diff options
| author | Nardi Ivan <nardi.ivan@gmail.com> | 2022-01-10 10:27:16 +0100 |
|---|---|---|
| committer | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2022-07-07 15:36:05 +0200 |
| commit | 2636c07571ecc19f832c81b71544a0ef2a69a3a6 (patch) | |
| tree | 0184f78ccc2babd2c1602684f2a027132ae6b52a | |
| parent | a31e79fc3c728acb01f03547197cccb95aa2265a (diff) | |
MONGODB: avoid false positives
| -rw-r--r-- | src/lib/protocols/mongodb.c | 21 | ||||
| -rw-r--r-- | tests/pcap/mongo_false_positive.pcapng | bin | 0 -> 13464 bytes | |||
| -rw-r--r-- | tests/result/mongo_false_positive.pcapng.out | 8 |
3 files changed, 28 insertions, 1 deletions
diff --git a/src/lib/protocols/mongodb.c b/src/lib/protocols/mongodb.c index 5b462cda2..1f09efd63 100644 --- a/src/lib/protocols/mongodb.c +++ b/src/lib/protocols/mongodb.c @@ -26,6 +26,8 @@ #include "ndpi_api.h" +/* https://docs.mongodb.com/manual/reference/mongodb-wire-protocol/ */ + enum mongo_opcodes { OP_REPLY = 1, @@ -67,6 +69,7 @@ static void ndpi_check_mongodb(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct mongo_message_header mongodb_hdr; struct ndpi_packet_struct *packet = &ndpi_struct->packet; + uint32_t responseFlags; if (packet->payload_packet_len <= sizeof(mongodb_hdr)) { NDPI_EXCLUDE_PROTO(ndpi_struct, flow); @@ -87,7 +90,6 @@ static void ndpi_check_mongodb(struct ndpi_detection_module_struct *ndpi_struct, } switch(le32toh(mongodb_hdr.op_code)) { - case OP_REPLY: case OP_UPDATE: case OP_INSERT: case RESERVED: @@ -98,6 +100,23 @@ static void ndpi_check_mongodb(struct ndpi_detection_module_struct *ndpi_struct, case OP_MSG: set_mongodb_detected(ndpi_struct, flow); break; + case OP_REPLY: + /* struct { + MsgHeader header; // standard message header + int32 responseFlags; // bit vector - see details below + int64 cursorID; // cursor id if client needs to do get more's + int32 startingFrom; // where in the cursor this reply is starting + int32 numberReturned; // number of documents in the reply + document* documents; // documents + } + */ + if(packet->payload_packet_len > sizeof(mongodb_hdr) + 20) { + responseFlags = le32toh(*(uint32_t *)(packet->payload + sizeof(mongodb_hdr))); + if((responseFlags & 0xFFFFFFF0) == 0) + set_mongodb_detected(ndpi_struct, flow); + } + break; + default: NDPI_LOG_DBG(ndpi_struct, "Invalid MONGODB length"); NDPI_EXCLUDE_PROTO(ndpi_struct, flow); diff --git a/tests/pcap/mongo_false_positive.pcapng b/tests/pcap/mongo_false_positive.pcapng Binary files differnew file mode 100644 index 000000000..44aa700f2 --- /dev/null +++ b/tests/pcap/mongo_false_positive.pcapng diff --git a/tests/result/mongo_false_positive.pcapng.out b/tests/result/mongo_false_positive.pcapng.out new file mode 100644 index 000000000..00c221205 --- /dev/null +++ b/tests/result/mongo_false_positive.pcapng.out @@ -0,0 +1,8 @@ +Guessed flow protos: 1 + +DPI Packets (TCP): 26 (26.00 pkts/flow) +Confidence Match by port : 1 (flows) + +TLS 26 12163 1 + + 1 TCP 188.75.184.20:49542 <-> 251.182.120.32:443 [proto: 91/TLS][Encrypted][Confidence: Match by port][cat: Web/5][13 pkts/9962 bytes <-> 13 pkts/2201 bytes][Goodput ratio: 93/67][84.45 sec][bytes ratio: 0.638 (Upload)][IAT c2s/s2c min/avg/max/stddev: 186/186 7406/5844 21467/15787 7157/5701][Pkt Len c2s/s2c min/avg/max/stddev: 56/56 766/169 1328/189 433/46][Plen Bins: 0,0,0,0,51,0,0,0,0,9,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,9,9,0,0,0,4,0,0,4,0,4,0,0,0,0,0,0,0,0] |