diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2021-11-15 16:20:57 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-11-15 16:20:57 +0100 |
| commit | afc2b641eb9cf5035b5147e78030bafe0b40dd87 (patch) | |
| tree | 99cf853d219ae6004819d2564f4cabd29c487cf6 /src/lib/protocols/imo.c | |
| parent | da47357762746c7fc5c537b575b5b56f252320a5 (diff) | |
Fix writes to `flow->protos` union fields (#1354)
We can write to `flow->protos` only after a proper classification.
This issue has been found in Kerberos, DHCP, HTTP, STUN, IMO, FTP,
SMTP, IMAP and POP code.
There are two kinds of fixes:
* write to `flow->protos` only if a final protocol has been detected
* move protocol state out of `flow->protos`
The hard part is to find, for each protocol, the right tradeoff between
memory usage and code complexity.
Handle Kerberos like DNS: if we find a request, we set the protocol
and an extra callback to further parsing the reply.
For all the other protocols, move the state out of `flow->protos`. This
is an issue only for the FTP/MAIL stuff.
Add DHCP Class Identification value to the output of ndpiReader and to
the Jason serialization.
Extend code coverage of fuzz tests.
Close #1343
Close #1342
Diffstat (limited to 'src/lib/protocols/imo.c')
| -rw-r--r-- | src/lib/protocols/imo.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/src/lib/protocols/imo.c b/src/lib/protocols/imo.c index 2784e7143..fab99d301 100644 --- a/src/lib/protocols/imo.c +++ b/src/lib/protocols/imo.c @@ -39,11 +39,11 @@ void ndpi_search_imo(struct ndpi_detection_module_struct *ndpi_struct, struct nd if(packet->payload_packet_len == 1) { /* Two one byte consecutive packets with the same payload */ - if((flow->protos.imo.last_one_byte_pkt == 1) - && (flow->protos.imo.last_byte == packet->payload[0])) + if((flow->l4.udp.imo_last_one_byte_pkt == 1) + && (flow->l4.udp.imo_last_byte == packet->payload[0])) ndpi_int_imo_add_connection(ndpi_struct, flow); else - flow->protos.imo.last_one_byte_pkt = 1, flow->protos.imo.last_byte = packet->payload[0]; + flow->l4.udp.imo_last_one_byte_pkt = 1, flow->l4.udp.imo_last_byte = packet->payload[0]; } else if(((packet->payload_packet_len == 10) && (packet->payload[0] == 0x09) && (packet->payload[1] == 0x02)) @@ -62,7 +62,7 @@ void ndpi_search_imo(struct ndpi_detection_module_struct *ndpi_struct, struct nd if(flow->num_processed_pkts > 5) NDPI_EXCLUDE_PROTO(ndpi_struct, flow); else - flow->protos.imo.last_one_byte_pkt = 0; + flow->l4.udp.imo_last_one_byte_pkt = 0; } } |