From f48c7ab8e6b0a6848aaab28ec56212787b41defa Mon Sep 17 00:00:00 2001 From: Daniele De Sensi Date: Tue, 11 Sep 2018 12:41:05 +0200 Subject: Fixed bug in spotify dissector (subnet /24 was matched as /22). Slight performance improvements in spotify dissector (avoid doing ntohl and masking in each and all if conditions). --- src/lib/protocols/spotify.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) (limited to 'src') diff --git a/src/lib/protocols/spotify.c b/src/lib/protocols/spotify.c index 699d8f346..a180a1ea7 100644 --- a/src/lib/protocols/spotify.c +++ b/src/lib/protocols/spotify.c @@ -88,17 +88,25 @@ static void ndpi_check_spotify(struct ndpi_detection_module_struct *ndpi_struct, */ //printf("%08X - %08X\n", ntohl(packet->iph->saddr), ntohl(packet->iph->daddr)); - if(((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0x4E1F0800 /* 78.31.8.0 */) - || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0x4E1F0800 /* 78.31.8.0 */) + + long src_addr = ntohl(packet->iph->saddr); + long dst_addr = ntohl(packet->iph->daddr); + long src_addr_masked_22 = src_addr & 0xFFFFFC00; // */22 + long dst_addr_masked_22 = dst_addr & 0xFFFFFC00; // */22 + long src_addr_masked_24 = src_addr & 0xFFFFFF00; // */24 + long dst_addr_masked_24 = dst_addr & 0xFFFFFF00; // */24 + + if( src_addr_masked_22 == 0x4E1F0800 /* 78.31.8.0 */ + || dst_addr_masked_22 == 0x4E1F0800 /* 78.31.8.0 */ /* **** */ - || ((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC1EBE800 /* 193.235.232.0 */) - || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC1EBE800 /* 193.235.232.0 */) - /* **** */ - || ((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284C400 /* 194.132.196.0 */) - || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284C400 /* 194.132.196.0 */) - /* **** */ - || ((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284A200 /* 194.132.162.0 */) - || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284A200 /* 194.132.162.0 */) + || src_addr_masked_22 == 0xC1EBE800 /* 193.235.232.0 */ + || dst_addr_masked_22 == 0xC1EBE800 /* 193.235.232.0 */ + /* **** */ + || src_addr_masked_22 == 0xC284C400 /* 194.132.196.0 */ + || dst_addr_masked_22 == 0xC284C400 /* 194.132.196.0 */ + /* **** */ + || src_addr_masked_24 == 0xC284A200 /* 194.132.162.0 */ + || dst_addr_masked_24 == 0xC284A200 /* 194.132.162.0 */ ) { NDPI_LOG_INFO(ndpi_struct, "found spotify via ip range\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_UNKNOWN); -- cgit v1.2.3