From 260787167a81a8f7ac311ed394ceb5d990451136 Mon Sep 17 00:00:00 2001 From: yangwei Date: Sat, 12 Oct 2024 15:51:16 +0800 Subject: ✨ feat(lpip match quic): remove port pattern MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- decoders/lpi_plus/lpip_extend.c | 3 +-- test/lpi_plus/test_expect/mixed_pcap.json | 7 +++++++ test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap | Bin 0 -> 484121 bytes 3 files changed, 8 insertions(+), 2 deletions(-) create mode 100644 test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap diff --git a/decoders/lpi_plus/lpip_extend.c b/decoders/lpi_plus/lpip_extend.c index 79b3849..334e557 100644 --- a/decoders/lpi_plus/lpip_extend.c +++ b/decoders/lpi_plus/lpip_extend.c @@ -448,8 +448,7 @@ lpi_module_t* lpi_plus_extended_guess(struct lpi_plus_detect_context *ctx, lpi_p } //QUIC - if((sport==443 || dport==443 || sport==80 || dport==80 || sport==8443 || dport==8443) - && (lpi_proto==LPI_PROTO_UNKNOWN || lpi_proto==LPI_PROTO_UDP)) + if((lpi_proto==LPI_PROTO_UNKNOWN || lpi_proto==LPI_PROTO_UDP)) { if(lpi_plus_match_quic(ctx->current_is_c2s_flow, (const unsigned char *)payload, payload_sz)) { diff --git a/test/lpi_plus/test_expect/mixed_pcap.json b/test/lpi_plus/test_expect/mixed_pcap.json index cddc7e3..90bb9f0 100644 --- a/test/lpi_plus/test_expect/mixed_pcap.json +++ b/test/lpi_plus/test_expect/mixed_pcap.json @@ -288,4 +288,11 @@ "l7_label_id": "UNKNOWN", "STREAM_DIR": "DOUBLE", "name": "APP_PROTO_IDENTIFY_RESULT_42" + }, { + "Tuple4": "192.168.58.54:56122-162.159.198.1:1701-17-0", + "STREAM_TYPE": "UDP", + "l7_label_id": [2521], + "l7_label_name": ["QUIC"], + "STREAM_DIR": "DOUBLE", + "name": "APP_PROTO_IDENTIFY_RESULT_43" }] diff --git a/test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap b/test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap new file mode 100644 index 0000000..b004a85 Binary files /dev/null and b/test/lpi_plus/test_pcap/mixed_pcap/40-quic-masque.pcap differ -- cgit v1.2.3