diff options
Diffstat (limited to 'src/lib/protocols/quic.c')
| -rw-r--r-- | src/lib/protocols/quic.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c index df32926db..32347b9c1 100644 --- a/src/lib/protocols/quic.c +++ b/src/lib/protocols/quic.c @@ -1389,6 +1389,14 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct, ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1); + if(ndpi_is_valid_hostname(flow->host_server_name, + strlen(flow->host_server_name)) == 0) { + ndpi_set_risk(ndpi_struct, flow, NDPI_INVALID_CHARACTERS); + + /* This looks like an attack */ + ndpi_set_risk(ndpi_struct, flow, NDPI_POSSIBLE_EXPLOIT); + } + sni_found = 1; if (ua_found) return; |