From 326a2fb7ed8afba6aa42dda65c4c135d0cbae2ff Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Mon, 28 May 2018 18:18:19 +0200 Subject: Fix for https://github.com/ntop/nDPI/issues/572 --- src/lib/ndpi_main.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'src/lib/ndpi_main.c') diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 6505463ee..aaa1109e9 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -3791,7 +3791,7 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st if(flow->guessed_protocol_id == NDPI_PROTOCOL_STUN) goto check_stun_export; - else if(flow->protos.ssl.client_certificate[0] != '\0') { + else if(flow->protos.stun_ssl.ssl.client_certificate[0] != '\0') { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSL, NDPI_PROTOCOL_UNKNOWN); } else { if((flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN) @@ -3830,9 +3830,9 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st if((flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) && (flow->guessed_protocol_id == NDPI_PROTOCOL_STUN)) { check_stun_export: - if(flow->protos.stun.num_processed_pkts > 0) { - if(flow->protos.stun.num_processed_pkts >= 8) { - u_int16_t proto = (flow->protos.stun.num_binding_requests < 4) ? NDPI_PROTOCOL_SKYPE_CALL_IN : NDPI_PROTOCOL_SKYPE_CALL_OUT; + if(flow->protos.stun_ssl.stun.num_processed_pkts > 0) { + if(flow->protos.stun_ssl.stun.num_processed_pkts >= 8) { + u_int16_t proto = (flow->protos.stun_ssl.stun.num_binding_requests < 4) ? NDPI_PROTOCOL_SKYPE_CALL_IN : NDPI_PROTOCOL_SKYPE_CALL_OUT; ndpi_set_detected_protocol(ndpi_struct, flow, proto, NDPI_PROTOCOL_SKYPE); } else @@ -4096,9 +4096,9 @@ void ndpi_fill_protocol_category(struct ndpi_detection_module_struct *ndpi_struc } } - if(flow->protos.ssl.server_certificate[0] != '\0') { + if(flow->protos.stun_ssl.ssl.server_certificate[0] != '\0') { unsigned long id; - int rc = ndpi_match_custom_category(ndpi_struct, (char *)flow->protos.ssl.server_certificate, &id); + int rc = ndpi_match_custom_category(ndpi_struct, (char *)flow->protos.stun_ssl.ssl.server_certificate, &id); if(rc == 0) { ret->category = (ndpi_protocol_category_t)id; -- cgit v1.2.3 From 6b16ad709ee4ef7c504650cf9d4efdf7e56c517b Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Tue, 29 May 2018 22:50:18 +0200 Subject: Fix for #560 --- src/lib/ndpi_main.c | 9 ++++++--- src/lib/third_party/include/actypes.h | 2 +- src/lib/third_party/src/ahocorasick.c | 5 ++--- 3 files changed, 9 insertions(+), 7 deletions(-) (limited to 'src/lib/ndpi_main.c') diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index aaa1109e9..5f1f9800d 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1883,9 +1883,9 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp /* ****************************************************** */ -static int ac_match_handler(AC_MATCH_t *m, void *param) { +static int ac_match_handler(AC_MATCH_t *m, AC_TEXT_t *txt, void *param) { int *matching_protocol_id = (int*)param; - + int min_len = (txt->length < m->patterns->length) ? txt->length : m->patterns->length; /* Return 1 for stopping to the first match. We might consider searching for the more @@ -1893,7 +1893,10 @@ static int ac_match_handler(AC_MATCH_t *m, void *param) { */ *matching_protocol_id = m->patterns[0].rep.number; - return 0; /* 0 to continue searching, !0 to stop */ + if(strncmp(txt->astring, m->patterns->astring, min_len) == 0) + return(1); /* If the pattern found matches the string at the beginning we stop here */ + else + return 0; /* 0 to continue searching, !0 to stop */ } /* ******************************************************************** */ diff --git a/src/lib/third_party/include/actypes.h b/src/lib/third_party/include/actypes.h index 1900ae9a0..807e5026a 100644 --- a/src/lib/third_party/include/actypes.h +++ b/src/lib/third_party/include/actypes.h @@ -125,7 +125,7 @@ typedef enum * continue searching, otherwise it will return from ac_automata_search() * to your calling function. **/ -typedef int (*MATCH_CALBACK_f)(AC_MATCH_t *, void *); +typedef int (*MATCH_CALBACK_f)(AC_MATCH_t *, AC_TEXT_t *, void *); /* AC_PATTRN_MAX_LENGTH: * Maximum acceptable pattern length in AC_PATTERN_t.length diff --git a/src/lib/third_party/src/ahocorasick.c b/src/lib/third_party/src/ahocorasick.c index ce064033f..fd6541dd7 100644 --- a/src/lib/third_party/src/ahocorasick.c +++ b/src/lib/third_party/src/ahocorasick.c @@ -189,16 +189,15 @@ int ac_automata_search (AC_AUTOMATA_t * thiz, AC_TEXT_t * txt, void * param) position++; } - if(curr->final && next) + if(curr->final && next) { /* We check 'next' to find out if we came here after a alphabet * transition or due to a fail. in second case we should not report * matching because it was reported in previous node */ - { thiz->match.position = position + thiz->base_position; thiz->match.match_num = curr->matched_patterns_num; thiz->match.patterns = curr->matched_patterns; /* we found a match! do call-back */ - if (thiz->match_callback(&thiz->match, param)) + if (thiz->match_callback(&thiz->match, txt, param)) return 1; } } -- cgit v1.2.3