diff options
| author | loures <loures.raso@gmail.com> | 2020-05-13 18:30:51 +0200 |
|---|---|---|
| committer | loures <loures.raso@gmail.com> | 2020-05-13 18:32:29 +0200 |
| commit | 0a4fbb8cfb7602c9c0b90e8329b56577dea207fd (patch) | |
| tree | 88c58ff657091d847dc4b792d7287569cd4382a6 | |
| parent | 9dfd0d0071845779487b4e2e14c3599e18a74a8c (diff) | |
Add check for HTTP transfer of executable files
| -rw-r--r-- | src/include/ndpi_protocol_ids.h | 1 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 5 | ||||
| -rw-r--r-- | src/lib/protocols/http.c | 13 |
3 files changed, 19 insertions, 0 deletions
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index b63f1525c..463aeb497 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -281,6 +281,7 @@ typedef enum { NDPI_PROTOCOL_S7COMM = 249, NDPI_PROTOCOL_MSTEAMS = 250, NDPI_PROTOCOL_WEBSOCKET = 251, /* Leonn Paiva <leonn.paiva@gmail.com> */ + NDPI_PROTOCOL_EXECUTABLE_HTTP = 252, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index dcb34f2ad..39aad090c 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1474,6 +1474,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp no_master, "WebSocket", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_EXECUTABLE_HTTP, + 1 /* can_have_a_subprotocol */, no_master, + no_master, "Executable HTTP", NDPI_PROTOCOL_CATEGORY_WEB, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_main.c" diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index de4de3aee..b9a920ec7 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -245,6 +245,19 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ } } + /* catch application/exe mime-type */ + if(packet->content_line.ptr != NULL) { + u_int app_len = sizeof("application"); + if(packet->content_line.len > app_len) { + if(ndpi_strncasestr((const char *)&packet->content_line.ptr[app_len], "exe", + packet->content_line.len-app_len) != NULL) { + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_EXECUTABLE_HTTP, NDPI_PROTOCOL_CATEGORY_WEB); + NDPI_LOG_INFO(ndpi_struct, "found executable HTTP transfer\n"); + return; + } + } + } + if(packet->user_agent_line.ptr != NULL && packet->user_agent_line.len != 0) { /** Format examples: |