diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/ndpi_main.c | 2 | ||||
| -rw-r--r-- | src/lib/protocols/cassandra.c | 17 |
2 files changed, 13 insertions, 6 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 93060a2e5..e9372ba5c 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1876,7 +1876,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_str, 1 /* cleartext */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CASSANDRA, "Cassandra", NDPI_PROTOCOL_CATEGORY_DATABASE, - ndpi_build_default_ports(ports_a, 9042, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_a, 7000, 9042, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FACEBOOK_VOIP, "FacebookVoip", NDPI_PROTOCOL_CATEGORY_VOIP, diff --git a/src/lib/protocols/cassandra.c b/src/lib/protocols/cassandra.c index effb9d255..191932ceb 100644 --- a/src/lib/protocols/cassandra.c +++ b/src/lib/protocols/cassandra.c @@ -33,12 +33,12 @@ static inline int ndpi_validate_cassandra_response(u_int8_t response) { - return (response >= 0x81 && response <= 0x84) ? 1 : -1; + return (response >= 0x81 && response <= 0x85) ? 1 : -1; } static inline int ndpi_validate_cassandra_request(u_int8_t request) { - return (request >= 0x01 && request <= 0x04) ? 1 : -1; + return (request >= 0x01 && request <= 0x05) ? 1 : -1; } static void ndpi_int_cassandra_add_connection(struct ndpi_detection_module_struct *ndpi_struct, @@ -58,6 +58,14 @@ static void ndpi_search_cassandra(struct ndpi_detection_module_struct *ndpi_stru NDPI_LOG_DBG(ndpi_struct, "search Cassandra CQL\n"); + if (packet->payload_packet_len == 19 && + ntohl(get_u_int32_t(packet->payload, 0)) == 0xCA552DFA) + { + NDPI_LOG_INFO(ndpi_struct, "found Cassandra Internode Communication\n"); + ndpi_int_cassandra_add_connection(ndpi_struct, flow); + return; + } + if (packet->payload_packet_len < 9 || (!ndpi_validate_cassandra_response(packet->payload[0]) || !ndpi_validate_cassandra_request(packet->payload[0]))) @@ -74,9 +82,8 @@ static void ndpi_search_cassandra(struct ndpi_detection_module_struct *ndpi_stru /* Looking for a 'STARTUP' message from the client, * which should always contain the CQL_VERSION string */ - if (packet->payload_packet_len > 24 && - (packet->payload[4] == 0x01 && - (strncmp((char *)&packet->payload[13], "CQL_VERSION", 11) == 0))) + if (packet->payload_packet_len > 60 && + memcmp(&packet->payload[packet->payload_packet_len-20], "CQL_VERSION", 11) == 0) { NDPI_LOG_INFO(ndpi_struct, "found Cassandra CQL\n"); ndpi_int_cassandra_add_connection(ndpi_struct, flow); |