fix facebook detection in http dissector

2 files changed, 69 insertions, 73 deletions

diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 4e4d01ca2..039f38b56 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -780,6 +780,17 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
       packet->http_method.ptr = packet->line[0].ptr;
       packet->http_method.len = filename_start - 1;
 
+      /* Check for additional field introduced by Facebook */
+      int x = 1;
+      while(packet->line[x].len != 0) {
+	if((memcmp(packet->line[x].ptr, "X-FB-SIM-HNI", 12)) == 0) {
+	  ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_SERVICE_FACEBOOK);
+	  check_content_type_and_change_protocol(ndpi_struct, flow);
+	  return;
+	}
+	x++;
+      }
+    
       if((packet->http_url_name.len > 7)
           && (!strncmp((const char*) packet->http_url_name.ptr, "http://", 7))) {
         NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP_PROXY Found.\n");
@@ -814,26 +825,26 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct
 		   "HTTP START Found, we will look further for the response...\n");
 	  flow->l4.tcp.http_stage = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2
 	}
-
+	
 	check_content_type_and_change_protocol(ndpi_struct, flow);
-
+	
 	return;
       }
     }
-
+    
     NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: REQUEST NOT HTTP CONFORM\n");
     http_bitmask_exclude(flow);
   } else if((flow->l4.tcp.http_stage == 1) || (flow->l4.tcp.http_stage == 2)) {
     NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP stage %u: \n",
 	     flow->l4.tcp.http_stage);
-
+    
     /* At first check, if this is for sure a response packet (in another direction. If not, if http is detected do nothing now and return,
      * otherwise check the second packet for the http request . */
     if((flow->l4.tcp.http_stage - packet->packet_direction) == 1) {
-
+      
       if(flow->http_detected)
         return;
-
+      
       NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG,
 	       " SECOND PAYLOAD TRAFFIC FROM CLIENT, FIRST PACKET MIGHT HAVE BEEN HTTP...UNKNOWN TRAFFIC, HERE FOR HTTP again.. \n");
 
diff --git a/src/lib/protocols/mdns.c b/src/lib/protocols/mdns.c
index d4426e7f3..b3184c26f 100644
--- a/src/lib/protocols/mdns.c
+++ b/src/lib/protocols/mdns.c
@@ -1,8 +1,7 @@
 /*
  * mdns.c
  *
- * Copyright (C) 2009-2011 by ipoque GmbH
- * Copyright (C) 2011-15 - ntop.org
+ * Copyright (C) 2016 - ntop.org
  *
  * This file is part of nDPI, an open source deep packet inspection
  * library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -21,13 +20,31 @@
  * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
  * 
  */
-
-
 #include "ndpi_protocols.h"
 
 #ifdef NDPI_PROTOCOL_MDNS
 
-#define NDPI_MAX_MDNS_REQUESTS                        128
+#define NDPI_MAX_MDNS_REQUESTS  128
+
+
+/**
+   MDNS header is similar to dns header
+
+   0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
+   +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+   |                  ID = 0x0000                  |
+   +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+   |                     FLAGS                     |
+   +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+   |                    QDCOUNT                    |
+   +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+   |                    ANCOUNT                    |
+   +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+   |                    NSCOUNT                    |
+   +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+   |                    ARCOUNT                    |
+   +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
+*/
 
 
 static void ndpi_int_mdns_add_connection(struct ndpi_detection_module_struct
@@ -41,101 +58,69 @@ static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
 {
   struct ndpi_packet_struct *packet = &flow->packet;
 
-  if ((packet->payload[2] & 0x80) == 0 &&
-      ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
-      ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
-
+  if((packet->payload[2] & 0x80) == 0 &&
+     ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
+     ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
+    
     NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n");
-
     return 1;
-  } else if ((packet->payload[2] & 0x80) != 0 &&
-	     ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
-	     ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
-	     ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
+    
+  }
+  else if((packet->payload[2] & 0x80) != 0 &&
+	  ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
+	  ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
+	  ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
     NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with answer query.\n");
-
     return 1;
   }
-
+  
   return 0;
 }
 
 void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
 {
   struct ndpi_packet_struct *packet = &flow->packet;
-	
-  //      struct ndpi_id_struct         *src=ndpi_struct->src;
-  //      struct ndpi_id_struct         *dst=ndpi_struct->dst;
-
   u_int16_t dport;
-  //      const u_int16_t sport=ntohs(packet->udp->source);
-
-  /* check if UDP and */
-  if (packet->udp != NULL) {
-    /*read destination port */
+  
+  /**
+     information from http://www.it-administrator.de/lexikon/multicast-dns.html 
+  */
+  
+  /* check if UDP packet */
+  if(packet->udp != NULL) {
+    
+    /* read destination port */
     dport = ntohs(packet->udp->dest);
 
-    NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "MDNS udp start \n");
-
-
-
-    /*check standard MDNS to port 5353 */
-    /*took this information from http://www.it-administrator.de/lexikon/multicast-dns.html */
-
-    if (dport == 5353 && packet->payload_packet_len >= 12) {
-
-      NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with destination port 5353\n");
+    /* check standard MDNS ON port 5353 */
+    if(dport == 5353 && packet->payload_packet_len >= 12) {
 
-      /* MDNS header is similar to dns header */
-      /* dns header
-	 0  1  2  3  4  5  6  7  8  9  0  1  2  3  4  5
-	 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
-	 |                      ID                       |
-	 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
-	 |QR|   Opcode  |AA|TC|RD|RA|   Z    |   RCODE   |
-	 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
-	 |                    QDCOUNT                    |
-	 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
-	 |                    ANCOUNT                    |
-	 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
-	 |                    NSCOUNT                    |
-	 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
-	 |                    ARCOUNT                    |
-	 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
-	 *
-	 * dns query check: query: QR set, ancount = 0, nscount = 0, QDCOUNT < MAX_MDNS, ARCOUNT < MAX_MDNS
-	 *
-	 */
-
-      /* mdns protocol must have destination address  224.0.0.251 */
-      /* took this information from http://www.it-administrator.de/lexikon/multicast-dns.html */
-
-      if (packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
+      /* mdns protocol must have destination address 224.0.0.251 */
+      if(packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
 
 	NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
 		 NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
-
-	if (ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
+	
+	if(ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
 	  ndpi_int_mdns_add_connection(ndpi_struct, flow);
 	  return;
 	}
       }
 #ifdef NDPI_DETECTION_SUPPORT_IPV6
-      if (packet->iphv6 != NULL) {
+      if(packet->iphv6 != NULL) {
 	const u_int32_t *daddr = packet->iphv6->ip6_dst.u6_addr.u6_addr32;
-	if (daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
+	if(daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
 
 	  NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
 		   NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n");
-
-	  if (ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
+	  
+	  if(ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
 	    ndpi_int_mdns_add_connection(ndpi_struct, flow);
 	    return;
 	  }
 	}
       }
 #endif
-
     }
   }
   NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MDNS);