diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2023-05-10 21:00:27 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-05-10 21:00:27 +0200 |
| commit | 8c224b464f36da0497c9ef7c2fe2ec3c135a01ba (patch) | |
| tree | fb621c9606b51904aa7f8c71f1603dba83ac41a5 /src | |
| parent | 596a5fd5dc4ec1040adaa242907c12ccd52c78b8 (diff) | |
Fix MS Teams detection with heuristic (#1972)
When we reconcile a TLS session to Teams, we need to keep TLs as master.
This way:
* we keep exporting all the TLS metadata
* we avoid some memory leaks (of these metadata themeselves)
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/ndpi_main.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index e07daf3ff..0c9e2eca9 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -5983,9 +5983,12 @@ static u_int32_t make_msteams_key(struct ndpi_flow_struct *flow, u_int8_t use_cl static void ndpi_reconcile_msteams_udp(struct ndpi_detection_module_struct *ndpi_str, struct ndpi_flow_struct *flow) { - if((flow->l4_proto == IPPROTO_UDP) && (ndpi_str->packet.udp != NULL)) { - u_int16_t sport = ntohs(ndpi_str->packet.udp->source); - u_int16_t dport = ntohs(ndpi_str->packet.udp->dest); + + /* This function can NOT access &ndpi_str->packet since it is called also from ndpi_detection_giveup(), via ndpi_reconcile_protocols() */ + + if(flow->l4_proto == IPPROTO_UDP) { + u_int16_t sport = ntohs(flow->c_port); + u_int16_t dport = ntohs(flow->s_port); u_int8_t s_match = ((sport >= 3478) && (sport <= 3481)) ? 1 : 0; u_int8_t d_match = ((dport >= 3478) && (dport <= 3481)) ? 1 : 0; @@ -6080,7 +6083,7 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s &dummy, 0 /* Don't remove it as it can be used for other connections */, ndpi_get_current_time(flow))) { ndpi_int_change_protocol(ndpi_str, flow, - NDPI_PROTOCOL_SKYPE_TEAMS, flow->detected_protocol_stack[1], + NDPI_PROTOCOL_SKYPE_TEAMS, NDPI_PROTOCOL_TLS, NDPI_CONFIDENCE_DPI_PARTIAL); } } |