diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/ndpi_main.c | 2 | ||||
| -rw-r--r-- | src/lib/protocols/dns.c | 3 | ||||
| -rw-r--r-- | src/lib/protocols/quic.c | 2 |
3 files changed, 4 insertions, 3 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index ba6c66a4f..c8da3b3d5 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -5162,7 +5162,7 @@ void ndpi_fill_protocol_category(struct ndpi_detection_module_struct *ndpi_str, static void ndpi_reset_packet_line_info(struct ndpi_packet_struct *packet) { packet->parsed_lines = 0, packet->empty_line_position_set = 0, packet->host_line.ptr = NULL, packet->host_line.len = 0, packet->referer_line.ptr = NULL, packet->referer_line.len = 0, - packet->authorization_line.len = 0, + packet->authorization_line.len = 0, packet->authorization_line.ptr = NULL, packet->content_line.ptr = NULL, packet->content_line.len = 0, packet->accept_line.ptr = NULL, packet->accept_line.len = 0, packet->user_agent_line.ptr = NULL, packet->user_agent_line.len = 0, packet->http_url_name.ptr = NULL, packet->http_url_name.len = 0, packet->http_encoding.ptr = NULL, diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c index 7df539a88..987133213 100644 --- a/src/lib/protocols/dns.c +++ b/src/lib/protocols/dns.c @@ -521,6 +521,7 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st if((flow->packet.detected_protocol_stack[0] == NDPI_PROTOCOL_DNS) || (flow->packet.detected_protocol_stack[1] == NDPI_PROTOCOL_DNS)) { + /* TODO: add support to RFC6891 to avoid some false positives */ if(flow->packet.udp != NULL && flow->packet.payload_packet_len > PKT_LEN_ALERT) ndpi_set_risk(ndpi_struct, flow, NDPI_DNS_LARGE_PACKET); @@ -529,7 +530,7 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st u_int8_t flags = ((u_int8_t*)flow->packet.iph)[6]; /* 0: fragmented; 1: not fragmented */ - if((flags & 0xE0) + if((flags & 0x20) || (ndpi_iph_is_valid_and_not_fragmented(flow->packet.iph, flow->packet.l3_packet_len) == 0)) { ndpi_set_risk(ndpi_struct, flow, NDPI_DNS_FRAGMENTED); } diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c index 9461765c6..7db718ac8 100644 --- a/src/lib/protocols/quic.c +++ b/src/lib/protocols/quic.c @@ -202,7 +202,7 @@ int quic_len(const uint8_t *buf, uint64_t *value) /* Necessary as simple cast crashes on ARM */ memcpy(&n, buf, sizeof(u_int64_t)); - *value = ndpi_ntohll(n & 0x3FFFFFFFFFFFFFFF); + *value = ndpi_ntohll(n) & 0x3FFFFFFFFFFFFFFF; } return 8; default: /* No Possible */ |