From 7571f48392ef3b79eb25b94f1da6932a137c4f02 Mon Sep 17 00:00:00 2001 From: Nardi Ivan Date: Fri, 12 Aug 2022 16:40:41 +0200 Subject: Dissectors shouldn't update `flow->guessed_host_protocol_id` The field `flow->guessed_host_protocol_id` is set at the beginning of the flow analysis and it represents the "classification by ip" of the flow itself. This field should never be changed. Dissectors which want to provide an "hint" about the classification, should update `flow->guessed_protocol_id` instead. Such "hint" is useless if the dissector set the "extra-dissection" data-path. Rename such field to `guessed_protocol_id_by_ip` to better describe its role. Preliminary work necessary for #1687 --- src/lib/protocols/wireguard.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'src/lib/protocols/wireguard.c') diff --git a/src/lib/protocols/wireguard.c b/src/lib/protocols/wireguard.c index a2e2291bc..8a0d15e00 100644 --- a/src/lib/protocols/wireguard.c +++ b/src/lib/protocols/wireguard.c @@ -140,8 +140,7 @@ void ndpi_search_wireguard(struct ndpi_detection_module_struct u_int32_t receiver_index = get_u_int32_t(payload, 4); /* We speculate this is wireguard, so let's remember it */ - if(flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) - flow->guessed_host_protocol_id = NDPI_PROTOCOL_WIREGUARD; + flow->guessed_protocol_id = NDPI_PROTOCOL_WIREGUARD; if (flow->l4.udp.wireguard_stage == 0) { flow->l4.udp.wireguard_stage = 3 + packet->packet_direction; -- cgit v1.2.3