dnp3: more precise probing for banners

diff --git a/src/app-layer-dnp3.c b/src/app-layer-dnp3.c
index 5c04ea19fc60bdc26c567ad7c77466d7e7e4ea90..025afd69fcd81ab9e01fe8f4ccda5abf8177ab12 100644 (file)
--- a/src/app-layer-dnp3.c
+++ b/src/app-layer-dnp3.c
@@ -277,10 +277,20 @@ static uint16_t DNP3ProbingParser(Flow *f, uint8_t direction,
     /* May be a banner. */
     if (DNP3ContainsBanner(input, len)) {
         SCLogDebug("Packet contains a DNP3 banner.");
-        if (toserver) {
-            *rdir = STREAM_TOCLIENT;
+        bool is_banner = true;
+        // magic 0x100 = 256 seems good enough
+        for (uint32_t i = 0; i < len && i < 0x100; i++) {
+            if (!isprint(input[i])) {
+                is_banner = false;
+                break;
+            }
+        }
+        if (is_banner) {
+            if (toserver) {
+                *rdir = STREAM_TOCLIENT;
+            }
+            return ALPROTO_DNP3;
         }
-        return ALPROTO_DNP3;
     }
 
     /* Check that we have the minimum amount of bytes. */