From afc2b641eb9cf5035b5147e78030bafe0b40dd87 Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Mon, 15 Nov 2021 16:20:57 +0100 Subject: Fix writes to `flow->protos` union fields (#1354) We can write to `flow->protos` only after a proper classification. This issue has been found in Kerberos, DHCP, HTTP, STUN, IMO, FTP, SMTP, IMAP and POP code. There are two kinds of fixes: * write to `flow->protos` only if a final protocol has been detected * move protocol state out of `flow->protos` The hard part is to find, for each protocol, the right tradeoff between memory usage and code complexity. Handle Kerberos like DNS: if we find a request, we set the protocol and an extra callback to further parsing the reply. For all the other protocols, move the state out of `flow->protos`. This is an issue only for the FTP/MAIL stuff. Add DHCP Class Identification value to the output of ndpiReader and to the Jason serialization. Extend code coverage of fuzz tests. Close #1343 Close #1342 --- src/lib/protocols/imo.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src/lib/protocols/imo.c') diff --git a/src/lib/protocols/imo.c b/src/lib/protocols/imo.c index 2784e7143..fab99d301 100644 --- a/src/lib/protocols/imo.c +++ b/src/lib/protocols/imo.c @@ -39,11 +39,11 @@ void ndpi_search_imo(struct ndpi_detection_module_struct *ndpi_struct, struct nd if(packet->payload_packet_len == 1) { /* Two one byte consecutive packets with the same payload */ - if((flow->protos.imo.last_one_byte_pkt == 1) - && (flow->protos.imo.last_byte == packet->payload[0])) + if((flow->l4.udp.imo_last_one_byte_pkt == 1) + && (flow->l4.udp.imo_last_byte == packet->payload[0])) ndpi_int_imo_add_connection(ndpi_struct, flow); else - flow->protos.imo.last_one_byte_pkt = 1, flow->protos.imo.last_byte = packet->payload[0]; + flow->l4.udp.imo_last_one_byte_pkt = 1, flow->l4.udp.imo_last_byte = packet->payload[0]; } else if(((packet->payload_packet_len == 10) && (packet->payload[0] == 0x09) && (packet->payload[1] == 0x02)) @@ -62,7 +62,7 @@ void ndpi_search_imo(struct ndpi_detection_module_struct *ndpi_struct, struct nd if(flow->num_processed_pkts > 5) NDPI_EXCLUDE_PROTO(ndpi_struct, flow); else - flow->protos.imo.last_one_byte_pkt = 0; + flow->l4.udp.imo_last_one_byte_pkt = 0; } } -- cgit v1.2.3