diff options
| author | Toni <matzeton@googlemail.com> | 2022-08-24 13:22:46 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-08-24 13:22:46 +0200 |
| commit | 0c8bc9f0555fa19d56bb686a2233772ae408f77b (patch) | |
| tree | 78e848b716456ae3ce95f15d2b3cf11c40a30ea2 /src/lib/protocols/cassandra.c | |
| parent | e135c1c5e3a6b202f4b29374426bbc9808978045 (diff) | |
Add FastCGI protocol detection. (#1711)
* CQL: fixed byte order conversion (BigEndian not LittleEndian)
* CQL: increased required successful dissected packets to prevent false-positives
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'src/lib/protocols/cassandra.c')
| -rw-r--r-- | src/lib/protocols/cassandra.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/lib/protocols/cassandra.c b/src/lib/protocols/cassandra.c index 154882f81..07231ac65 100644 --- a/src/lib/protocols/cassandra.c +++ b/src/lib/protocols/cassandra.c @@ -117,12 +117,15 @@ void ndpi_search_cassandra(struct ndpi_detection_module_struct *ndpi_struct, ndpi_check_valid_cassandra_version(get_u_int8_t(packet->payload, 0)) && ndpi_check_valid_cassandra_flags(get_u_int8_t(packet->payload, 1)) && ndpi_check_valid_cassandra_opcode(get_u_int8_t(packet->payload, 4)) && - le32toh(get_u_int32_t(packet->payload, 5)) <= CASSANDRA_MAX_BODY_SIZE && - le32toh(get_u_int32_t(packet->payload, 5)) >= (uint32_t) (packet->payload_packet_len - CASSANDRA_HEADER_LEN) && + ntohl(get_u_int32_t(packet->payload, 5)) <= CASSANDRA_MAX_BODY_SIZE && + ntohl(get_u_int32_t(packet->payload, 5)) >= (uint32_t) (packet->payload_packet_len - CASSANDRA_HEADER_LEN) && flow->l4.tcp.h323_valid_packets == 0 /* To avoid clashing with H323 */ && flow->socks4_stage == 0 /* To avoid clashing with SOCKS */) { - NDPI_LOG_INFO(ndpi_struct, "found Cassandra\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CASSANDRA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); + if (flow->packet_counter > 3) + { + NDPI_LOG_INFO(ndpi_struct, "found Cassandra\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CASSANDRA, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); + } return; } } |