Skip to content

Commit

Permalink
Remove Google Hangouts/Duo stuff (#2233)
Browse files Browse the repository at this point in the history 
* Remove Google Hangouts/Duo support

* Update protocols.rst
  • Loading branch information
@0xA50C1A1
0xA50C1A1 authored Jan 2, 2024
1 parent 3dbd89e commit 0f4d9f5
Show file tree
Hide file tree
Showing 10 changed files with 64 additions and 22 deletions.
10 changes: 10 additions & 0 deletions doc/protocols.rst
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,16 @@ A Remote Procedure Call protocol over HTTP from Microsoft.

References: `Protocol Specs: <https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rpch/c0f4c9c5-1a61-4d10-b8e2-005378d1d212`_.


.. _Proto 201:

`NDPI_PROTOCOL_GOOGLE_MEET`
====================
Google Meet is a video conferencing service from Google.

References: `Main site: <https://meet.google.com/>`_.


.. _Proto 338:

`NDPI_PROTOCOL_SRTP`
Expand Down
2 changes: 1 addition & 1 deletion src/include/ndpi_protocol_ids.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -229,7 +229,7 @@ typedef enum {
NDPI_PROTOCOL_MPEGTS = 198,
NDPI_PROTOCOL_SNAPCHAT = 199,
NDPI_PROTOCOL_SINA = 200,
NDPI_PROTOCOL_HANGOUT_DUO = 201, /* Google Hangout ad Duo (merged as they are very similar) */
NDPI_PROTOCOL_GOOGLE_MEET = 201,
NDPI_PROTOCOL_IFLIX = 202,
NDPI_PROTOCOL_GITHUB = 203,
NDPI_PROTOCOL_BJNP = 204,
Expand Down
5 changes: 2 additions & 3 deletions src/lib/ndpi_content_match.c.inc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -608,8 +608,8 @@ static ndpi_protocol_match host_match[] =
{ "app-measurement.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
{ ".app-measurement.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },

/* Google Hangout */
{ "images2-hangout-opensocial.googleusercontent.com", "GoogleHangout", NDPI_PROTOCOL_HANGOUT_DUO, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
/* Google Meet */
{ "meet.google.com", "GoogleMeet", NDPI_PROTOCOL_GOOGLE_MEET, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },

/* Google Services */
{ "googleapis.com", "GoogleServices", NDPI_PROTOCOL_GOOGLE_SERVICES, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL },
Expand Down Expand Up @@ -1573,7 +1573,6 @@ static ndpi_tls_cert_name_match tls_certificate_match [] = {
{ "O=Riot Games Inc", NDPI_PROTOCOL_RIOTGAMES },
{ "O=NoMachine", NDPI_PROTOCOL_NOMACHINE },

{ "CN=hangouts", NDPI_PROTOCOL_HANGOUT_DUO },
{ "CN=Snapchat Inc.", NDPI_PROTOCOL_SNAPCHAT_CALL },
{ "CN=NVIDIA GameStream", NDPI_PROTOCOL_GEFORCENOW },

Expand Down
4 changes: 2 additions & 2 deletions src/lib/ndpi_main.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1770,8 +1770,8 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
"DRDA", NDPI_PROTOCOL_CATEGORY_DATABASE,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HANGOUT_DUO,
"GoogleHangoutDuo", NDPI_PROTOCOL_CATEGORY_VOIP,
ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_GOOGLE_MEET,
"GoogleMeet", NDPI_PROTOCOL_CATEGORY_VOIP,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_BJNP,
Expand Down
8 changes: 4 additions & 4 deletions src/lib/protocols/stun.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,7 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct,
NDPI_LOG_DBG(ndpi_struct, "Realm [%s]\n", flow->host_server_name);

if(strstr(flow->host_server_name, "google.com") != NULL) {
*app_proto = NDPI_PROTOCOL_HANGOUT_DUO;
*app_proto = NDPI_PROTOCOL_GOOGLE_MEET;
return 1;
} else if(strstr(flow->host_server_name, "whispersystems.org") != NULL ||
strstr(flow->host_server_name, "signal.org") != NULL) {
Expand Down Expand Up @@ -307,7 +307,7 @@ int is_stun(struct ndpi_detection_module_struct *ndpi_struct,
return 1;

case 0xFF03:
*app_proto = NDPI_PROTOCOL_HANGOUT_DUO;
*app_proto = NDPI_PROTOCOL_GOOGLE_MEET;
return 1;

case 0x0013:
Expand Down Expand Up @@ -582,7 +582,7 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd
memcmp(&flow->c_address.v6, &pref2, sizeof(pref2)) == 0 ||
memcmp(&flow->s_address.v6, &pref1, sizeof(pref1)) == 0 ||
memcmp(&flow->s_address.v6, &pref2, sizeof(pref2)) == 0) {
app_proto = NDPI_PROTOCOL_HANGOUT_DUO;
app_proto = NDPI_PROTOCOL_GOOGLE_MEET;
}
} else {
u_int32_t c_address, s_address;
Expand All @@ -593,7 +593,7 @@ static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *nd
(c_address & 0xFFFFFF00) == 0x8efa5200 || /* 142.250.82.0/24 */
(s_address & 0xFFFFFF00) == 0x4a7dfa00 ||
(s_address & 0xFFFFFF00) == 0x8efa5200) {
app_proto = NDPI_PROTOCOL_HANGOUT_DUO;
app_proto = NDPI_PROTOCOL_GOOGLE_MEET;
}
}
}
Expand Down
Binary file added tests/cfgs/default/pcap/google_meet.pcapng
View file
Binary file not shown.
33 changes: 33 additions & 0 deletions tests/cfgs/default/result/google_meet.pcapng.out
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
DPI Packets (TCP): 6 (6.00 pkts/flow)
DPI Packets (UDP): 1 (1.00 pkts/flow)
Confidence DPI : 2 (flows)
Num dissector calls: 2 (1.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache zoom: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache stun_zoom: 0/0/0 (insert/search/found)
Automa host: 2/2 (search/found)
Automa domain: 2/0 (search/found)
Automa tls cert: 0/0 (search/found)
Automa risk mask: 0/0 (search/found)
Automa common alpns: 3/3 (search/found)
Patricia risk mask: 2/0 (search/found)
Patricia risk mask IPv6: 0/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 2/2 (search/found)
Patricia protocols IPv6: 0/0 (search/found)

GoogleMeet 12 8888 2

JA3 Host Stats:
IP Address # JA3C
1 192.168.88.231 2


1 UDP 192.168.88.231:59369 <-> 173.194.73.101:443 [proto: 188.201/QUIC.GoogleMeet][IP: 126/Google][Encrypted][Confidence: DPI][DPI packets: 1][cat: Chat/9][2 pkts/1373 bytes <-> 4 pkts/5168 bytes][Goodput ratio: 94/97][0.04 sec][Hostname/SNI: meet.google.com][(Advertised) ALPNs: h3][TLS Supported Versions: TLSv1.3][bytes ratio: -0.580 (Download)][IAT c2s/s2c min/avg/max/stddev: 18/17 18/6 18/17 0/8][Pkt Len c2s/s2c min/avg/max/stddev: 81/1292 686/1292 1292/1292 606/0][TLSv1.3][QUIC ver: V-1][JA3C: 86ba0adabbe377daf6b620f07b59b45c][JA4: q13d0311h][ECH: version 0xfe0d][PLAIN TEXT (w.ZLst)][Plen Bins: 0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,83,0,0,0,0,0,0,0,0]
2 TCP 192.168.88.231:43268 <-> 173.194.73.101:443 [proto: 91.201/TLS.GoogleMeet][IP: 126/Google][Encrypted][Confidence: DPI][DPI packets: 6][cat: Chat/9][3 pkts/741 bytes <-> 3 pkts/1606 bytes][Goodput ratio: 72/87][0.03 sec][Hostname/SNI: meet.google.com][(Advertised) ALPNs: h2;http/1.1][TLS Supported Versions: GREASE;TLSv1.3;TLSv1.2][bytes ratio: -0.369 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 8/8 16/16 8/8][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 247/535 601/1466 250/658][TLSv1.3][JA3C: f97d8fcbd3d1517f7bf0d2c536a503a1][JA4: t00d1516h2_8daaf6152771_02713d6af862][JA3S: eb1d94daa7e0344597e756a1fb6e7054][ECH: version 0xfe0d][Chrome][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0]
6 changes: 3 additions & 3 deletions tests/cfgs/default/result/stun.pcap.out
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ DTLS 4 766 1
Skype_TeamsCall 15 2124 1
STUN 62 7620 2
ICMP 1 122 1
GoogleHangoutDuo 41 7228 2
GoogleMeet 41 7228 2
FacebookVoip 75 10554 1

JA3 Host Stats:
Expand All @@ -36,10 +36,10 @@ JA3 Host Stats:


1 UDP 192.168.12.169:38123 <-> 31.13.86.54:40003 [proto: 78.268/STUN.FacebookVoip][IP: 119/Facebook][ClearText][Confidence: DPI][DPI packets: 2][cat: VoIP/10][40 pkts/6134 bytes <-> 35 pkts/4420 bytes][Goodput ratio: 73/67][10.09 sec][Hostname/SNI: turner.facebook][bytes ratio: 0.162 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 260/331 6004/5997 1040/1126][Pkt Len c2s/s2c min/avg/max/stddev: 70/68 153/126 190/174 31/39][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][PLAIN TEXT (unauthorized)][Plen Bins: 8,14,9,28,40,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 UDP 192.168.12.169:49153 <-> 142.250.82.99:3478 [proto: 78.201/STUN.GoogleHangoutDuo][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][18 pkts/2856 bytes <-> 15 pkts/3436 bytes][Goodput ratio: 74/82][2.12 sec][bytes ratio: -0.092 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 8/0 88/153 699/625 177/222][Pkt Len c2s/s2c min/avg/max/stddev: 107/76 159/229 588/1240 107/297][PLAIN TEXT (BwlkYDtFJ)][Plen Bins: 0,6,57,21,6,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0]
2 UDP 192.168.12.169:49153 <-> 142.250.82.99:3478 [proto: 78.201/STUN.GoogleMeet][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][18 pkts/2856 bytes <-> 15 pkts/3436 bytes][Goodput ratio: 74/82][2.12 sec][bytes ratio: -0.092 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 8/0 88/153 699/625 177/222][Pkt Len c2s/s2c min/avg/max/stddev: 107/76 159/229 588/1240 107/297][PLAIN TEXT (BwlkYDtFJ)][Plen Bins: 0,6,57,21,6,0,0,0,0,0,0,0,0,0,0,0,0,6,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0]
3 UDP [3516:bf0b:fc53:75e7:70af:f67f:8e49:f603]:56880 <-> [2a38:e156:8167:a333:face:b00c::24d9]:3478 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 5][cat: Network/14][21 pkts/1722 bytes <-> 21 pkts/2226 bytes][Goodput ratio: 24/41][191.49 sec][bytes ratio: -0.128 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 2/2 9451/9451 10358/10358 2441/2441][Pkt Len c2s/s2c min/avg/max/stddev: 82/106 82/106 82/106 0/0][PLAIN TEXT (WOBTrOXR)][Plen Bins: 50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
4 TCP 87.47.100.17:3478 <-> 54.1.57.155:37257 [proto: 78/STUN][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 6][cat: Network/14][9 pkts/1494 bytes <-> 11 pkts/2178 bytes][Goodput ratio: 60/67][0.95 sec][Hostname/SNI: apps-host.com][bytes ratio: -0.186 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 104/96 267/252 102/93][Pkt Len c2s/s2c min/avg/max/stddev: 74/94 166/198 234/354 41/65][PLAIN TEXT (Unauthorized)][Plen Bins: 10,0,15,21,42,5,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
5 TCP 10.77.110.51:41588 <-> 10.206.50.239:42000 [VLAN: 1611][proto: 78.38/STUN.Skype_TeamsCall][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 3][cat: VoIP/10][7 pkts/1006 bytes <-> 8 pkts/1118 bytes][Goodput ratio: 58/57][1.05 sec][bytes ratio: -0.053 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 189/134 369/399 144/153][Pkt Len c2s/s2c min/avg/max/stddev: 70/64 144/140 164/172 31/43][Plen Bins: 0,0,25,75,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
6 UDP 192.168.12.169:43016 <-> 74.125.247.128:3478 [proto: 78.201/STUN.GoogleHangoutDuo][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 4][cat: VoIP/10][4 pkts/528 bytes <-> 4 pkts/408 bytes][Goodput ratio: 68/59][1.25 sec][Hostname/SNI: turn.l.google.com][bytes ratio: 0.128 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 9/23 342/409 974/1177 447/543][Pkt Len c2s/s2c min/avg/max/stddev: 62/74 132/102 198/122 61/19][PLAIN TEXT (BSnLfRxS6)][Plen Bins: 12,37,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
6 UDP 192.168.12.169:43016 <-> 74.125.247.128:3478 [proto: 78.201/STUN.GoogleMeet][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 4][cat: VoIP/10][4 pkts/528 bytes <-> 4 pkts/408 bytes][Goodput ratio: 68/59][1.25 sec][Hostname/SNI: turn.l.google.com][bytes ratio: 0.128 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 9/23 342/409 974/1177 447/543][Pkt Len c2s/s2c min/avg/max/stddev: 62/74 132/102 198/122 61/19][PLAIN TEXT (BSnLfRxS6)][Plen Bins: 12,37,25,0,25,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
7 UDP 192.168.43.169:48854 <-> 134.224.90.111:8801 [proto: 30/DTLS][IP: 189/Zoom][Encrypted][Confidence: DPI][DPI packets: 4][3 pkts/660 bytes <-> 1 pkts/106 bytes][Goodput ratio: 81/60][0.12 sec][(Advertised) ALPNs: webrtc;c-webrtc][Risk: ** Known Proto on Non Std Port **** Missing SNI TLS Extn **][Risk Score: 100][DTLSv1.2][JA3C: 3e12a43c7535bb32beac3928f8fe905d][JA4: t00d0808we_c6c2b6ec87e0_06b1ae923e2a][Firefox][PLAIN TEXT (DCBD09778680)][Plen Bins: 0,0,25,0,25,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
8 ICMP 192.168.12.169:0 -> 74.125.247.128:0 [proto: 81/ICMP][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/122 bytes -> 0 pkts/0 bytes][Goodput ratio: 65/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (62NfUD5)][Plen Bins: 0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
4 changes: 2 additions & 2 deletions tests/cfgs/default/result/stun_dtls_rtp.pcapng.out
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,6 @@ Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 1/1 (search/found)
Patricia protocols IPv6: 0/0 (search/found)

GoogleHangoutDuo 39 8413 1
GoogleMeet 39 8413 1

1 UDP 192.168.12.156:37967 <-> 142.250.82.76:19305 [proto: 78.201/STUN.GoogleHangoutDuo][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][25 pkts/4202 bytes <-> 14 pkts/4211 bytes][Goodput ratio: 75/86][0.88 sec][bytes ratio: -0.001 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 37/35 203/107 47/36][Pkt Len c2s/s2c min/avg/max/stddev: 103/82 168/301 587/1245 125/320][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic][PLAIN TEXT (ShSURJhNF)][Plen Bins: 0,5,47,30,2,0,0,0,0,0,0,0,0,2,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0]
1 UDP 192.168.12.156:37967 <-> 142.250.82.76:19305 [proto: 78.201/STUN.GoogleMeet][IP: 126/Google][ClearText][Confidence: DPI][DPI packets: 1][cat: VoIP/10][25 pkts/4202 bytes <-> 14 pkts/4211 bytes][Goodput ratio: 75/86][0.88 sec][bytes ratio: -0.001 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 37/35 203/107 47/36][Pkt Len c2s/s2c min/avg/max/stddev: 103/82 168/301 587/1245 125/320][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: No server to client traffic][PLAIN TEXT (ShSURJhNF)][Plen Bins: 0,5,47,30,2,0,0,0,0,0,0,0,0,2,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0]
Loading

0 comments on commit 0f4d9f5

Please sign in to comment.