedia_flow_types));
}

fprintf(out, "[%s]",
Expand Down
4 changes: 3 additions & 1 deletion example/reader_util.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1198,6 +1198,8 @@ static void process_ndpi_monitoring_info(struct ndpi_flow_info *flow) {
add_to_address_port_list(&flow->stun.peer_address, &flow->ndpi_flow->monit->protos.dtls_stun_rtp.peer_address);
add_to_address_port_list(&flow->stun.relayed_address, &flow->ndpi_flow->monit->protos.dtls_stun_rtp.relayed_address);
add_to_address_port_list(&flow->stun.response_origin, &flow->ndpi_flow->monit->protos.dtls_stun_rtp.response_origin);

flow->multimedia_flow_types |= flow->ndpi_flow->flow_multimedia_types;
}

}
Expand Down Expand Up @@ -1607,7 +1609,7 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
add_to_address_port_list(&flow->stun.other_address, &flow->ndpi_flow->stun.other_address);
}

flow->multimedia_flow_type = flow->ndpi_flow->flow_multimedia_type;
flow->multimedia_flow_types |= flow->ndpi_flow->flow_multimedia_types;

if(flow->ndpi_flow->tcp.fingerprint) {
char buf[128];
Expand Down
2 changes: 1 addition & 1 deletion example/reader_util.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -333,7 +333,7 @@ typedef struct ndpi_flow_info {
char geolocation_iata_code[4];
} dns;

ndpi_multimedia_flow_type multimedia_flow_type;
u_int8_t multimedia_flow_types;

void *src_id, *dst_id;
char *tcp_fingerprint;
Expand Down
4 changes: 4 additions & 0 deletions fuzz/fuzz_config.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -631,6 +631,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
char buf[8]; /* Too short in same cases... */
if(fuzzed_data.ConsumeBool()) {
ndpi_ssl_version2str(buf, sizeof(buf), fuzzed_data.ConsumeIntegral<u_int16_t>(), &unused);
if(fuzzed_data.ConsumeBool())
ndpi_multimedia_flowtype2str(buf, sizeof(buf), static_cast<ndpi_multimedia_flow_type>(fuzzed_data.ConsumeIntegral<u_int8_t>()));
else
ndpi_multimedia_flowtype2str(NULL, 0, static_cast<ndpi_multimedia_flow_type>(fuzzed_data.ConsumeIntegral<u_int8_t>()));
ndpi_get_ip_proto_name(fuzzed_data.ConsumeIntegral<u_int8_t>(), buf, sizeof(buf));
} else {
ndpi_ssl_version2str(NULL, 0, fuzzed_data.ConsumeIntegral<u_int16_t>(), &unused);
Expand Down
1 change: 1 addition & 0 deletions src/include/ndpi_api.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1133,6 +1133,7 @@ extern "C" {
ndpi_protocol const * const l7_protocol);
char* ndpi_ssl_version2str(char *buf, int buf_len,
u_int16_t version, u_int8_t *unknown_tls_version);
char *ndpi_multimedia_flowtype2str(char *buf, int buf_len, u_int8_t m_types);
char *ndpi_quic_version2str(char *buf, int buf_len, u_int32_t version);
int ndpi_netbios_name_interpret(u_char *in, u_int in_len, u_char *out, u_int out_len);
void ndpi_patchIPv6Address(char *str);
Expand Down
2 changes: 1 addition & 1 deletion src/include/ndpi_private.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -691,7 +691,7 @@ const uint8_t *get_crypto_data(struct ndpi_detection_module_struct *ndpi_struct,
int is_valid_rtp_payload_type(uint8_t type);
int is_rtp_or_rtcp(struct ndpi_detection_module_struct *ndpi_struct,
const u_int8_t *payload, u_int16_t payload_len, u_int16_t *seq);
u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_type, u_int16_t sub_proto);
u_int8_t rtp_get_stream_type(u_int8_t payloadType, u_int8_t *s_type, u_int16_t sub_proto);

/* Bittorrent */
u_int64_t make_bittorrent_host_key(struct ndpi_flow_struct *flow, int client, int offset);
Expand Down
10 changes: 5 additions & 5 deletions src/include/ndpi_typedefs.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -72,10 +72,10 @@ typedef enum {
} ndpi_log_level_t;

typedef enum {
ndpi_multimedia_unknown_flow = 0,
ndpi_multimedia_audio_flow,
ndpi_multimedia_video_flow,
ndpi_multimedia_screen_sharing_flow,
ndpi_multimedia_unknown_flow = 0x00,
ndpi_multimedia_audio_flow = 0x01,
ndpi_multimedia_video_flow = 0x02,
ndpi_multimedia_screen_sharing_flow = 0x04,
} ndpi_multimedia_flow_type;

typedef enum {
Expand Down Expand Up @@ -1358,7 +1358,7 @@ struct ndpi_flow_struct {
char *username, *password;
} http;

ndpi_multimedia_flow_type flow_multimedia_type;
u_int8_t flow_multimedia_types;

/*
Put outside of the union to avoid issues in case the protocol
Expand Down
8 changes: 4 additions & 4 deletions src/lib/ndpi_main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7728,13 +7728,13 @@ static int ndpi_reconcile_msteams_call_udp_port(struct ndpi_flow_struct *flow,
*/

if((dport == 3478) || (dport == 3479) || ((sport >= 50000) && (sport <= 50019)))
flow->flow_multimedia_type = ndpi_multimedia_audio_flow;
flow->flow_multimedia_types |= ndpi_multimedia_audio_flow;
else if((dport == 3480) || ((sport >= 50020) && (sport <= 50039)))
flow->flow_multimedia_type = ndpi_multimedia_video_flow;
flow->flow_multimedia_types |= ndpi_multimedia_video_flow;
else if((dport == 3481) || ((sport >= 50040) && (sport <= 50059)))
flow->flow_multimedia_type = ndpi_multimedia_screen_sharing_flow;
flow->flow_multimedia_types |= ndpi_multimedia_screen_sharing_flow;
else {
flow->flow_multimedia_type = ndpi_multimedia_unknown_flow;
flow->flow_multimedia_types = ndpi_multimedia_unknown_flow;
return(0);
}

Expand Down
37 changes: 37 additions & 0 deletions src/lib/ndpi_utils.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -831,6 +831,38 @@ const char* ndpi_get_flow_info(struct ndpi_flow_struct const * const flow,

/* ********************************** */

char *ndpi_multimedia_flowtype2str(char *buf, int buf_len, u_int8_t m_types)
{
int rc, len = 0;

if(buf == NULL || buf_len <= 1)
return NULL;

buf[0] = '\0';

if(m_types == ndpi_multimedia_unknown_flow) {
rc = ndpi_snprintf(buf + len, buf_len - len, "Unknown", len > 0 ? ", " : "");
if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
}

if(m_types & ndpi_multimedia_audio_flow) {
rc = ndpi_snprintf(buf + len, buf_len - len, "%sAudio", len > 0 ? ", " : "");
if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
}
if(m_types & ndpi_multimedia_video_flow) {
rc = ndpi_snprintf(buf + len, buf_len - len, "%sVideo", len > 0 ? ", " : "");
if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
}
if(m_types & ndpi_multimedia_screen_sharing_flow) {
rc = ndpi_snprintf(buf + len, buf_len - len, "%sScreen Sharing", len > 0 ? ", " : "");
if(rc > 0 && len + rc < buf_len) len += rc; else return NULL;
}

return buf;
}

/* ********************************** */

char* ndpi_ssl_version2str(char *buf, int buf_len,
u_int16_t version, u_int8_t *unknown_tls_version) {
if(unknown_tls_version)
Expand Down Expand Up @@ -1260,6 +1292,7 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
char buf[64];
char const *host_server_name;
char quic_version[16];
char content[64] = {0};
u_int i;

if(flow == NULL) return(-1);
Expand All @@ -1274,6 +1307,10 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
ndpi_serialize_string_string(serializer, "domainame", ndpi_get_host_domain(ndpi_struct, host_server_name));
}

if(flow->flow_multimedia_types != ndpi_multimedia_unknown_flow) {
ndpi_serialize_string_string(serializer, "stream_content", ndpi_multimedia_flowtype2str(content, sizeof(content), flow->flow_multimedia_types));
}

switch(l7_protocol.proto.master_protocol ? l7_protocol.proto.master_protocol : l7_protocol.proto.app_protocol) {
case NDPI_PROTOCOL_IP_ICMP:
if(flow->entropy > 0.0f) {
Expand Down
46 changes: 23 additions & 23 deletions src/lib/protocols/rtp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ int is_valid_rtp_payload_type(uint8_t type)
return 1;
}

u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_type, u_int16_t sub_proto)
u_int8_t rtp_get_stream_type(u_int8_t payloadType, u_int8_t *s_type, u_int16_t sub_proto)
{
/* General, from IANA */
switch(payloadType) {
Expand All @@ -61,7 +61,7 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
case 16: /* DVI4 */
case 17: /* DVI4 */
case 18: /* G729 */
*s_type = ndpi_multimedia_audio_flow;
*s_type |= ndpi_multimedia_audio_flow;
return(1);

case 25: /* CelB */
Expand All @@ -70,7 +70,7 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
case 31: /* H261 */
case 32: /* MPV */
case 34: /* H263 */
*s_type = ndpi_multimedia_video_flow;
*s_type |= ndpi_multimedia_video_flow;
return(1);
}

Expand All @@ -87,18 +87,18 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
case 116: /* G.726 */
case 117: /* G.722 */
case 118: /* Comfort Noise Wideband */
*s_type = ndpi_multimedia_audio_flow;
*s_type |= ndpi_multimedia_audio_flow;
return(1);

case 34: /* H.263 [MS-H26XPF] */
case 121: /* RT Video */
case 122: /* H.264 [MS-H264PF] */
case 123: /* H.264 FEC [MS-H264PF] */
*s_type = ndpi_multimedia_video_flow;
*s_type |= ndpi_multimedia_video_flow;
return(1);

default:
*s_type = ndpi_multimedia_unknown_flow;
*s_type |= ndpi_multimedia_unknown_flow;
return(0);
}
}
Expand All @@ -114,33 +114,33 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
if(sub_proto == NDPI_PROTOCOL_GOOGLE_CALL) {
switch(payloadType) {
case 111:
*s_type = ndpi_multimedia_audio_flow;
*s_type |= ndpi_multimedia_audio_flow;
return(1);

case 96:
case 100:
*s_type = ndpi_multimedia_video_flow;
*s_type |= ndpi_multimedia_video_flow;
return(1);

default:
*s_type = ndpi_multimedia_unknown_flow;
*s_type |= ndpi_multimedia_unknown_flow;
return(0);
}
}

if(sub_proto == NDPI_PROTOCOL_WHATSAPP_CALL) {
switch(payloadType) {
case 120:
*s_type = ndpi_multimedia_audio_flow;
*s_type |= ndpi_multimedia_audio_flow;
return(1);

case 97:
case 102:
*s_type = ndpi_multimedia_video_flow;
*s_type |= ndpi_multimedia_video_flow;
return(1);

default:
*s_type = ndpi_multimedia_unknown_flow;
*s_type |= ndpi_multimedia_unknown_flow;
return(0);
}
}
Expand All @@ -151,52 +151,52 @@ u_int8_t rtp_get_stream_type(u_int8_t payloadType, ndpi_multimedia_flow_type *s_
case 97:
case 101:
case 109:
*s_type = ndpi_multimedia_audio_flow;
*s_type |= ndpi_multimedia_audio_flow;
return(1);

case 127:
*s_type = ndpi_multimedia_video_flow;
*s_type |= ndpi_multimedia_video_flow;
return(1);

default:
*s_type = ndpi_multimedia_unknown_flow;
*s_type |= ndpi_multimedia_unknown_flow;
return(0);
}
}

if(sub_proto == NDPI_PROTOCOL_TELEGRAM_VOIP) {
switch(payloadType) {
case 111:
*s_type = ndpi_multimedia_audio_flow;
*s_type |= ndpi_multimedia_audio_flow;
return(1);

case 106:
*s_type = ndpi_multimedia_video_flow;
*s_type |= ndpi_multimedia_video_flow;
return(1);

default:
*s_type = ndpi_multimedia_unknown_flow;
*s_type |= ndpi_multimedia_unknown_flow;
return(0);
}
}

if(sub_proto == NDPI_PROTOCOL_SIGNAL_VOIP) {
switch(payloadType) {
case 102:
*s_type = ndpi_multimedia_audio_flow;
*s_type |= ndpi_multimedia_audio_flow;
return(1);

case 120:
*s_type = ndpi_multimedia_video_flow;
*s_type |= ndpi_multimedia_video_flow;
return(1);

default:
*s_type = ndpi_multimedia_unknown_flow;
*s_type |= ndpi_multimedia_unknown_flow;
return(0);
}
}

*s_type = ndpi_multimedia_unknown_flow;
*s_type |= ndpi_multimedia_unknown_flow;
return(0);
}

Expand Down Expand Up @@ -324,7 +324,7 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct,
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
NDPI_EXCLUDE_PROTO_EXT(ndpi_struct, flow, NDPI_PROTOCOL_RTCP);
} else {
rtp_get_stream_type(payload[1] & 0x7F, &flow->flow_multimedia_type, NDPI_PROTOCOL_UNKNOWN);
rtp_get_stream_type(payload[1] & 0x7F, &flow->flow_multimedia_types, NDPI_PROTOCOL_UNKNOWN);

NDPI_LOG_INFO(ndpi_struct, "Found RTP\n");
ndpi_int_rtp_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_RTP);
Expand Down
2 changes: 1 addition & 1 deletion src/lib/protocols/stun.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -877,7 +877,7 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct,
NDPI_LOG_DBG(ndpi_struct, "RTP (dir %d)\n", packet->packet_direction);
NDPI_LOG_INFO(ndpi_struct, "Found RTP over STUN\n");

rtp_get_stream_type(packet->payload[1] & 0x7F, &flow->flow_multimedia_type, flow->detected_protocol_stack[0]);
rtp_get_stream_type(packet->payload[1] & 0x7F, &flow->flow_multimedia_types, flow->detected_protocol_stack[0]);

if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_RTP &&
flow->detected_protocol_stack[0] != NDPI_PROTOCOL_RTCP &&
Expand Down
Loading

0 comments on commit cff8bd1

Please sign in to comment.