Fixes #485

3 files changed, 20 insertions, 12 deletions

diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 4a9ec63cf..1ee97381e 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -8434,7 +8434,7 @@ static const char *ndpi_en_bigrams[] = {
   "lz", "nz", "oz", "pz", "rz", "tz", "uz", "zz", NULL };
 
 static const char *ndpi_en_impossible_bigrams[] = {
-  "bk", "bq", "bx", "cb", "cf", "cg", "cj", "cp", "cv", "cw", "cx", "dx", "fk", "fq", "fv", "fx", "ee",
+  "bk", "bq", "bx", "cb", "cf", "cg", "cj", "cp", "cv", "cw", "cx", "dx", "fk", "fq", "fv", "fx", /* "ee", removed it can be found in 'meeting' */
   "fz", "gq", "gv", "gx", "hh", "hk", "hv", "hx", "hz", "iy", "jb", "jc", "jd", "jf", "jg", "jh", "jk",
   "jl", "jm", "jn", "jp", "jq", "jr", /* "js", */ "jt", "jv", "jw", "jx", "jy", "jz", "kg", "kq", "kv", "kx",
   "kz", "lq", "lx", "mg", "mj", "mq", "mx", "mz", "pq", "pv", "px", "qb", "qc", "qd", "qe", "qf", "ii",
diff --git a/src/lib/protocols/ssl.c b/src/lib/protocols/ssl.c
index 5afca5389..231bde1eb 100644
--- a/src/lib/protocols/ssl.c
+++ b/src/lib/protocols/ssl.c
@@ -641,7 +641,7 @@ void ndpi_search_ssl_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc
       return;
     } else if((packet->payload_packet_len == 4)
 	      && (packet->payload[0] == 'W')
-	      && (packet->payload[1] == 'A')){
+	      && (packet->payload[1] == 'A')) {
       ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN);
       return;
     } else {
diff --git a/src/lib/protocols/tor.c b/src/lib/protocols/tor.c
index f6987ef19..95233e471 100644
--- a/src/lib/protocols/tor.c
+++ b/src/lib/protocols/tor.c
@@ -16,14 +16,23 @@ static void ndpi_int_tor_add_connection(struct ndpi_detection_module_struct
 
 
 int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
-		    struct ndpi_flow_struct *flow, char *certificate) {
-  
+		    struct ndpi_flow_struct *flow, char *certificate) {  
   int prev_num = 0, numbers_found = 0, num_found = 0, i, len;
   char dummy[48], *dot, *name;
 
-  if((certificate == NULL)
-     || (strlen(certificate) < 6)
-     || (strncmp(certificate, "www.", 4)))
+  if(certificate == NULL)
+    return(0);
+  else
+    len = strlen(certificate);
+
+  /* Check if it ends in .com or .net */
+  if(strcmp(&certificate[len-4], ".com") && strcmp(&certificate[len-4], ".net"))
+    return(0);
+  
+  if((len < 6)
+     || (!strncmp(certificate, "*.", 2))  /* Wildcard certificate */
+     || (strncmp(certificate, "www.", 4)) /* Not starting with www.... */
+     )
     return(0);
 
   // printf("***** [SSL] %s(): %s\n", __FUNCTION__, certificate);
@@ -55,13 +64,12 @@ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
       } else
 	prev_num = 0;
 
-      if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->impossible_bigrams_automa, &name[i])) {
-	ndpi_int_tor_add_connection(ndpi_struct, flow);
-	return(1);
-      }
-
+      
       if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->bigrams_automa, &name[i])) {
 	num_found++;
+      } else if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->impossible_bigrams_automa, &name[i])) {
+	ndpi_int_tor_add_connection(ndpi_struct, flow);
+	return(1);
       }
     }