Fix for #400

1 files changed, 20 insertions, 3 deletions

diff --git a/src/lib/protocols/whatsapp.c b/src/lib/protocols/whatsapp.c
index 6a98eac6b..6964a8e0e 100644
--- a/src/lib/protocols/whatsapp.c
+++ b/src/lib/protocols/whatsapp.c
@@ -33,12 +33,30 @@ void ndpi_search_whatsapp(struct ndpi_detection_module_struct *ndpi_struct,
 
   NDPI_LOG_DBG(ndpi_struct, "search WhatsApp\n");
 
+  if(flow->l4.tcp.wa_matched_so_far == 0) {
+    if(memcmp(packet->payload, whatsapp_sequence, packet->payload_packet_len)) {
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    } else
+      flow->l4.tcp.wa_matched_so_far = packet->payload_packet_len;
+
+    return;
+  } else {
+    if(memcmp(packet->payload, &whatsapp_sequence[flow->l4.tcp.wa_matched_so_far],
+	      sizeof(whatsapp_sequence)-flow->l4.tcp.wa_matched_so_far))
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+    else
+      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN);
+
+    return;
+  }
+
   if((packet->payload_packet_len > 240)
      && (memcmp(packet->payload, whatsapp_sequence, sizeof(whatsapp_sequence)) == 0)) {
     NDPI_LOG_INFO(ndpi_struct, "found WhatsApp\n");
     ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN);
-  } else 
-    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);  
+  }
+
+  NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
 }
 
 
@@ -53,4 +71,3 @@ void init_whatsapp_dissector(struct ndpi_detection_module_struct *ndpi_struct,
 				      ADD_TO_DETECTION_BITMASK);
   *id += 1;
 }
-