diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2022-07-30 22:57:20 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-07-30 22:57:20 +0200 |
| commit | 2a596c79e6df7f78dea6ee3b581b4ed99d48bd7b (patch) | |
| tree | 9479d3fa6c0be8761f091a57b11fe323ab02b2c8 /src | |
| parent | 8b6a00f84bff9c998643d823502ae9f924fce528 (diff) | |
HTTP: fix classification (#1692)
If we have a valid HTTP sessions, we should ignore
`flow->guessed_protocol_id` field (i.e. classification "by-port")
altogheter.
The attached trace was classified as "SIP/HTTP" only because the *client*
port was 5060...
As a general rule, having a classification such as "XXXX/HTTP" is
*extremely* suspicious.
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/http.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index 6e2cf924b..48a80dd9a 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -759,9 +759,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ if(flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN) { /* Avoid putting as subprotocol a "core" protocol such as SSL or DNS */ if(ndpi_struct->proto_defaults[flow->guessed_protocol_id].subprotocol_count == 0) { - flow->detected_protocol_stack[1] = flow->guessed_protocol_id; - if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) + if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; + flow->detected_protocol_stack[1] = flow->guessed_protocol_id; + } } } else { |