From 1edf5c49d662f7944ee976a63d54980a270a2419 Mon Sep 17 00:00:00 2001 From: loures Date: Thu, 14 May 2020 14:30:34 +0200 Subject: Extend filetype matching for Content-Disposition header --- src/lib/protocols/http.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index abcf8c32e..5f62d730f 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -37,6 +37,13 @@ static const char* binary_file_mimes[] = { NULL }; +static const char* binary_file_ext[] = { + ".exe", + ".msi", + ".cab", + NULL +}; + static void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); @@ -112,22 +119,23 @@ static ndpi_protocol_category_t ndpi_http_check_content(struct ndpi_detection_mo } } + /* check for attachment */ if (packet->content_disposition_line.len > 0) { - /* check for weird exe name as attachment */ uint8_t attachment_len = sizeof("attachment; filename"); if (packet->content_disposition_line.len > attachment_len) { uint8_t filename_len = packet->content_disposition_line.len - attachment_len; - /* might want to extend this to match more filenames */ - if (strncmp((const char *)&packet->content_disposition_line.ptr[attachment_len], - "\"phn34ycjtghm.exe\"", filename_len) == 0) { - flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT; - NDPI_SET_BIT_16(flow->risk, NDPI_BINARY_APPLICATION_TRANSFER); - NDPI_LOG_INFO(ndpi_struct, "found executable HTTP transfer"); - return(flow->category); + for (int i = 0; binary_file_ext[i] != NULL; i++) { + if (ndpi_strncasestr((const char*)&packet->content_disposition_line.ptr[attachment_len], + binary_file_ext[i], filename_len)) { + printf("got %s\n", binary_file_ext[i]); + flow->guessed_category = flow->category = NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT; + NDPI_SET_BIT_16(flow->risk, NDPI_BINARY_APPLICATION_TRANSFER); + NDPI_LOG_INFO(ndpi_struct, "found executable HTTP transfer"); + return(flow->category); + } } } } - switch(packet->content_line.ptr[0]) { case 'a': if(strncasecmp((const char *)packet->content_line.ptr, "audio", -- cgit v1.2.3