mDNS improvemennts to recognize reponses senst to non multicast addresses

1 files changed, 20 insertions, 17 deletions

diff --git a/src/lib/protocols/mdns.c b/src/lib/protocols/mdns.c
index 0692b3252..a47e9b72a 100644
--- a/src/lib/protocols/mdns.c
+++ b/src/lib/protocols/mdns.c
@@ -1,7 +1,7 @@
 /*
  * mdns.c
  *
- * Copyright (C) 2016 - ntop.org
+ * Copyright (C) 2016-17 - ntop.org
  *
  * This file is part of nDPI, an open source deep packet inspection
  * library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -26,6 +26,10 @@
 
 #define NDPI_MAX_MDNS_REQUESTS  128
 
+PACK_ON
+struct mdns_header {
+ u_int16_t transaction_id, flags, questions, answers, authority_rr, additional_rr;	
+} PACK_OFF;
 
 /**
    MDNS header is similar to dns header
@@ -48,27 +52,26 @@
 
 
 static void ndpi_int_mdns_add_connection(struct ndpi_detection_module_struct
-					 *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+					 *ndpi_struct, struct ndpi_flow_struct *flow) {
   ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MDNS, NDPI_PROTOCOL_UNKNOWN);
 }
 
 static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
-				       *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+				       *ndpi_struct, struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
-
-  if((packet->payload[2] & 0x80) == 0 &&
-     ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
-     ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
-    
+  struct mdns_header *h = (struct mdns_header*)packet->payload;
+  u_int16_t questions = ntohs(h->questions), answers = ntohs(h->answers);
+  
+  if(((packet->payload[2] & 0x80) == 0)
+     && (questions <= NDPI_MAX_MDNS_REQUESTS)
+     && (answers <= NDPI_MAX_MDNS_REQUESTS)) {	
     NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n");
     return 1;    
   }
-  else if((packet->payload[2] & 0x80) != 0 &&
-	  ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
-	  ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
-	  ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
+  else if(((packet->payload[2] & 0x80) != 0)
+	  && (questions == 0)
+	  && (answers <= NDPI_MAX_MDNS_REQUESTS)
+	  && (answers != 0)) {
     char answer[256];
     int i, j, len;
 
@@ -77,7 +80,7 @@ static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
 	
     answer[j] = '\0';
 
-    /* printf("==> [%d] %s\n", j, answer); */
+    printf("==> [%d] %s\n", j, answer); 
 
     len = ndpi_min(sizeof(flow->protos.mdns.answer)-1, j);
     strncpy(flow->protos.mdns.answer, (const char *)answer, len);
@@ -107,7 +110,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
     /* check standard MDNS ON port 5353 */
     if(dport == 5353 && packet->payload_packet_len >= 12) {
       /* mdns protocol must have destination address 224.0.0.251 */
-      if(packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
+	    if(packet->iph != NULL /* && ntohl(packet->iph->daddr) == 0xe00000fb */) {
 
 	NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
 		 NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
@@ -120,7 +123,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
 #ifdef NDPI_DETECTION_SUPPORT_IPV6
       if(packet->iphv6 != NULL) {
 	const u_int32_t *daddr = packet->iphv6->ip6_dst.u6_addr.u6_addr32;
-	if(daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
+	if(daddr[0] == htonl(0xff020000) /* && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb) */) {
 
 	  NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
 		   NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n");