diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2023-11-29 16:55:39 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-11-29 16:55:39 +0100 |
| commit | ac90b1f00910a33d9104d0470429bb8244a49cc9 (patch) | |
| tree | 653e018d2e6c0d0864c87754f5267cb566deb730 /src/lib | |
| parent | 5fb631c8feb91e04d70fe8123ea5143ad6f28f90 (diff) | |
Fix detection of `NDPI_TCP_ISSUES` flow risk (#2177)
We need to take into account retransmissions: they increase
`flow->all_packets_counter` counter but not `flows->packet_counter`
one.
Therefore, the right way to check for 3WH + RST pattern involves checking
for `flows->packet_counter == 0`
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/ndpi_main.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index f3786a719..a96c9463b 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -7107,12 +7107,12 @@ static void ndpi_check_tcp_flags(struct ndpi_detection_module_struct *ndpi_str, if((flow->l4.tcp.cli2srv_tcp_flags & TH_SYN) && (flow->l4.tcp.srv2cli_tcp_flags & TH_RST) - && (flow->all_packets_counter < 5 /* Ignore connections terminated by RST but that exchanged data (3WH + RST) */) + && (flow->packet_counter == 0 /* Ignore connections terminated by RST but that exchanged data (3WH + RST) */) ) ndpi_set_risk(ndpi_str, flow, NDPI_TCP_ISSUES, "Connection refused (server)"); else if((flow->l4.tcp.cli2srv_tcp_flags & TH_SYN) && (flow->l4.tcp.cli2srv_tcp_flags & TH_RST) - && (flow->all_packets_counter < 5 /* Ignore connections terminated by RST but that exchanged data (3WH + RST) */) + && (flow->packet_counter == 0 /* Ignore connections terminated by RST but that exchanged data (3WH + RST) */) ) ndpi_set_risk(ndpi_str, flow, NDPI_TCP_ISSUES, "Connection refused (client)"); else if((flow->l4.tcp.srv2cli_tcp_flags & TH_RST) && (flow->packet_direction_complete_counter[1 /* server -> client */] == 1)) |