From ac5cb53066adf584da95b96e04e3e7e838c97a4a Mon Sep 17 00:00:00 2001
From: Luca <deri@ntop.org>
Date: Thu, 15 Jun 2017 05:25:27 -0400
Subject: mDNS improvemennts to recognize reponses senst to non multicast
addresses
---
src/lib/protocols/mdns.c | 37 ++++++++++++++++++++-----------------
1 file changed, 20 insertions(+), 17 deletions(-)
diff --git a/src/lib/protocols/mdns.c b/src/lib/protocols/mdns.c
index 0692b3252..a47e9b72a 100644
--- a/src/lib/protocols/mdns.c
+++ b/src/lib/protocols/mdns.c
@@ -1,7 +1,7 @@
/*
* mdns.c
*
- * Copyright (C) 2016 - ntop.org
+ * Copyright (C) 2016-17 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -26,6 +26,10 @@
#define NDPI_MAX_MDNS_REQUESTS 128
+PACK_ON
+struct mdns_header {
+ u_int16_t transaction_id, flags, questions, answers, authority_rr, additional_rr;
+} PACK_OFF;
/**
MDNS header is similar to dns header
@@ -48,27 +52,26 @@
static void ndpi_int_mdns_add_connection(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+ *ndpi_struct, struct ndpi_flow_struct *flow) {
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MDNS, NDPI_PROTOCOL_UNKNOWN);
}
static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+ *ndpi_struct, struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &flow->packet;
-
- if((packet->payload[2] & 0x80) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
-
+ struct mdns_header *h = (struct mdns_header*)packet->payload;
+ u_int16_t questions = ntohs(h->questions), answers = ntohs(h->answers);
+
+ if(((packet->payload[2] & 0x80) == 0)
+ && (questions <= NDPI_MAX_MDNS_REQUESTS)
+ && (answers <= NDPI_MAX_MDNS_REQUESTS)) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n");
return 1;
}
- else if((packet->payload[2] & 0x80) != 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
+ else if(((packet->payload[2] & 0x80) != 0)
+ && (questions == 0)
+ && (answers <= NDPI_MAX_MDNS_REQUESTS)
+ && (answers != 0)) {
char answer[256];
int i, j, len;
@@ -77,7 +80,7 @@ static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
answer[j] = '\0';
- /* printf("==> [%d] %s\n", j, answer); */
+ printf("==> [%d] %s\n", j, answer);
len = ndpi_min(sizeof(flow->protos.mdns.answer)-1, j);
strncpy(flow->protos.mdns.answer, (const char *)answer, len);
@@ -107,7 +110,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
/* check standard MDNS ON port 5353 */
if(dport == 5353 && packet->payload_packet_len >= 12) {
/* mdns protocol must have destination address 224.0.0.251 */
- if(packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
+ if(packet->iph != NULL /* && ntohl(packet->iph->daddr) == 0xe00000fb */) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
@@ -120,7 +123,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if(packet->iphv6 != NULL) {
const u_int32_t *daddr = packet->iphv6->ip6_dst.u6_addr.u6_addr32;
- if(daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
+ if(daddr[0] == htonl(0xff020000) /* && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb) */) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n");
--
cgit v1.2.3