diff options
Diffstat (limited to 'src/lib/ndpi_main.c')
| -rw-r--r-- | src/lib/ndpi_main.c | 42 |
1 files changed, 22 insertions, 20 deletions
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index f29fc9322..cd24e52df 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -72,33 +72,33 @@ static ndpi_risk_info ndpi_known_risks[] = { { NDPI_URL_POSSIBLE_SQL_INJECTION, NDPI_RISK_SEVERE, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_URL_POSSIBLE_RCE_INJECTION, NDPI_RISK_SEVERE, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_BINARY_APPLICATION_TRANSFER, NDPI_RISK_SEVERE, CLIENT_FAIR_RISK_PERCENTAGE }, - { NDPI_KNOWN_PROTOCOL_ON_NON_STANDARD_PORT, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, - { NDPI_TLS_SELFSIGNED_CERTIFICATE, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, - { NDPI_TLS_OBSOLETE_VERSION, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, - { NDPI_TLS_WEAK_CIPHER, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_KNOWN_PROTOCOL_ON_NON_STANDARD_PORT, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, + { NDPI_TLS_SELFSIGNED_CERTIFICATE, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_TLS_OBSOLETE_VERSION, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_TLS_WEAK_CIPHER, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_TLS_CERTIFICATE_EXPIRED, NDPI_RISK_HIGH, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_TLS_CERTIFICATE_MISMATCH, NDPI_RISK_HIGH, CLIENT_FAIR_RISK_PERCENTAGE }, - { NDPI_HTTP_SUSPICIOUS_USER_AGENT, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_HTTP_SUSPICIOUS_USER_AGENT, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_HTTP_NUMERIC_IP_HOST, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_HTTP_SUSPICIOUS_URL, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, - { NDPI_HTTP_SUSPICIOUS_HEADER, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_HTTP_SUSPICIOUS_HEADER, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_TLS_NOT_CARRYING_HTTPS, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_SUSPICIOUS_DGA_DOMAIN, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_MALFORMED_PACKET, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, - { NDPI_SSH_OBSOLETE_CLIENT_VERSION_OR_CIPHER, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_SSH_OBSOLETE_CLIENT_VERSION_OR_CIPHER, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_SSH_OBSOLETE_SERVER_VERSION_OR_CIPHER, NDPI_RISK_MEDIUM, CLIENT_LOW_RISK_PERCENTAGE }, - { NDPI_SMB_INSECURE_VERSION, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, - { NDPI_TLS_SUSPICIOUS_ESNI_USAGE, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_SMB_INSECURE_VERSION, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_TLS_SUSPICIOUS_ESNI_USAGE, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_UNSAFE_PROTOCOL, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, - { NDPI_DNS_SUSPICIOUS_TRAFFIC, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, - { NDPI_TLS_MISSING_SNI, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, - { NDPI_HTTP_SUSPICIOUS_CONTENT, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_DNS_SUSPICIOUS_TRAFFIC, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_TLS_MISSING_SNI, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, + { NDPI_HTTP_SUSPICIOUS_CONTENT, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_RISKY_ASN, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_RISKY_DOMAIN, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, - { NDPI_MALICIOUS_JA3, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_MALICIOUS_JA3, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_MALICIOUS_SHA1_CERTIFICATE, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_DESKTOP_OR_FILE_SHARING_SESSION, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, - { NDPI_TLS_UNCOMMON_ALPN, NDPI_RISK_MEDIUM, CLIENT_HIGH_RISK_PERCENTAGE }, + { NDPI_TLS_UNCOMMON_ALPN, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_TLS_CERT_VALIDITY_TOO_LONG, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_TLS_SUSPICIOUS_EXTENSION, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_TLS_FATAL_ALERT, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE }, @@ -7433,10 +7433,12 @@ static int enough(int a, int b) { /* ******************************************************************** */ -static u_int8_t endsWith(char *str, char *ends, u_int8_t ends_len) { +u_int8_t ndpi_ends_with(char *str, char *ends) { u_int str_len = str ? strlen(str) : 0; + u_int8_t ends_len = strlen(ends); u_int8_t rc; + if(str_len < ends_len) return(0); rc = (strncmp(&str[str_len-ends_len], ends, ends_len) != 0) ? 0 : 1; @@ -7499,12 +7501,12 @@ int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str, if((!name) || (strchr(name, '_') != NULL) - || (endsWith(name, "in-addr.arpa", 12)) - || (endsWith(name, "ip6.arpa", 8)) + || (ndpi_ends_with(name, "in-addr.arpa")) + || (ndpi_ends_with(name, "ip6.arpa")) /* Ignore TLD .local .lan and .home */ - || (endsWith(name, ".local", 6)) - || (endsWith(name, ".lan", 4)) - || (endsWith(name, ".home", 5)) + || (ndpi_ends_with(name, ".local")) + || (ndpi_ends_with(name, ".lan")) + || (ndpi_ends_with(name, ".home")) ) return(0); |