diff options
| author | Luca Deri <deri@ntop.org> | 2020-05-06 01:34:55 +0200 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2020-05-06 01:34:55 +0200 |
| commit | 48282369e244afb91f4d322b3a9091ffec52af81 (patch) | |
| tree | 36eaeae91eae06800e2c958d21ffa4c9abd17636 /src/lib/protocols | |
| parent | 7d63149ced191d1d646404a844c5ffd2d55dea14 (diff) | |
False positive fixes
Diffstat (limited to 'src/lib/protocols')
| -rw-r--r-- | src/lib/protocols/h323.c | 8 | ||||
| -rw-r--r-- | src/lib/protocols/mssql_tds.c | 7 |
2 files changed, 12 insertions, 3 deletions
diff --git a/src/lib/protocols/h323.c b/src/lib/protocols/h323.c index 70e5a33c0..21ab1c472 100644 --- a/src/lib/protocols/h323.c +++ b/src/lib/protocols/h323.c @@ -25,7 +25,11 @@ void ndpi_search_h323(struct ndpi_detection_module_struct *ndpi_struct, struct n NDPI_LOG_DBG(ndpi_struct, "search H323\n"); - if(packet->tcp != NULL) { + /* + The TPKT protocol is used by ISO 8072 (on port 102) + and H.323. So this check below is to avoid ambiguities + */ + if((packet->tcp != NULL) && (packet->tcp->dest != ntohs(102))) { NDPI_LOG_DBG2(ndpi_struct, "calculated dport over tcp\n"); /* H323 */ @@ -62,7 +66,7 @@ void ndpi_search_h323(struct ndpi_detection_module_struct *ndpi_struct, struct n NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; } - } + } } else if(packet->udp != NULL) { sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest); NDPI_LOG_DBG2(ndpi_struct, "calculated dport over udp\n"); diff --git a/src/lib/protocols/mssql_tds.c b/src/lib/protocols/mssql_tds.c index 8e6b40c5b..06da37515 100644 --- a/src/lib/protocols/mssql_tds.c +++ b/src/lib/protocols/mssql_tds.c @@ -51,7 +51,12 @@ void ndpi_search_mssql_tds(struct ndpi_detection_module_struct *ndpi_struct, str NDPI_LOG_DBG(ndpi_struct, "search mssql_tds\n"); - if(packet->payload_packet_len < sizeof(struct tds_packet_header)) { + if((packet->payload_packet_len < sizeof(struct tds_packet_header)) + /* + The TPKT protocol used by ISO 8072 (on port 102) is similar + to this potocol and it can cause false positives + */ + || (packet->tcp->dest == ntohs(102))) { NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; } |