From 0cb951f143285a599a6d831c6fc2b3cb89d6aa67 Mon Sep 17 00:00:00 2001 From: Toni Uhlig Date: Fri, 10 Jan 2025 17:52:51 +0100 Subject: Improved WebSocket-over-HTTP detection * detect `chisel` SSH-over-HTTP-WebSocket * use `strncasecmp()` for `LINE_*` matching macros Signed-off-by: Toni Uhlig --- src/include/ndpi_private.h | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'src/include') diff --git a/src/include/ndpi_private.h b/src/include/ndpi_private.h index 93eccf0d1..22f6e5605 100644 --- a/src/include/ndpi_private.h +++ b/src/include/ndpi_private.h @@ -82,13 +82,15 @@ typedef struct default_ports_tree_node { #define LINE_ENDS(ndpi_int_one_line_struct, string_to_compare) \ ((ndpi_int_one_line_struct).len >= strlen(string_to_compare) && \ - memcmp((ndpi_int_one_line_struct).ptr + \ - ((ndpi_int_one_line_struct).len - strlen(string_to_compare)), \ - string_to_compare, strlen(string_to_compare)) == 0) + ndpi_strncasestr((const char *)((ndpi_int_one_line_struct).ptr) + \ + ((ndpi_int_one_line_struct).len - strlen(string_to_compare)), \ + string_to_compare, strlen(string_to_compare)) == \ + (const char *)((ndpi_int_one_line_struct).ptr) + ((ndpi_int_one_line_struct).len - strlen(string_to_compare))) #define LINE_CMP(ndpi_int_one_line_struct, string_to_compare, string_to_compare_length) \ ((ndpi_int_one_line_struct).ptr != NULL && \ - memcmp((ndpi_int_one_line_struct).ptr, string_to_compare, string_to_compare_length) == 0) + ndpi_strncasestr((const char *)((ndpi_int_one_line_struct).ptr), string_to_compare, \ + string_to_compare_length) == (const char *)((ndpi_int_one_line_struct).ptr)) #define NDPI_MAX_PARSE_LINES_PER_PACKET 64 -- cgit v1.2.3