Added memory check in patricia tree

Improved AFP dissection
Updated DHCP test results

1 files changed, 41 insertions, 29 deletions

diff --git a/src/lib/protocols/afp.c b/src/lib/protocols/afp.c
index 74b98b8d0..1a5914fc9 100644
--- a/src/lib/protocols/afp.c
+++ b/src/lib/protocols/afp.c
@@ -2,7 +2,7 @@
  * afp.c
  *
  * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2011-16 - ntop.org
  *
  * This file is part of nDPI, an open source deep packet inspection
  * library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -27,6 +27,12 @@
 
 #ifdef NDPI_PROTOCOL_AFP
 
+struct afpHeader {
+  u_int8_t flags, command;
+  u_int16_t requestId;
+  u_int32_t dataOffset, length, reserved;
+};
+
 static void ndpi_int_afp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AFP, NDPI_PROTOCOL_UNKNOWN);
@@ -36,36 +42,42 @@ static void ndpi_int_afp_add_connection(struct ndpi_detection_module_struct *ndp
 void ndpi_search_afp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
-  //  struct ndpi_id_struct *src = flow->src;
-  //  struct ndpi_id_struct *dst = flow->dst;
-  
-  /*
-   * this will detect the OpenSession command of the Data Stream Interface (DSI) protocol
-   * which is exclusively used by the Apple Filing Protocol (AFP) on TCP/IP networks
-   */
-  if (packet->payload_packet_len >= 22 && get_u_int16_t(packet->payload, 0) == htons(0x0004) &&
-      get_u_int16_t(packet->payload, 2) == htons(0x0001) && get_u_int32_t(packet->payload, 4) == 0 &&
-      get_u_int32_t(packet->payload, 8) == htonl(packet->payload_packet_len - 16) &&
-      get_u_int32_t(packet->payload, 12) == 0 && get_u_int16_t(packet->payload, 16) == htons(0x0104)) {
-
-    NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP: DSI OpenSession detected.\n");
-    ndpi_int_afp_add_connection(ndpi_struct, flow);
-    return;
-  }
 
-  /*
-   * detection of GetStatus command of DSI protocol
-   */
-  if (packet->payload_packet_len >= 18 && get_u_int16_t(packet->payload, 0) == htons(0x0003) &&
-      get_u_int16_t(packet->payload, 2) == htons(0x0001) && get_u_int32_t(packet->payload, 4) == 0 &&
-      get_u_int32_t(packet->payload, 8) == htonl(packet->payload_packet_len - 16) &&
-      get_u_int32_t(packet->payload, 12) == 0 && get_u_int16_t(packet->payload, 16) == htons(0x0f00)) {
-
-    NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP: DSI GetStatus detected.\n");
-    ndpi_int_afp_add_connection(ndpi_struct, flow);
-    return;
-  }
+  if (packet->payload_packet_len >= sizeof(struct afpHeader)) {
+    struct afpHeader *h = (struct afpHeader*)packet->payload;
+
+    if(packet->payload_packet_len > 128) {
+      /*
+	When we transfer a large data chunk, unless we have observed
+	the initial connection, we need to discard these packets
+	as they are not an indication that this flow is not AFP	
+      */
+      return;
+    }
 
+    /*
+     * this will detect the OpenSession command of the Data Stream Interface (DSI) protocol
+     * which is exclusively used by the Apple Filing Protocol (AFP) on TCP/IP networks
+     */
+    if (packet->payload_packet_len >= 22 && get_u_int16_t(packet->payload, 0) == htons(0x0004) &&
+	get_u_int16_t(packet->payload, 2) == htons(0x0001) && get_u_int32_t(packet->payload, 4) == 0 &&
+	get_u_int32_t(packet->payload, 8) == htonl(packet->payload_packet_len - 16) &&
+	get_u_int32_t(packet->payload, 12) == 0 && get_u_int16_t(packet->payload, 16) == htons(0x0104)) {
+
+      NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP: DSI OpenSession detected.\n");
+      ndpi_int_afp_add_connection(ndpi_struct, flow);
+      return;
+    }
+
+    if((h->flags <= 1)
+       && ((h->command >= 1) && (h->command <= 8))
+       && (h->reserved == 0)
+       && (packet->payload_packet_len >= (sizeof(struct afpHeader)+ntohl(h->length)))) {
+      NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP: DSI detected.\n");
+      ndpi_int_afp_add_connection(ndpi_struct, flow);
+      return;
+    }
+  }
 
   NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP excluded.\n");
   NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_AFP);