diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2025-05-21 16:43:50 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-05-21 16:43:50 +0200 |
| commit | 2c9ed8faaa12179897c3bbe713f0f72b56d4bba3 (patch) | |
| tree | 58dd7065f8e3cb5b8432c466997235dbb051163f /src/lib/protocols/non_tcp_udp.c | |
| parent | ed29a8f9633933db7be173d9d944e2bc5e2cae01 (diff) | |
ospf, ipsec: use different ids for protocols at layer3 (#2838)
Don't use the same id for the same protocol identified via L3 info or
via standard TCP/UDP detection (example: ospf ip_proto 0x59 or TCP port
2604)
Before:
```
ivan@ivan-Precision-3591:~/svnrepos/nDPI(dev)$ ./example/ndpiReader -H | grep -wE 'OSPF|IPSec|AH|ESP|IP_OSPF'
79 79 IPSec UDP X Safe VPN 500,4500 500
85 85 OSPF X Acceptable Network - 2604
```
After:
```
ivan@ivan-Precision-3591:~/svnrepos/nDPI(ospf-ipsec)$ ./example/ndpiReader -H | grep -wE 'OSPF|IPSec|AH|ESP|IP_OSPF'
79 79 IPSec UDP X Safe VPN 500,4500 500
85 85 IP_OSPF X Acceptable Network - -
116 116 AH X Safe VPN - -
117 117 ESP X Safe VPN - -
184 184 OSPF TCP X Safe Network - 2604
```
Diffstat (limited to 'src/lib/protocols/non_tcp_udp.c')
| -rw-r--r-- | src/lib/protocols/non_tcp_udp.c | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/src/lib/protocols/non_tcp_udp.c b/src/lib/protocols/non_tcp_udp.c index a2f8b518e..d20efdfa9 100644 --- a/src/lib/protocols/non_tcp_udp.c +++ b/src/lib/protocols/non_tcp_udp.c @@ -45,8 +45,11 @@ static void ndpi_search_in_non_tcp_udp(struct ndpi_detection_module_struct switch (flow->l4_proto) { case NDPI_IPSEC_PROTOCOL_ESP: + set_protocol_and_bmask(NDPI_PROTOCOL_IP_ESP); + break; + case NDPI_IPSEC_PROTOCOL_AH: - set_protocol_and_bmask(NDPI_PROTOCOL_IPSEC); + set_protocol_and_bmask(NDPI_PROTOCOL_IP_AH); break; case NDPI_GRE_PROTOCOL_TYPE: @@ -163,13 +166,20 @@ void init_non_tcp_udp_dissector(struct ndpi_detection_module_struct *ndpi_struct /* always add non tcp/udp if one protocol is compiled in */ NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[ndpi_struct->callback_buffer_num].detection_bitmask, NDPI_PROTOCOL_UNKNOWN); - ndpi_set_bitmask_protocol_detection("IPSec", ndpi_struct, - NDPI_PROTOCOL_IPSEC, + ndpi_set_bitmask_protocol_detection("AH", ndpi_struct, + NDPI_PROTOCOL_IP_AH, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); + ndpi_set_bitmask_protocol_detection("ESP", ndpi_struct, + NDPI_PROTOCOL_IP_ESP, + ndpi_search_in_non_tcp_udp, + NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, + NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, + ADD_TO_DETECTION_BITMASK); + ndpi_set_bitmask_protocol_detection("IP_GRE", ndpi_struct, NDPI_PROTOCOL_IP_GRE, ndpi_search_in_non_tcp_udp, |