Finds the best match for the given signature and direction. If a match is found, returns a tuple consisting of: - label: the matched label - dishonest: whether the software was detected as dishonest Returns None if no match was found
(self, ts, direction)
| 505 | return None |
| 506 | |
| 507 | def http_find_match(self, ts, direction): |
| 508 | """ |
| 509 | Finds the best match for the given signature and direction. |
| 510 | If a match is found, returns a tuple consisting of: |
| 511 | - label: the matched label |
| 512 | - dishonest: whether the software was detected as dishonest |
| 513 | Returns None if no match was found |
| 514 | """ |
| 515 | gmatch = None # generic match |
| 516 | for http_record in self.base["http"][direction]: |
| 517 | rs = http_record.sig |
| 518 | |
| 519 | if rs.http_ver != -1 and rs.http_ver != ts.http_ver: |
| 520 | continue |
| 521 | |
| 522 | # Check that all non-optional headers appear in the packet |
| 523 | if not (ts.hdr_set & rs.hdr_set) == rs.hdr_set: |
| 524 | continue |
| 525 | |
| 526 | # Check that no forbidden headers appear in the packet. |
| 527 | if len(rs.habsent & ts.hdr_set) > 0: |
| 528 | continue |
| 529 | |
| 530 | def headers_correl(): |
| 531 | phi = 0 # Packet HTTP header index |
| 532 | hdr_len = len(ts.hdr) |
| 533 | |
| 534 | # Confirm the ordering and values of headers |
| 535 | # (this is relatively slow, hence the if statements above). |
| 536 | # The algorithm is derived from the original p0f/fp_http.c |
| 537 | for kh in rs.hdr: |
| 538 | orig_phi = phi |
| 539 | while (phi < hdr_len and |
| 540 | kh[0] != ts.hdr[phi][0]): |
| 541 | phi += 1 |
| 542 | |
| 543 | if phi == hdr_len: |
| 544 | if not kh[2]: |
| 545 | return False |
| 546 | |
| 547 | for ph in ts.hdr: |
| 548 | if kh[0] == ph[0]: |
| 549 | return False |
| 550 | |
| 551 | phi = orig_phi |
| 552 | continue |
| 553 | |
| 554 | if kh[1] not in ts.hdr[phi][1]: |
| 555 | return False |
| 556 | phi += 1 |
| 557 | return True |
| 558 | |
| 559 | if not headers_correl(): |
| 560 | continue |
| 561 | |
| 562 | # Got a match |
| 563 | label = self.labels[http_record.label_id] |
| 564 | dishonest = rs.sw and ts.sw and rs.sw not in ts.sw |