diff options
| author | Luca Deri <lucaderi@users.noreply.github.com> | 2020-09-02 12:32:48 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-09-02 12:32:48 +0200 |
| commit | 3cca5af8c3ce3308917279b32af18868e742d78b (patch) | |
| tree | 8e72d5a7f60523fb7034e1e95651387e289e53f9 /src | |
| parent | 5d2551ff3e8544cc76e9b6a2747b95db8c7f97d5 (diff) | |
| parent | 7051acc0b5b8046b6415a454a2eff4fffa18396b (diff) | |
Merge pull request #1003 from lnslbrty/fix/fals-positive-cisco-hsrp-radius-detection
Fixed false positive detection for Skype.SkypeCall (affects at least Cisco HSRP and RADIUS).
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/kerberos.c | 2 | ||||
| -rw-r--r-- | src/lib/protocols/skype.c | 7 |
2 files changed, 5 insertions, 4 deletions
diff --git a/src/lib/protocols/kerberos.c b/src/lib/protocols/kerberos.c index 168586643..10c2b5a65 100644 --- a/src/lib/protocols/kerberos.c +++ b/src/lib/protocols/kerberos.c @@ -309,7 +309,7 @@ void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, printf("name_offset=%u [%02X %02X] [byte 0 must be 0x1b]\n", name_offset, packet->payload[name_offset], packet->payload[name_offset+1]); #endif - if(name_offset < (packet->payload_packet_len+1)) { + if(name_offset < (packet->payload_packet_len - 1)) { u_int realm_len; name_offset++; diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c index dfc3f274f..01d93bda7 100644 --- a/src/lib/protocols/skype.c +++ b/src/lib/protocols/skype.c @@ -64,13 +64,14 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s || (((packet->payload[0] & 0xF0) >> 4) == 0x07 /* Skype */) ) && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */ - && (packet->payload[0] != 0x0) /* Avoid invalid CAPWAP detection */ + && (packet->payload[0] != 0x00) /* Avoid invalid CAPWAP detection */ && (packet->payload[2] == 0x02))) { - if(is_port(sport, dport, 8801)) + if(is_port(sport, dport, 8801)) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZOOM, NDPI_PROTOCOL_UNKNOWN); - else + } else if (payload_len >= 16 && packet->payload[0] != 0x01) /* Avoid invalid Cisco HSRP detection / RADIUS */ { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE_CALL, NDPI_PROTOCOL_SKYPE); + } } } |