signal: improve detection of chats and calls (#2637)

ntop · Dec 4, 2024 · 83ce341 · 83ce341
1 parent d31b35d
commit 83ce341
Show file tree

Hide file tree

Showing 4 changed files with 41 additions and 1 deletion.
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
@@ -1067,7 +1067,12 @@ static ndpi_protocol_match host_match[] =
    { "ubuntu.com",                            "UbuntuONE",        NDPI_PROTOCOL_UBUNTUONE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
 
    { "signal.org",                            "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
-   { "whispersystems.org",            "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "whispersystems.org",                    "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "signal.art",                            "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "signal.group",                          "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "signal.link",                           "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "signal.me",                             "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
+   { "signal.tube",                           "Signal",           NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
 
    { "musical.ly",                            "TikTok",           NDPI_PROTOCOL_TIKTOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },
    { "byteoversea.com",                       "TikTok",           NDPI_PROTOCOL_TIKTOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL },

diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
@@ -485,6 +485,14 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct,
     break;
   }
 
+  /* See https://support.signal.org/hc/en-us/articles/360007320291-Firewall-and-Internet-settings.
+     Since the check is quite weak, give time to other applications to kick in */
+  if(flow->packet_counter > 4 && !flow->stun.is_turn &&
+     !is_subclassification_real(flow) &&
+     (ntohs(flow->c_port) == 10000 || ntohs(flow->s_port) == 10000)) {
+     *app_proto = NDPI_PROTOCOL_SIGNAL_VOIP;
+  }
+
   off = STUN_HDR_LEN;
   while(off + 4 < payload_length) {
     u_int16_t attribute = ntohs(*((u_int16_t *)&payload[off]));

diff --git a/tests/cfgs/default/pcap/signal_multiparty.pcapng b/tests/cfgs/default/pcap/signal_multiparty.pcapng
diff --git a/tests/cfgs/default/result/signal_multiparty.pcapng.out b/tests/cfgs/default/result/signal_multiparty.pcapng.out
@@ -0,0 +1,27 @@
+DPI Packets (UDP):	7	(7.00 pkts/flow)
+Confidence DPI              : 1 (flows)
+Num dissector calls: 7 (7.00 diss/flow)
+LRU cache ookla:      0/0/0 (insert/search/found)
+LRU cache bittorrent: 0/0/0 (insert/search/found)
+LRU cache stun:       4/8/0 (insert/search/found)
+LRU cache tls_cert:   0/0/0 (insert/search/found)
+LRU cache mining:     0/0/0 (insert/search/found)
+LRU cache msteams:    0/0/0 (insert/search/found)
+LRU cache fpc_dns:    0/0/0 (insert/search/found)
+Automa host:          0/0 (search/found)
+Automa domain:        0/0 (search/found)
+Automa tls cert:      0/0 (search/found)
+Automa risk mask:     0/0 (search/found)
+Automa common alpns:  0/0 (search/found)
+Patricia risk mask:   2/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
+Patricia risk:        0/0 (search/found)
+Patricia risk IPv6:   0/0 (search/found)
+Patricia protocols:   1/1 (search/found)
+Patricia protocols IPv6: 0/0 (search/found)
+
+SignalVoip	30	9753	1
+
+Acceptable                      30 9753          1            
+
+	1	UDP 192.168.12.67:38303 <-> 35.207.138.135:10000 [proto: 338.269/SRTP.SignalVoip][IP: 284/GoogleCloud][Encrypted][Confidence: DPI][FPC: 78/STUN, Confidence: DPI][DPI packets: 7][cat: VoIP/10][24 pkts/9059 bytes <-> 6 pkts/694 bytes][Goodput ratio: 89/64][0.46 sec][bytes ratio: 0.858 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 21/23 213/46 46/22][Pkt Len c2s/s2c min/avg/max/stddev: 87/81 377/116 1036/142 286/27][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 3478][PLAIN TEXT (BCipr/LEZ)][Plen Bins: 0,23,10,20,0,0,3,3,0,3,0,0,0,0,26,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]