diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2023-02-13 11:31:52 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-02-13 11:31:52 +0100 |
| commit | 200d1d4cfcb9e8c02e91834481ffc716e796cfc3 (patch) | |
| tree | aec66564caf5dd9bb3a991013454a7ed4e9aec0a /src | |
| parent | a3a9a72f31401b83a264e64cc2f2190dffdfb380 (diff) | |
Fix detection of packet direction and NDPI_UNIDIRECTIONAL_TRAFFIC risk (#1883)
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/ndpi_main.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index d3037bb76..e32f9dce8 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -5448,7 +5448,8 @@ void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_str, else if(flags == (TH_FIN | TH_PUSH | TH_URG)) ndpi_set_risk(ndpi_str, flow, NDPI_TCP_ISSUES, "TCP XMAS scan"); - if(!ndpi_str->direction_detect_disable) + if(!ndpi_str->direction_detect_disable && + (tcph->source != tcph->dest)) packet->packet_direction = (ntohs(tcph->source) < ntohs(tcph->dest)) ? 1 : 0; if(packet->packet_direction == 0 /* cli -> srv */) { @@ -5525,7 +5526,8 @@ void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_str, flow->next_tcp_seq_nr[1] = 0; } } else if(udph != NULL) { - if(!ndpi_str->direction_detect_disable) + if(!ndpi_str->direction_detect_disable && + (udph->source != udph->dest)) packet->packet_direction = (htons(udph->source) < htons(udph->dest)) ? 1 : 0; } @@ -5618,9 +5620,9 @@ void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_str, if(ndpi_is_multi_or_broadcast(packet)) ; /* multicast or broadcast */ else { - if(flow->packet_direction_complete_counter[0] == 0) + if(flow->packet_direction_complete_counter[flow->client_packet_direction] == 0) ndpi_set_risk(ndpi_str, flow, NDPI_UNIDIRECTIONAL_TRAFFIC, "No client to server traffic"); /* Should never happen */ - else if(flow->packet_direction_complete_counter[1] == 0) + else if(flow->packet_direction_complete_counter[!flow->client_packet_direction] == 0) ndpi_set_risk(ndpi_str, flow, NDPI_UNIDIRECTIONAL_TRAFFIC, "No server to client traffic"); else { ndpi_unset_risk(ndpi_str, flow, NDPI_UNIDIRECTIONAL_TRAFFIC); /* Clear bit */ |