aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--CHANGELOG.md31
-rwxr-xr-xautogen.sh2
-rw-r--r--src/include/ndpi_api.h5
-rw-r--r--src/include/ndpi_protocol_ids.h2
-rw-r--r--src/lib/ndpi_content_match.c.inc2
-rw-r--r--src/lib/ndpi_main.c69
-rw-r--r--src/lib/protocols/dns.c14
-rw-r--r--src/lib/protocols/mdns_proto.c29
-rw-r--r--src/lib/protocols/mining.c18
-rw-r--r--wireshark/ndpi.lua48
10 files changed, 141 insertions, 79 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 930cb4c3b..fabdd2e95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,36 @@
# CHANGELOG
+#### nDPI 2.8 (March 2019)
+
+## New Supported Protocols and Services
+
+* Added Modbus over TCP dissector
+
+## Improvements
+
+* Wireshark Lua plugin compatibility with Wireshark 3
+* Improved MDNS dissection
+* Improved HTTP response code handling
+* Full dissection of HTTP responses
+
+## Fixes
+
+* Fixed false positive mining detection
+* Fixed invalid TCP DNS dissection
+* Releasing buffers upon `realloc` failures
+* ndpiReader: Prevents references after free
+* Endianness fixes
+* Fixed IPv6 HTTP traffic dissection
+* Fixed H.323 detection
+
+## Other
+
+* Disabled ookla statistics which need to be improved
+* Support for custom protocol files of arbitrary length
+* Update radius.c to RFC2865
+
+------------------------------------------------------------------------
+
#### nDPI 2.6 (December 2018)
## New Supported Protocols and Services
diff --git a/autogen.sh b/autogen.sh
index 9f376febc..03c51630c 100755
--- a/autogen.sh
+++ b/autogen.sh
@@ -1,7 +1,7 @@
#!/bin/sh
NDPI_MAJOR="2"
-NDPI_MINOR="7"
+NDPI_MINOR="9"
NDPI_PATCH="0"
NDPI_VERSION_SHORT="$NDPI_MAJOR.$NDPI_MINOR.$NDPI_PATCH"
diff --git a/src/include/ndpi_api.h b/src/include/ndpi_api.h
index e09c91c8e..386d306fd 100644
--- a/src/include/ndpi_api.h
+++ b/src/include/ndpi_api.h
@@ -740,8 +740,11 @@ extern "C" {
char *name, ndpi_protocol_category_t category);
int ndpi_enable_loaded_categories(struct ndpi_detection_module_struct *ndpi_struct);
int ndpi_fill_ip_protocol_category(struct ndpi_detection_module_struct *ndpi_struct,
- const struct ndpi_iphdr *iph,
+ u_int32_t saddr,
+ u_int32_t daddr,
ndpi_protocol *ret);
+ int ndpi_match_custom_category(struct ndpi_detection_module_struct *ndpi_struct,
+ char *name, unsigned long *id);
void ndpi_fill_protocol_category(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
ndpi_protocol *ret);
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index 7545de436..1d9c1d428 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -85,7 +85,7 @@ typedef enum {
NDPI_PROTOCOL_XBOX = 47,
NDPI_PROTOCOL_QQ = 48,
- NDPI_PROTOCOL_FREE_49 = 49, /* Free */
+ NDPI_PROTOCOL_TIKTOK = 49,
NDPI_PROTOCOL_RTSP = 50,
NDPI_PROTOCOL_MAIL_IMAPS = 51,
NDPI_PROTOCOL_ICECAST = 52,
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 8daa8a825..8f7fc2337 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -8420,6 +8420,8 @@ ndpi_protocol_match host_match[] = {
{ "signal.org", NULL, "signal\\.org" TLD, "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE },
{ "whispersystems.org", NULL, "whispersystems\\.org" TLD, "Signal", NDPI_PROTOCOL_SIGNAL, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE },
+ { "musical.ly", NULL, "musical\\.ly" TLD, "TikTok", NDPI_PROTOCOL_TIKTOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_ACCEPTABLE },
+ { "muscdn.com", NULL, "muscndl\\.com" TLD, "TikTok", NDPI_PROTOCOL_TIKTOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_ACCEPTABLE },
{ NULL, NULL, NULL, 0 }
};
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 01b25a1b8..936f47dac 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1198,14 +1198,9 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "SkypeCall", NDPI_PROTOCOL_CATEGORY_VOIP,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_49,
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TIKTOK,
0 /* can_have_a_subprotocol */, no_master,
- no_master, "Free_49", NDPI_PROTOCOL_CATEGORY_VOIP,
- ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
- ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
- ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FREE_49,
- 0 /* can_have_a_subprotocol */, no_master,
- no_master, "SkypeCall", NDPI_PROTOCOL_CATEGORY_VOIP,
+ no_master, "TikTok", NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TEREDO,
@@ -1991,21 +1986,42 @@ static int ac_match_handler(AC_MATCH_t *m, AC_TEXT_t *txt, AC_REP_t *match) {
m->match_num, m->patterns->astring);
#endif
+ {
+ char *whatfound = strstr(buf, m->patterns->astring);
+
+#ifdef MATCH_DEBUG
+ printf("[NDPI] %s() [searching=%s][pattern=%s][%s][%c]\n",
+ __FUNCTION__, buf, m->patterns->astring,
+ whatfound ? whatfound : "<NULL>",
+ whatfound[-1]);
+#endif
+
+ /*
+ The patch below allows in case of pattern ws.amazon.com
+ to avoid matching aws.amazon.com whereas a.ws.amazon.com
+ has to match
+ */
+ if(whatfound && (whatfound != buf)
+ && (m->patterns->astring[0] != '.') /* The searched patter does not start with . */
+ && strchr(m->patterns->astring, '.') /* The matched pattern has a . (e.g. numeric or sym IPs) */
+ && (whatfound[-1] != '.')
+ )
+ return(0);
+ }
+
/*
Return 1 for stopping to the first match.
We might consider searching for the more
specific match, paying more cpu cycles.
*/
-
memcpy(match, &m->patterns[0].rep, sizeof(AC_REP_t));
if(((buf_len >= min_len) && (strncmp(&buf[buf_len-min_len], m->patterns->astring, min_len) == 0))
|| (strncmp(buf, m->patterns->astring, min_len) == 0) /* begins with */
- )
- {
+ ) {
#ifdef MATCH_DEBUG
printf("Found match [%s][%s] [len: %u][proto_id: %u]\n",
- buf, m->patterns->astring, min_len, *matching_protocol_id);
+ buf, m->patterns->astring, min_len , *matching_protocol_id);
#endif
return(1); /* If the pattern found matches the string at the beginning we stop here */
} else
@@ -2301,8 +2317,8 @@ int ndpi_match_string(void *_automa, char *string_to_match) {
int ndpi_match_string_id(void *_automa, char *string_to_match, unsigned long *id) {
AC_TEXT_t ac_input_text;
AC_AUTOMATA_t *automa = (AC_AUTOMATA_t*)_automa;
- AC_REP_t match = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED, NDPI_PROTOCOL_UNRATED };
-
+ AC_REP_t match = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED, NDPI_PROTOCOL_UNRATED };
+
*id = -1;
if((automa == NULL)
|| (string_to_match == NULL)
@@ -2338,11 +2354,14 @@ static int hyperscanCustomEventHandler(unsigned int id,
/* *********************************************** */
-static int ndpi_match_custom_category(struct ndpi_detection_module_struct *ndpi_struct,
+int ndpi_match_custom_category(struct ndpi_detection_module_struct *ndpi_struct,
char *name, unsigned long *id) {
- /* printf("[NDPI] %s(%s)\n", __FUNCTION__, name); */
+#ifdef DEBUG
+ printf("[NDPI] %s(%s) [enable_category_substring_match: %u]\n",
+ __FUNCTION__, name, ndpi_struct->enable_category_substring_match);
+#endif
- if(!ndpi_struct->enable_category_substring_match) {
+ if(ndpi_struct->enable_category_substring_match == 0) {
if(ndpi_struct->custom_categories.hostnames_hash == NULL)
return(-1);
else {
@@ -2731,7 +2750,8 @@ int ndpi_handle_rule(struct ndpi_detection_module_struct *ndpi_mod,
if(sscanf(value, "%u-%u", (u_int32_t *)&range.port_low, (u_int32_t *)&range.port_high) != 2)
range.port_low = range.port_high = atoi(&elem[4]);
if(do_add)
- addDefaultPort(ndpi_mod, &range, def, 1 /* Custom user proto */, is_tcp ? &ndpi_mod->tcpRoot : &ndpi_mod->udpRoot, __FUNCTION__,__LINE__);
+ addDefaultPort(ndpi_mod, &range, def, 1 /* Custom user proto */,
+ is_tcp ? &ndpi_mod->tcpRoot : &ndpi_mod->udpRoot, __FUNCTION__,__LINE__);
else
removeDefaultPort(&range, def, is_tcp ? &ndpi_mod->tcpRoot : &ndpi_mod->udpRoot);
} else if(is_ip) {
@@ -4358,19 +4378,20 @@ int ndpi_enable_loaded_categories(struct ndpi_detection_module_struct *ndpi_str)
/* ********************************************************************************* */
int ndpi_fill_ip_protocol_category(struct ndpi_detection_module_struct *ndpi_struct,
- const struct ndpi_iphdr *iph,
+ u_int32_t saddr,
+ u_int32_t daddr,
ndpi_protocol *ret) {
if(ndpi_struct->custom_categories.categories_loaded) {
prefix_t prefix;
patricia_node_t *node;
-
+
/* Make sure all in network byte order otherwise compares wont work */
- fill_prefix_v4(&prefix, (struct in_addr *)&iph->saddr,
+ fill_prefix_v4(&prefix, (struct in_addr *)&saddr,
32, ((patricia_tree_t*)ndpi_struct->protocols_ptree)->maxbits);
node = ndpi_patricia_search_best(ndpi_struct->custom_categories.ipAddresses, &prefix);
if(!node) {
- fill_prefix_v4(&prefix, (struct in_addr *)&iph->daddr,
+ fill_prefix_v4(&prefix, (struct in_addr *)&daddr,
32, ((patricia_tree_t*)ndpi_struct->protocols_ptree)->maxbits);
node = ndpi_patricia_search_best(ndpi_struct->custom_categories.ipAddresses, &prefix);
}
@@ -4385,12 +4406,14 @@ int ndpi_fill_ip_protocol_category(struct ndpi_detection_module_struct *ndpi_str
return 0;
}
+/* ********************************************************************************* */
+
void ndpi_fill_protocol_category(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow,
ndpi_protocol *ret) {
if(ndpi_struct->custom_categories.categories_loaded) {
if(flow->packet.iph) {
- if(ndpi_fill_ip_protocol_category(ndpi_struct, flow->packet.iph, ret)) {
+ if(ndpi_fill_ip_protocol_category(ndpi_struct, flow->packet.iph->saddr, flow->packet.iph->daddr, ret)) {
flow->category = ret->category;
return;
}
@@ -4435,7 +4458,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
if(ndpi_struct->ndpi_log_level >= NDPI_LOG_TRACE)
NDPI_LOG(flow ? flow->detected_protocol_stack[0]:NDPI_PROTOCOL_UNKNOWN,
- ndpi_struct, NDPI_LOG_TRACE, "START packet processing\n");
+ ndpi_struct, NDPI_LOG_TRACE, "START packet processing\n");
if(flow == NULL)
return(ret);
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index f77040020..e282eb4d3 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -63,7 +63,7 @@ static u_int getNameLength(u_int i, const u_int8_t *payload, u_int payloadLen) {
/* *********************************************** */
void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
- int x;
+ int x, payload_offset;
u_int8_t is_query;
u_int16_t s_port = 0, d_port = 0;
@@ -72,16 +72,18 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
if(flow->packet.udp != NULL) {
s_port = ntohs(flow->packet.udp->source);
d_port = ntohs(flow->packet.udp->dest);
- x = 0;
+ payload_offset = 0;
} else if(flow->packet.tcp != NULL) /* pkt size > 512 bytes */ {
s_port = ntohs(flow->packet.tcp->source);
d_port = ntohs(flow->packet.tcp->dest);
- x = 2;
+ payload_offset = 2;
} else {
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
return;
}
+ x = payload_offset;
+
if((s_port == 53 || d_port == 53 || d_port == 5355)
&& (flow->packet.payload_packet_len > sizeof(struct ndpi_dns_packet_header)+x)) {
struct ndpi_dns_packet_header dns_header;
@@ -175,7 +177,8 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
}
}
}
- }
+ } else
+ invalid = 1;
}
if(invalid) {
@@ -184,8 +187,7 @@ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct nd
}
/* extract host name server */
- int j = 0, max_len = sizeof(flow->host_server_name)-1, off = sizeof(struct ndpi_dns_packet_header) + 1;
-
+ int j = 0, max_len = sizeof(flow->host_server_name)-1, off = sizeof(struct ndpi_dns_packet_header) + 1 + payload_offset;
while(off < flow->packet.payload_packet_len && flow->packet.payload[off] != '\0') {
flow->host_server_name[j] = flow->packet.payload[off];
if(j < max_len) {
diff --git a/src/lib/protocols/mdns_proto.c b/src/lib/protocols/mdns_proto.c
index 00c7c8748..75eab720b 100644
--- a/src/lib/protocols/mdns_proto.c
+++ b/src/lib/protocols/mdns_proto.c
@@ -63,17 +63,15 @@ static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
struct ndpi_packet_struct *packet = &flow->packet;
struct mdns_header *h = (struct mdns_header*)packet->payload;
u_int16_t questions = ntohs(h->questions), answers = ntohs(h->answers);
+
+ if((questions > NDPI_MAX_MDNS_REQUESTS)
+ || (answers > NDPI_MAX_MDNS_REQUESTS))
+ return(0);
- if(((packet->payload[2] & 0x80) == 0)
- && (questions <= NDPI_MAX_MDNS_REQUESTS)
- && (answers <= NDPI_MAX_MDNS_REQUESTS)) {
+ if((packet->payload[2] & 0x80) == 0) {
NDPI_LOG_INFO(ndpi_struct, "found MDNS with question query\n");
return 1;
- }
- else if(((packet->payload[2] & 0x80) != 0)
- && (questions == 0)
- && (answers <= NDPI_MAX_MDNS_REQUESTS)
- && (answers != 0)) {
+ } else if((packet->payload[2] & 0x80) != 0) {
char answer[256];
int i, j, len;
@@ -100,8 +98,6 @@ static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow)
{
struct ndpi_packet_struct *packet = &flow->packet;
- u_int16_t dport;
-
NDPI_LOG_DBG(ndpi_struct, "search MDNS\n");
/**
@@ -111,15 +107,13 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
/* check if UDP packet */
if(packet->udp != NULL) {
/* read destination port */
- dport = ntohs(packet->udp->dest);
+ u_int16_t sport = ntohs(packet->udp->source);
+ u_int16_t dport = ntohs(packet->udp->dest);
/* check standard MDNS ON port 5353 */
- if(dport == 5353 && packet->payload_packet_len >= 12) {
- /* mdns protocol must have destination address 224.0.0.251 */
- if(packet->iph != NULL /* && ntohl(packet->iph->daddr) == 0xe00000fb */) {
-
- NDPI_LOG_INFO(ndpi_struct, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
-
+ if(((dport == 5353) || (sport == 5353))
+ && (packet->payload_packet_len >= 12)) {
+ if(packet->iph != NULL) {
if(ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) {
ndpi_int_mdns_add_connection(ndpi_struct, flow);
return;
@@ -141,6 +135,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
#endif
}
}
+
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}
diff --git a/src/lib/protocols/mining.c b/src/lib/protocols/mining.c
index ec094e7d3..b4361e270 100644
--- a/src/lib/protocols/mining.c
+++ b/src/lib/protocols/mining.c
@@ -44,9 +44,12 @@ void ndpi_search_mining_tcp(struct ndpi_detection_module_struct *ndpi_struct,
if((*to_match == magic) || (*to_match == magic1)) {
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN);
}
- } if(ndpi_strnstr((const char *)packet->payload, "\"eth1.0\"", packet->payload_packet_len)
- || ndpi_strnstr((const char *)packet->payload, "\"worker\"", packet->payload_packet_len)
- || ndpi_strnstr((const char *)packet->payload, "\"id\"", packet->payload_packet_len)) {
+ } if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
+ && (
+ ndpi_strnstr((const char *)packet->payload, "\"eth1.0\"", packet->payload_packet_len)
+ || ndpi_strnstr((const char *)packet->payload, "\"worker\":", packet->payload_packet_len)
+ /* || ndpi_strnstr((const char *)packet->payload, "\"id\":", packet->payload_packet_len) - Removed as too generic */
+ )) {
/*
Ethereum
@@ -55,9 +58,12 @@ void ndpi_search_mining_tcp(struct ndpi_detection_module_struct *ndpi_struct,
{"worker": "", "jsonrpc": "2.0", "params": [], "id": 3, "method": "eth_getWork"}
*/
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MINING, NDPI_PROTOCOL_UNKNOWN);
- } else if(ndpi_strnstr((const char *)packet->payload, "\"method\"", packet->payload_packet_len)
- || ndpi_strnstr((const char *)packet->payload, "\"blob\"", packet->payload_packet_len)
- || ndpi_strnstr((const char *)packet->payload, "\"id\"", packet->payload_packet_len)) {
+ } else if(ndpi_strnstr((const char *)packet->payload, "{", packet->payload_packet_len)
+ && (ndpi_strnstr((const char *)packet->payload, "\"method\":", packet->payload_packet_len)
+ || ndpi_strnstr((const char *)packet->payload, "\"blob\":", packet->payload_packet_len)
+ /* || ndpi_strnstr((const char *)packet->payload, "\"id\":", packet->payload_packet_len) - Removed as too generic */
+ )
+ ) {
/*
ZCash
diff --git a/wireshark/ndpi.lua b/wireshark/ndpi.lua
index 56fc01050..6038d8965 100644
--- a/wireshark/ndpi.lua
+++ b/wireshark/ndpi.lua
@@ -51,7 +51,7 @@ local f_udp_len = Field.new("udp.length")
local f_tcp_header_len = Field.new("tcp.hdr_len")
local f_ip_len = Field.new("ip.len")
local f_ip_hdr_len = Field.new("ip.hdr_len")
-local f_ssl_server_name = Field.new("ssl.handshake.extensions_server_name")
+local f_tls_server_name = Field.new("tls.handshake.extensions_server_name")
local f_tcp_flags = Field.new('tcp.flags')
local f_tcp_retrans = Field.new('tcp.analysis.retransmission')
local f_tcp_ooo = Field.new('tcp.analysis.out_of_order')
@@ -59,7 +59,7 @@ local f_tcp_lost_segment = Field.new('tcp.analysis.lost_segment') -- packet dro
local f_rpc_xid = Field.new('rpc.xid')
local f_rpc_msgtyp = Field.new('rpc.msgtyp')
local f_user_agent = Field.new('http.user_agent')
-local f_dhcp_request_item = Field.new('bootp.option.request_list_item')
+local f_dhcp_request_item = Field.new('dhcp.option.request_list_item')
local ndpi_protos = {}
local ndpi_flows = {}
@@ -88,8 +88,8 @@ local max_num_flows = 50
local num_top_dns_queries = 0
local max_num_dns_queries = 50
-local ssl_server_names = {}
-local tot_ssl_flows = 0
+local tls_server_names = {}
+local tot_tls_flows = 0
local http_ua = {}
local tot_http_ua_flows = 0
@@ -329,9 +329,9 @@ function ndpi_proto.init()
syn = {}
synack = {}
- -- SSL
- ssl_server_names = {}
- tot_ssl_flows = 0
+ -- TLS
+ tls_server_names = {}
+ tot_tls_flows = 0
-- HTTP
http_ua = {}
@@ -522,17 +522,17 @@ end
-- ###############################################
-function ssl_dissector(tvb, pinfo, tree)
- local ssl_server_name = f_ssl_server_name()
- if(ssl_server_name ~= nil) then
- ssl_server_name = getval(ssl_server_name)
+function tls_dissector(tvb, pinfo, tree)
+ local tls_server_name = f_tls_server_name()
+ if(tls_server_name ~= nil) then
+ tls_server_name = getval(tls_server_name)
- if(ssl_server_names[ssl_server_name] == nil) then
- ssl_server_names[ssl_server_name] = 0
+ if(tls_server_names[tls_server_name] == nil) then
+ tls_server_names[tls_server_name] = 0
end
- ssl_server_names[ssl_server_name] = ssl_server_names[ssl_server_name] + 1
- tot_ssl_flows = tot_ssl_flows + 1
+ tls_server_names[tls_server_name] = tls_server_names[tls_server_name] + 1
+ tot_tls_flows = tot_tls_flows + 1
end
end
@@ -989,7 +989,7 @@ function ndpi_proto.dissector(tvb, pinfo, tree)
mac_dissector(tvb, pinfo, tree)
arp_dissector(tvb, pinfo, tree)
vlan_dissector(tvb, pinfo, tree)
- ssl_dissector(tvb, pinfo, tree)
+ tls_dissector(tvb, pinfo, tree)
http_dissector(tvb, pinfo, tree)
dhcp_dissector(tvb, pinfo, tree)
dns_dissector(tvb, pinfo, tree)
@@ -1392,25 +1392,25 @@ end
-- ###############################################
-local function ssl_dialog_menu()
- local win = TextWindow.new("SSL Server Contacts");
+local function tls_dialog_menu()
+ local win = TextWindow.new("TLS Server Contacts");
local label = ""
local tot = 0
local i
- if(tot_ssl_flows > 0) then
+ if(tot_tls_flows > 0) then
i = 0
- label = label .. "SSL Server\t\t\t\t# Flows\n"
- for k,v in pairsByValues(ssl_server_names, rev) do
+ label = label .. "TLS Server\t\t\t\t# Flows\n"
+ for k,v in pairsByValues(tls_server_names, rev) do
local pctg
v = tonumber(v)
- pctg = formatPctg((v * 100) / tot_ssl_flows)
+ pctg = formatPctg((v * 100) / tot_tls_flows)
label = label .. string.format("%-32s", shortenString(k,32)).."\t"..v.." [".. pctg.." %]\n"
if(i == 50) then break else i = i + 1 end
end
else
- label = "No SSL server certificates detected"
+ label = "No TLS server certificates detected"
end
win:set(label)
@@ -1465,7 +1465,7 @@ register_menu("ntop/DNS", dns_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/HTTP UA", http_ua_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/Flows", flows_ua_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/IP-MAC", ip_mac_dialog_menu, MENU_TOOLS_UNSORTED)
-register_menu("ntop/SSL", ssl_dialog_menu, MENU_TOOLS_UNSORTED)
+register_menu("ntop/TLS", tls_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/TCP Analysis", tcp_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/VLAN", vlan_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/Latency/Network", rtt_dialog_menu, MENU_TOOLS_UNSORTED)
Powered by cgit, Themed by Ted Yin.