Skip to content

Commit 91da2cf

Browse files
IvanNardiIvanNardi
committed
IRC: remove detection over HTTP
We are not sure if it ever worked; we never had a pcap triggering that code...
1 parent bbbd117 commit 91da2cf

103 files changed

Lines changed: 101 additions & 158 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/lib/ndpi_main.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1287,7 +1287,6 @@ static void init_protocol_defaults(struct ndpi_detection_module_struct *ndpi_str
12871287
NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_SOAP,
12881288
NDPI_PROTOCOL_BITTORRENT,
12891289
NDPI_PROTOCOL_ZATTOO,
1290-
NDPI_PROTOCOL_IRC,
12911290
NDPI_PROTOCOL_IPP,
12921291
NDPI_PROTOCOL_MPEGDASH,
12931292
NDPI_PROTOCOL_RTSP,

‎src/lib/protocols/irc.c‎

Lines changed: 0 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -46,55 +46,12 @@ static u_int8_t ndpi_check_for_NOTICE_or_PRIVMSG(struct ndpi_detection_module_st
4646
return 0;
4747
}
4848

49-
static u_int8_t ndpi_check_for_Nickname(struct ndpi_detection_module_struct *ndpi_struct)
50-
{
51-
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
52-
u_int16_t i, packetl = packet->payload_packet_len;
53-
54-
if (packetl < 4) {
55-
return 0;
56-
}
57-
58-
for (i = 0; i < (packetl - 4); i++) {
59-
if (packet->payload[i] == 'N' || packet->payload[i] == 'n') {
60-
if ((((packetl - (i + 1)) >= 4) && memcmp(&packet->payload[i + 1], "ick=", 4) == 0)
61-
|| (((packetl - (i + 1)) >= 8) && (memcmp(&packet->payload[i + 1], "ickname=", 8) == 0))
62-
|| (((packetl - (i + 1)) >= 8) && (memcmp(&packet->payload[i + 1], "ickName=", 8) == 0))) {
63-
NDPI_LOG_DBG2(ndpi_struct, "found HTTP IRC Nickname pattern\n");
64-
return 1;
65-
}
66-
}
67-
}
68-
return 0;
69-
}
70-
71-
static u_int8_t ndpi_check_for_cmd(struct ndpi_detection_module_struct *ndpi_struct)
72-
{
73-
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
74-
u_int16_t i;
75-
76-
if (packet->payload_packet_len < 4) {
77-
return 0;
78-
}
79-
80-
for (i = 0; i < packet->payload_packet_len - 4; i++) {
81-
if (packet->payload[i] == 'c') {
82-
if (memcmp(&packet->payload[i + 1], "md=", 3) == 0) {
83-
NDPI_LOG_DBG2(ndpi_struct, "found HTTP IRC cmd pattern \n");
84-
return 1;
85-
}
86-
}
87-
}
88-
return 0;
89-
}
90-
9149
static void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
9250
{
9351
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
9452

9553
u_int16_t c = 0;
9654
u_int16_t i = 0;
97-
u_int16_t http_content_ptr_len = 0;
9855

9956
NDPI_LOG_DBG(ndpi_struct, "search irc\n");
10057
if((flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && (flow->packet_counter > 10))
@@ -209,19 +166,6 @@ static void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct
209166
}
210167
}
211168
}
212-
213-
if ((flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC) && (flow->l4.tcp.irc_stage == 1)) {
214-
if ((((packet->payload_packet_len - http_content_ptr_len) > 10)
215-
&& (memcmp(packet->payload + http_content_ptr_len, "interface=", 10) == 0)
216-
&& (ndpi_check_for_Nickname(ndpi_struct) != 0))
217-
|| (((packet->payload_packet_len - http_content_ptr_len) > 5)
218-
&& (memcmp(packet->payload + http_content_ptr_len, "item=", 5) == 0)
219-
&& (ndpi_check_for_cmd(ndpi_struct) != 0))) {
220-
NDPI_LOG_INFO(ndpi_struct, "found IRC: Nickname, cmd, one time");
221-
ndpi_int_irc_add_connection(ndpi_struct, flow, NDPI_CONFIDENCE_DPI);
222-
return;
223-
}
224-
}
225169
}
226170

227171
void init_irc_dissector(struct ndpi_detection_module_struct *ndpi_struct)

‎tests/cfgs/caches_cfg/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 1
33
DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence Match by port : 1 (flows)
55
Confidence DPI : 5 (flows)
6-
Num dissector calls: 573 (95.50 diss/flow)
6+
Num dissector calls: 572 (95.33 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/3/0 (insert/search/found)
99
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/caches_global/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 40 (6.67 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 573 (95.50 diss/flow)
7+
Num dissector calls: 572 (95.33 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/http-basic-auth.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ Guessed flow protos: 9
33
DPI Packets (TCP): 183 (7.32 pkts/flow)
44
Confidence Match by port : 9 (flows)
55
Confidence DPI : 16 (flows)
6-
Num dissector calls: 208 (8.32 diss/flow)
6+
Num dissector calls: 192 (7.68 diss/flow)
77
LRU cache ookla: 0/0/0 (insert/search/found)
88
LRU cache bittorrent: 0/27/0 (insert/search/found)
99
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/http-pwd.pcapng.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 9 (9.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 13 (13.00 diss/flow)
3+
Num dissector calls: 12 (12.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/http_auth.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
DPI Packets (TCP): 6 (6.00 pkts/flow)
22
Confidence DPI : 1 (flows)
3-
Num dissector calls: 13 (13.00 diss/flow)
3+
Num dissector calls: 12 (12.00 diss/flow)
44
LRU cache ookla: 0/0/0 (insert/search/found)
55
LRU cache bittorrent: 0/0/0 (insert/search/found)
66
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/ookla.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ DPI Packets (TCP): 38 (6.33 pkts/flow)
44
Confidence DPI (partial cache): 1 (flows)
55
Confidence DPI : 4 (flows)
66
Confidence DPI (aggressive) : 1 (flows)
7-
Num dissector calls: 573 (95.50 diss/flow)
7+
Num dissector calls: 572 (95.33 diss/flow)
88
LRU cache ookla: 4/2/2 (insert/search/found)
99
LRU cache bittorrent: 0/3/0 (insert/search/found)
1010
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/classification_only/result/waze.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 1 (1.00 pkts/flow)
55
Confidence Unknown : 1 (flows)
66
Confidence Match by port : 9 (flows)
77
Confidence DPI : 23 (flows)
8-
Num dissector calls: 354 (10.73 diss/flow)
8+
Num dissector calls: 346 (10.48 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/30/0 (insert/search/found)
1111
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/default/result/1kxun.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ DPI Packets (UDP): 120 (1.21 pkts/flow)
55
Confidence Unknown : 9 (flows)
66
Confidence Match by port : 6 (flows)
77
Confidence DPI : 182 (flows)
8-
Num dissector calls: 4484 (22.76 diss/flow)
8+
Num dissector calls: 4397 (22.32 diss/flow)
99
LRU cache ookla: 0/0/0 (insert/search/found)
1010
LRU cache bittorrent: 0/45/0 (insert/search/found)
1111
LRU cache stun: 0/0/0 (insert/search/found)

0 commit comments

Comments
 (0)