Avoid useless host automa lookup (#1724)

The host automa is used for two tasks:
* protocol sub-classification (obviously);
* DGA evaluation: the idea is that if a domain is present in this
automa, it can't be a DGA, regardless of its format/name.

In most dissectors both checks are executed, i.e. the code is something
like:

```
ndpi_match_host_subprotocol(..., flow->host_server_name, ...);
ndpi_check_dga_name(..., flow->host_server_name,...);

```

In that common case, we can perform only one automa lookup: if we check the
sub-classification before the DGA, we can avoid the second lookup in
the DGA function itself.

8 files changed, 14 insertions, 11 deletions

diff --git a/src/include/ndpi_api.h.in b/src/include/ndpi_api.h.in
index 0fd177557..cf6c1e469 100644
--- a/src/include/ndpi_api.h.in
+++ b/src/include/ndpi_api.h.in
@@ -1149,7 +1149,7 @@ extern "C" {
   /* DGA */
   int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
 			  struct ndpi_flow_struct *flow,
-			  char *name, u_int8_t is_hostname);
+			  char *name, u_int8_t is_hostname, u_int8_t check_subproto);
 
   /* Serializer (supports JSON, TLV, CSV) */
 
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index fed529297..1f47daa7c 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -8511,7 +8511,7 @@ static int ndpi_is_vowel(char c) {
 
 int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
 			struct ndpi_flow_struct *flow,
-			char *name, u_int8_t is_hostname) {
+			char *name, u_int8_t is_hostname, u_int8_t check_subproto) {
   if(ndpi_dga_function != NULL) {
     /* A custom DGA function is defined */
     int rc = ndpi_dga_function(name, is_hostname);
@@ -8542,7 +8542,8 @@ int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
     if(flow && (flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN))
       return(0); /* Ignore DGA check for protocols already fully detected */
 
-    if(ndpi_match_string_subprotocol(ndpi_str, name, strlen(name), &ret_match) > 0)
+    if(check_subproto &&
+       ndpi_match_string_subprotocol(ndpi_str, name, strlen(name), &ret_match) > 0)
       return(0); /* Ignore DGA for known domain names */
 
     if(isdigit((int)name[0])) {
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index ecf283a77..e12ece12c 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -529,8 +529,6 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
     if(j > 0) {
       ndpi_protocol_match_result ret_match;
 
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
       ret.app_protocol = ndpi_match_host_subprotocol(ndpi_struct, flow,
 						     flow->host_server_name,
 						     strlen(flow->host_server_name),
@@ -544,6 +542,8 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
 	ret.master_protocol = checkDNSSubprotocol(s_port, d_port);
       else
 	ret.master_protocol = NDPI_PROTOCOL_DNS;
+
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
     }
 
     /* Report if this is a DNS query or reply */
diff --git a/src/lib/protocols/fastcgi.c b/src/lib/protocols/fastcgi.c
index 9fad2c044..f70bd6cf5 100644
--- a/src/lib/protocols/fastcgi.c
+++ b/src/lib/protocols/fastcgi.c
@@ -212,7 +212,7 @@ void ndpi_search_fastcgi(struct ndpi_detection_module_struct *ndpi_struct,
                                   strlen(flow->host_server_name),
                                   &ret_match, NDPI_PROTOCOL_FASTCGI);
       ndpi_check_dga_name(ndpi_struct, flow,
-                          flow->host_server_name, 1);
+                          flow->host_server_name, 1, 0);
       if(ndpi_is_valid_hostname(flow->host_server_name,
                                 strlen(flow->host_server_name)) == 0) {
         char str[128];
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 6fe6cab33..f9d6abd90 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -722,8 +722,6 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
     ndpi_hostname_sni_set(flow, packet->host_line.ptr, packet->host_line.len);
 
     if(strlen(flow->host_server_name) > 0) {
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
       if(ndpi_is_valid_hostname(flow->host_server_name,
 				strlen(flow->host_server_name)) == 0) {
 	char str[128];
@@ -749,6 +747,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
 
     ndpi_http_parse_subprotocol(ndpi_struct, flow);
 
+    if(strlen(flow->host_server_name) > 0) {
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
+    }
+
     /**
        check result of host subprotocol detection
 
diff --git a/src/lib/protocols/netbios.c b/src/lib/protocols/netbios.c
index 710f18a71..45119ecbf 100644
--- a/src/lib/protocols/netbios.c
+++ b/src/lib/protocols/netbios.c
@@ -104,7 +104,7 @@ static void ndpi_int_netbios_add_connection(struct ndpi_detection_module_struct
 		 (u_int)(packet->payload_packet_len - off), name, sizeof(name)-1) > 0) {
       ndpi_hostname_sni_set(flow, (const u_int8_t *)name, strlen((char *)name));
 
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 1);
   }
 
   if(sub_protocol == NDPI_PROTOCOL_UNKNOWN)
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index af43bf7e5..7889dad4d 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1391,7 +1391,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
       flow->protos.tls_quic.hello_processed = 1; /* Allow matching of custom categories */
 
       ndpi_check_dga_name(ndpi_struct, flow,
-                          flow->host_server_name, 1);
+                          flow->host_server_name, 1, 0);
 
       if(ndpi_is_valid_hostname(flow->host_server_name,
 				strlen(flow->host_server_name)) == 0) {
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 98a8d8208..fe36555ed 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -1923,7 +1923,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
 		    }
 
 		    if(ndpi_check_dga_name(ndpi_struct, flow,
-					   sni, 1)) {
+					   sni, 1, 0)) {
 #ifdef DEBUG_TLS
 		      printf("[TLS] SNI: (DGA) [%s]\n", sni);
 #endif