aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIvan Nardi <nardi.ivan@gmail.com>2025-07-02 08:27:20 +0200
committerIvan Nardi <nardi.ivan@gmail.com>2025-07-02 08:28:11 +0200
commit81ca06b0c7528a3da65ab0c8fab0b0b88c2f859d (patch)
tree2ee9d5bb8cfd07e8e70b77d5841fa404cc5f5203
parent4eff2cdb9991eed51e7e00e4dcc2f5fa1955cf17 (diff)
websocket: `ndpi_set_detected_protocol()` should be called only onceHEADdev
Fix: b07a910dc
-rw-r--r--src/lib/protocols/websocket.c1
-rw-r--r--tests/cfgs/default/result/websocket-chisel-ssh.pcap.out4
2 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/protocols/websocket.c b/src/lib/protocols/websocket.c
index f100cce5d..fc8a89231 100644
--- a/src/lib/protocols/websocket.c
+++ b/src/lib/protocols/websocket.c
@@ -133,6 +133,7 @@ static void ndpi_search_websocket(struct ndpi_detection_module_struct *ndpi_stru
ndpi_set_risk(ndpi_struct, flow, NDPI_OBFUSCATED_TRAFFIC,
"Obfuscated SSH-in-HTTP-WebSocket traffic");
}
+ found = 1;
}
}
if (i == packet->parsed_lines)
diff --git a/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out b/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out
index 5062422e8..6b5daa1d3 100644
--- a/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out
+++ b/tests/cfgs/default/result/websocket-chisel-ssh.pcap.out
@@ -11,9 +11,9 @@ LRU cache fpc_dns: 0/1/0 (insert/search/found)
Automa host: 1/0 (search/found)
Automa domain: 1/0 (search/found)
Automa tls cert: 0/0 (search/found)
-Automa risk mask: 1/0 (search/found)
+Automa risk mask: 0/0 (search/found)
Automa common alpns: 0/0 (search/found)
-Patricia risk mask: 4/0 (search/found)
+Patricia risk mask: 2/0 (search/found)
Patricia risk mask IPv6: 0/0 (search/found)
Patricia risk: 0/0 (search/found)
Patricia risk IPv6: 0/0 (search/found)