From 470eaa6ff388435d7233ff2680e3ea013068d1fe Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Tue, 17 Jan 2023 11:38:39 +0100 Subject: Add Meraki Cloud protocol and improve other protocols (#1854) Avoid some LineCall and Jabber false positives. Detect Discord mid flows. Fix Bittorrent detection. --- src/lib/protocols/jabber.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) (limited to 'src/lib/protocols/jabber.c') diff --git a/src/lib/protocols/jabber.c b/src/lib/protocols/jabber.c index 54d13a6fb..7a8c3a3d7 100644 --- a/src/lib/protocols/jabber.c +++ b/src/lib/protocols/jabber.c @@ -78,6 +78,7 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st if (flow->packet_counter > max_packets - 1) { ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); + return; } for (i = 0; i < NDPI_ARRAY_LENGTH(valid_patterns); ++i) { @@ -86,6 +87,8 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st return; } } + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; } /* search for jabber here */ @@ -93,7 +96,7 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st if (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("payload, "payload[0], - "xmlns='http://jabber.org/protocol/caps'", packet->payload_packet_len) != NULL) + "xmlns='http://jabber.org/protocol/", packet->payload_packet_len) != NULL) { ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_JABBER, NDPI_CONFIDENCE_DPI); return; @@ -128,14 +131,12 @@ void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, st /* search for subprotocols */ check_content_type_and_change_protocol(ndpi_struct, flow, 13); - return; } - } - - if (flow->packet_counter > max_packets) { - NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; } + + NDPI_EXCLUDE_PROTO(ndpi_struct, flow); + return; } -- cgit v1.2.3