diff options
| author | yangwei <[email protected]> | 2024-10-12 15:51:16 +0800 |
|---|---|---|
| committer | yangwei <[email protected]> | 2024-10-12 15:51:16 +0800 |
| commit | 260787167a81a8f7ac311ed394ceb5d990451136 (patch) | |
| tree | 2a762fbbe7a09f20a9bea72ca794c20d7efc2176 | |
| parent | 70d21f28c36fc93280352c9284de6529afcbe5be (diff) | |
✨ feat(lpip match quic): remove port pattern
| -rw-r--r-- | decoders/lpi_plus/lpip_extend.c | 3 | ||||
| -rw-r--r-- | test/lpi_plus/test_expect/mixed_pcap.json | 7 | ||||
| -rw-r--r-- | test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap | bin | 0 -> 484121 bytes |
3 files changed, 8 insertions, 2 deletions
diff --git a/decoders/lpi_plus/lpip_extend.c b/decoders/lpi_plus/lpip_extend.c index 79b3849..334e557 100644 --- a/decoders/lpi_plus/lpip_extend.c +++ b/decoders/lpi_plus/lpip_extend.c @@ -448,8 +448,7 @@ lpi_module_t* lpi_plus_extended_guess(struct lpi_plus_detect_context *ctx, lpi_p } //QUIC - if((sport==443 || dport==443 || sport==80 || dport==80 || sport==8443 || dport==8443) - && (lpi_proto==LPI_PROTO_UNKNOWN || lpi_proto==LPI_PROTO_UDP)) + if((lpi_proto==LPI_PROTO_UNKNOWN || lpi_proto==LPI_PROTO_UDP)) { if(lpi_plus_match_quic(ctx->current_is_c2s_flow, (const unsigned char *)payload, payload_sz)) { diff --git a/test/lpi_plus/test_expect/mixed_pcap.json b/test/lpi_plus/test_expect/mixed_pcap.json index cddc7e3..90bb9f0 100644 --- a/test/lpi_plus/test_expect/mixed_pcap.json +++ b/test/lpi_plus/test_expect/mixed_pcap.json @@ -288,4 +288,11 @@ "l7_label_id": "UNKNOWN", "STREAM_DIR": "DOUBLE", "name": "APP_PROTO_IDENTIFY_RESULT_42" + }, { + "Tuple4": "192.168.58.54:56122-162.159.198.1:1701-17-0", + "STREAM_TYPE": "UDP", + "l7_label_id": [2521], + "l7_label_name": ["QUIC"], + "STREAM_DIR": "DOUBLE", + "name": "APP_PROTO_IDENTIFY_RESULT_43" }] diff --git a/test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap b/test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap Binary files differnew file mode 100644 index 0000000..b004a85 --- /dev/null +++ b/test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap |