From 06a63dcbaad807f50b28b8012f518b2243639470 Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Thu, 6 Apr 2023 09:34:39 +0200
Subject: MySql: improve detection (#1928)

Add support for flows with "caching_sha2_password" authentication plugin.

See #1924
---
 src/lib/protocols/mysql.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'src/lib/protocols/mysql.c')

diff --git a/src/lib/protocols/mysql.c b/src/lib/protocols/mysql.c
index 58e3c8f51..1a0402ca1 100644
--- a/src/lib/protocols/mysql.c
+++ b/src/lib/protocols/mysql.c
@@ -65,7 +65,9 @@ static void ndpi_search_mysql_tcp(struct ndpi_detection_module_struct *ndpi_stru
       }
 #else
         if(strncmp((const char*)&packet->payload[packet->payload_packet_len-22],
-		   "mysql_", 6) == 0) {
+		   "mysql_", 6) == 0 ||
+           strncmp((const char*)&packet->payload[packet->payload_packet_len-22],
+		   "caching_", 8) == 0) {
 	  NDPI_LOG_INFO(ndpi_struct, "found MySQL\n");
 	  ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MYSQL,  NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI);
 	  return;
-- 
cgit v1.2.3