Fixed MySQL dissector

SSL dissector now reports the protocol version
Fixed bug in ndpiReader that ivalidates in some cases the protocl dissection and used to slow down the dissection

1 files changed, 27 insertions, 24 deletions

diff --git a/src/lib/protocols/mysql.c b/src/lib/protocols/mysql.c
index d1602a2fe..83a5bf8ed 100644
--- a/src/lib/protocols/mysql.c
+++ b/src/lib/protocols/mysql.c
@@ -29,42 +29,45 @@
 
 #include "ndpi_api.h"
 
-
-static void ndpi_int_mysql_add_connection(struct ndpi_detection_module_struct
-					  *ndpi_struct, struct ndpi_flow_struct *flow)
-{
-  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MYSQL, NDPI_PROTOCOL_UNKNOWN);
-}
-
-void ndpi_search_mysql_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+void ndpi_search_mysql_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
 
   NDPI_LOG_DBG(ndpi_struct, "search MySQL\n");
 	
   if(packet->tcp) {
-    if (packet->payload_packet_len > 38	//min length
-	&& get_u_int16_t(packet->payload, 0) == packet->payload_packet_len - 4	//first 3 bytes are length
-	&& get_u_int8_t(packet->payload, 2) == 0x00	//3rd byte of packet length
-	&& get_u_int8_t(packet->payload, 3) == 0x00	//packet sequence number is 0 for startup packet
-	&& get_u_int8_t(packet->payload, 5) > 0x30	//server version > 0
-	&& get_u_int8_t(packet->payload, 5) < 0x37	//server version < 7
-	&& get_u_int8_t(packet->payload, 6) == 0x2e	//dot
-	) {
+    if(packet->payload_packet_len > 38	//min length
+       && get_u_int16_t(packet->payload, 0) == packet->payload_packet_len - 4	//first 3 bytes are length
+       && get_u_int8_t(packet->payload, 2) == 0x00	//3rd byte of packet length
+       && get_u_int8_t(packet->payload, 3) == 0x00	//packet sequence number is 0 for startup packet
+       && get_u_int8_t(packet->payload, 5) > 0x30	//server version > 0
+       && get_u_int8_t(packet->payload, 5) < 0x37	//server version < 7
+       && get_u_int8_t(packet->payload, 6) == 0x2e	//dot
+       ) {
+#if 0
+      /* Old code */
       u_int32_t a;
-      for (a = 7; a + 31 < packet->payload_packet_len; a++) {
-	if (packet->payload[a] == 0x00) {
-	  if (get_u_int8_t(packet->payload, a + 13) == 0x00	//filler byte
-	      && get_u_int64_t(packet->payload, a + 19) == 0x0ULL	//13 more
-	      && get_u_int32_t(packet->payload, a + 27) == 0x0	//filler bytes
-	      && get_u_int8_t(packet->payload, a + 31) == 0x0) {
+      
+      for(a = 7; a + 31 < packet->payload_packet_len; a++) {
+	if(packet->payload[a] == 0x00) {
+	  if(get_u_int8_t(packet->payload, a + 13) == 0x00	 // filler byte
+	     && get_u_int64_t(packet->payload, a + 19) == 0x0ULL // 13 more
+	     && get_u_int32_t(packet->payload, a + 27) == 0x0	 // filler bytes
+	     && get_u_int8_t(packet->payload, a + 31) == 0x0) {
 	    NDPI_LOG_INFO(ndpi_struct, "found MySQL\n");
-	    ndpi_int_mysql_add_connection(ndpi_struct, flow);
+	    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MYSQL, NDPI_PROTOCOL_UNKNOWN);
 	    return;
 	  }
+	  
 	  break;
 	}
       }
+#else
+      if(strncmp(&packet->payload[packet->payload_packet_len-22], "mysql_", 6) == 0) {
+	NDPI_LOG_INFO(ndpi_struct, "found MySQL\n");
+	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MYSQL,  NDPI_PROTOCOL_UNKNOWN);
+	return;
+      }
+#endif
     }
   }