Improved packet datastructure cleanup after packet processing

Cleaned up code of steam dissector
Added steam test pcap

2 files changed, 83 insertions, 72 deletions

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index df40c5769..418ceaf2e 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -4460,6 +4460,44 @@ void ndpi_fill_protocol_category(struct ndpi_detection_module_struct *ndpi_struc
 
 /* ********************************************************************************* */
 
+static void ndpi_reset_packet_line_info(struct ndpi_packet_struct *packet) {
+  packet->parsed_lines = 0,
+  packet->empty_line_position_set = 0,
+  packet->host_line.ptr = NULL,
+  packet->host_line.len = 0,
+  packet->referer_line.ptr = NULL,
+  packet->referer_line.len = 0,
+  packet->content_line.ptr = NULL,
+  packet->content_line.len = 0,
+  packet->accept_line.ptr = NULL,
+  packet->accept_line.len = 0,
+  packet->user_agent_line.ptr = NULL,
+  packet->user_agent_line.len = 0,
+  packet->http_url_name.ptr = NULL,
+  packet->http_url_name.len = 0,
+  packet->http_encoding.ptr = NULL,
+  packet->http_encoding.len = 0,
+  packet->http_transfer_encoding.ptr = NULL,
+  packet->http_transfer_encoding.len = 0,
+  packet->http_contentlen.ptr = NULL,
+  packet->http_contentlen.len = 0,
+  packet->http_cookie.ptr = NULL,
+  packet->http_cookie.len = 0,
+  packet->http_origin.len = 0,
+  packet->http_origin.ptr = NULL,
+  packet->http_x_session_type.ptr = NULL,
+  packet->http_x_session_type.len = 0,
+  packet->server_line.ptr = NULL,
+  packet->server_line.len = 0,
+  packet->http_method.ptr = NULL,
+  packet->http_method.len = 0,
+  packet->http_response.ptr = NULL,
+  packet->http_response.len = 0,
+  packet->http_num_headers = 0;
+}
+
+/* ********************************************************************************* */
+
 ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct *ndpi_struct,
 					    struct ndpi_flow_struct *flow,
 					    const unsigned char *packet,
@@ -4701,8 +4739,9 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
      Invalidate packet memory to avoid accessing the pointers below
      when the packet is no longer accessible
   */
-  flow->packet.iph = NULL, flow->packet.tcp = NULL, flow->packet.udp = NULL;
-
+  flow->packet.iph = NULL, flow->packet.tcp = NULL, flow->packet.udp = NULL, flow->packet.payload = NULL;
+  ndpi_reset_packet_line_info(&flow->packet);
+  
   return(ret);
 }
 
@@ -4864,40 +4903,8 @@ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struc
     return;
 
   packet->packet_lines_parsed_complete = 1;
-  packet->parsed_lines = 0;
-  packet->empty_line_position_set = 0;
-  packet->host_line.ptr = NULL;
-  packet->host_line.len = 0;
-  packet->referer_line.ptr = NULL;
-  packet->referer_line.len = 0;
-  packet->content_line.ptr = NULL;
-  packet->content_line.len = 0;
-  packet->accept_line.ptr = NULL;
-  packet->accept_line.len = 0;
-  packet->user_agent_line.ptr = NULL;
-  packet->user_agent_line.len = 0;
-  packet->http_url_name.ptr = NULL;
-  packet->http_url_name.len = 0;
-  packet->http_encoding.ptr = NULL;
-  packet->http_encoding.len = 0;
-  packet->http_transfer_encoding.ptr = NULL;
-  packet->http_transfer_encoding.len = 0;
-  packet->http_contentlen.ptr = NULL;
-  packet->http_contentlen.len = 0;
-  packet->http_cookie.ptr = NULL;
-  packet->http_cookie.len = 0;
-  packet->http_origin.len = 0;
-  packet->http_origin.ptr = NULL;
-  packet->http_x_session_type.ptr = NULL;
-  packet->http_x_session_type.len = 0;
-  packet->server_line.ptr = NULL;
-  packet->server_line.len = 0;
-  packet->http_method.ptr = NULL;
-  packet->http_method.len = 0;
-  packet->http_response.ptr = NULL;
-  packet->http_response.len = 0;
-  packet->http_num_headers=0;
-
+  ndpi_reset_packet_line_info(packet);
+  
   if((packet->payload_packet_len < 3)
      || (packet->payload == NULL))
     return;
diff --git a/src/lib/protocols/steam.c b/src/lib/protocols/steam.c
index 0a737baf9..6e1034aee 100644
--- a/src/lib/protocols/steam.c
+++ b/src/lib/protocols/steam.c
@@ -1,6 +1,7 @@
 /*
  * steam.c
  *
+ * Copyright (C) 2011-19 - ntop.org
  * Copyright (C) 2014 Tomasz Bujlow <tomasz@skatnet.dk>
  * 
  * The signature is mostly based on the Libprotoident library
@@ -242,52 +243,55 @@ static void ndpi_check_steam_udp3(struct ndpi_detection_module_struct *ndpi_stru
 void ndpi_search_steam(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
 	
-  /* Break after 20 packets. */
-  if (flow->packet_counter > 20) {
-    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    return;
-  }
-
-  /* skip marked or retransmitted packets */
-  if (packet->tcp_retransmission != 0) {
-    return;
-  }
-
-  if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) {
-    return;
-  }
-
-  NDPI_LOG_DBG(ndpi_struct, "search STEAM\n");
-  ndpi_check_steam_http(ndpi_struct, flow);
+  if(flow->packet.udp != NULL) {
+    if(flow->packet_counter > 5) {
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+      return;
+    }
+    
+    ndpi_check_steam_udp1(ndpi_struct, flow);
 	
-  if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) {
-    return;
-  }
-
-  ndpi_check_steam_tcp(ndpi_struct, flow);
+    if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM)
+      return;   
 	
-  if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) {
-    return;
-  }
+    ndpi_check_steam_udp2(ndpi_struct, flow);
 	
-  ndpi_check_steam_udp1(ndpi_struct, flow);
+    if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM)
+      return;   
 	
-  if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) {
-    return;
-  }
+    ndpi_check_steam_udp3(ndpi_struct, flow);
+  } else {
+    /* Break after 10 packets. */
+    if(flow->packet_counter > 10) {
+      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
+      return;
+    }
+
+
+    /* skip marked or retransmitted packets */
+    if(packet->tcp_retransmission != 0) {
+      return;
+    }
+
+    if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM)
+      return;   
+
+    NDPI_LOG_DBG(ndpi_struct, "search STEAM\n");
+    ndpi_check_steam_http(ndpi_struct, flow);
 	
-  ndpi_check_steam_udp2(ndpi_struct, flow);
+    if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM)
+      return;   
+
+    ndpi_check_steam_tcp(ndpi_struct, flow);
 	
-  if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) {
-    return;
+    if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM)
+      return;   
   }
-	
-  ndpi_check_steam_udp3(ndpi_struct, flow);
 }
 
 
-void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
-{
+void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct,
+			  u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) {
   ndpi_set_bitmask_protocol_detection("Steam", ndpi_struct, detection_bitmask, *id,
 				      NDPI_PROTOCOL_STEAM,
 				      ndpi_search_steam,