OVPN: checking datapackets for RTP validity to reduce false positives

hynekkar · hynekkar · commit ae7f0586c071 · 2023-07-14T12:55:26.000+02:00
diff --git a/process/ovpn.cpp b/process/ovpn.cpp
@@ -155,7 +155,7 @@ void OVPNPlugin::update_record(RecordExtOVPN* vpn_data, const Packet &pkt)
             vpn_data->invalid_pkt_cnt = -1;
          }
 
-         if (pkt.payload_len_wire > c_min_data_packet_size) {
+         if (pkt.payload_len_wire > c_min_data_packet_size && !check_valid_rtp_header(pkt)) {
             vpn_data->data_pkt_cnt++;
          }
          break;
@@ -165,7 +165,7 @@ void OVPNPlugin::update_record(RecordExtOVPN* vpn_data, const Packet &pkt)
          break;
    }
 
-   if (pkt.payload_len_wire > c_min_data_packet_size) {
+   if (pkt.payload_len_wire > c_min_data_packet_size && !check_valid_rtp_header(pkt)) {
             vpn_data->large_pkt_cnt++;
       }
 

Original file line number	Diff line number	Diff line change
`@@ -155,7 +155,7 @@ void OVPNPlugin::update_record(RecordExtOVPN* vpn_data, const Packet &pkt)`
`155`	`155`	`vpn_data->invalid_pkt_cnt = -1;`
`156`	`156`	`}`
`157`	`157`
`158`		`- if (pkt.payload_len_wire > c_min_data_packet_size) {`
	`158`	`+ if (pkt.payload_len_wire > c_min_data_packet_size && !check_valid_rtp_header(pkt)) {`
`159`	`159`	`vpn_data->data_pkt_cnt++;`
`160`	`160`	`}`
`161`	`161`	`break;`
`@@ -165,7 +165,7 @@ void OVPNPlugin::update_record(RecordExtOVPN* vpn_data, const Packet &pkt)`
`165`	`165`	`break;`
`166`	`166`	`}`
`167`	`167`
`168`		`- if (pkt.payload_len_wire > c_min_data_packet_size) {`
	`168`	`+ if (pkt.payload_len_wire > c_min_data_packet_size && !check_valid_rtp_header(pkt)) {`
`169`	`169`	`vpn_data->large_pkt_cnt++;`
`170`	`170`	`}`
`171`	`171`