diff options
| author | Luca Deri <deri@ntop.org> | 2019-06-05 23:15:06 +0200 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2019-06-05 23:15:06 +0200 |
| commit | 4e8055742e8ff826e01587aebb1bea3458268049 (patch) | |
| tree | 96c69c0894dd4c2dbd4928f45469d60e36c21001 /src | |
| parent | c43bec826d086e5c0b4caccd9e542da6f5586101 (diff) | |
Added fix for discarding core protocols as subprotocols
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/protocols/http.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index e715dd499..de2bb032e 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -321,14 +321,17 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ /** check result of host subprotocol detection - + if "detected" in flow == 0 then "detected" = "guess" else "guess" = "detected" **/ - if(flow->detected_protocol_stack[1] == 0) { - flow->detected_protocol_stack[1] = flow->guessed_protocol_id; - if(flow->detected_protocol_stack[0] == 0) - flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; + if(flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN) { + /* Avoid putting as subprotocol a "core" protocol such as SSL or DNS */ + if(ndpi_struct->proto_defaults[flow->guessed_protocol_id].can_have_a_subprotocol == 0) { + flow->detected_protocol_stack[1] = flow->guessed_protocol_id; + if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) + flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; + } } else { if(flow->detected_protocol_stack[1] != flow->guessed_protocol_id) @@ -336,7 +339,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_ if(flow->detected_protocol_stack[0] != flow->guessed_host_protocol_id) flow->guessed_host_protocol_id = flow->detected_protocol_stack[0]; } - + if((flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) && ((ndpi_struct->http_dont_dissect_response) || flow->http_detected) && (packet->http_origin.len > 0)) { |