1 files changed, 29 insertions, 17 deletions

diff --git a/src/lib/protocols/tor.c b/src/lib/protocols/tor.c
index c9ab55542..21fc0cf52 100644
--- a/src/lib/protocols/tor.c
+++ b/src/lib/protocols/tor.c
@@ -5,10 +5,15 @@
  * Copyright (C) 2013 Remy Mudingay <mudingay@ill.fr>
  *
  */
-#include "ndpi_api.h"
+#include "ndpi_protocol_ids.h"
 
 #ifdef NDPI_PROTOCOL_TOR
 
+#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_TOR
+
+#include "ndpi_api.h"
+
+
 static void ndpi_int_tor_add_connection(struct ndpi_detection_module_struct
 					*ndpi_struct, struct ndpi_flow_struct *flow) {
   ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TOR, NDPI_PROTOCOL_UNKNOWN);
@@ -16,14 +21,23 @@ static void ndpi_int_tor_add_connection(struct ndpi_detection_module_struct
 
 
 int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
-		    struct ndpi_flow_struct *flow, char *certificate) {
-  
+		    struct ndpi_flow_struct *flow, char *certificate) {  
   int prev_num = 0, numbers_found = 0, num_found = 0, i, len;
   char dummy[48], *dot, *name;
 
-  if((certificate == NULL)
-     || (strlen(certificate) < 6)
-     || (strncmp(certificate, "www.", 4)))
+  if(certificate == NULL)
+    return(0);
+  else
+    len = strlen(certificate);
+
+  /* Check if it ends in .com or .net */
+  if(strcmp(&certificate[len-4], ".com") && strcmp(&certificate[len-4], ".net"))
+    return(0);
+  
+  if((len < 6)
+     || (!strncmp(certificate, "*.", 2))  /* Wildcard certificate */
+     || (strncmp(certificate, "www.", 4)) /* Not starting with www.... */
+     )
     return(0);
 
   // printf("***** [SSL] %s(): %s\n", __FUNCTION__, certificate);
@@ -55,13 +69,12 @@ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
       } else
 	prev_num = 0;
 
-      if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->impossible_bigrams_automa, &name[i])) {
-	ndpi_int_tor_add_connection(ndpi_struct, flow);
-	return(1);
-      }
-
+      
       if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->bigrams_automa, &name[i])) {
 	num_found++;
+      } else if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->impossible_bigrams_automa, &name[i])) {
+	ndpi_int_tor_add_connection(ndpi_struct, flow);
+	return(1);
       }
     }
 
@@ -69,7 +82,7 @@ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct,
       ndpi_int_tor_add_connection(ndpi_struct, flow);
       return(1);
     } else {
-#ifdef PENDANTIC_TOR_CHECK
+#ifdef PEDANTIC_TOR_CHECK
       if(gethostbyname(certificate) == NULL) {
 	ndpi_int_tor_add_connection(ndpi_struct, flow);
 	return(1);
@@ -88,23 +101,22 @@ void ndpi_search_tor(struct ndpi_detection_module_struct *ndpi_struct, struct nd
   struct ndpi_packet_struct *packet = &flow->packet;
   u_int16_t dport = 0, sport = 0;
 
-  NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "search for TOR.\n");
+  NDPI_LOG_DBG(ndpi_struct, "search for TOR\n");
 
   if(packet->tcp != NULL) {
     sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest);
-    NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "calculating TOR over tcp.\n");
+    NDPI_LOG_DBG2(ndpi_struct, "calculating TOR over tcp\n");
 
     if ((((dport == 9001) || (sport == 9001)) || ((dport == 9030) || (sport == 9030)))
 	&& ((packet->payload[0] == 0x17) || (packet->payload[0] == 0x16)) 
 	&& (packet->payload[1] == 0x03) 
 	&& (packet->payload[2] == 0x01) 
 	&& (packet->payload[3] == 0x00)) {
-      NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "found tor.\n");
+      NDPI_LOG_INFO(ndpi_struct, "found tor\n");
       ndpi_int_tor_add_connection(ndpi_struct, flow);
     }
   } else {
-    NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "exclude TOR.\n");
-    NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TOR);
+    NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
   }
 }