aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_api.h.in33
-rw-r--r--src/include/ndpi_protocol_ids.h1
-rw-r--r--src/lib/ndpi_content_match.c.inc57
-rw-r--r--src/lib/ndpi_main.c147
-rw-r--r--src/lib/ndpi_serializer.c7
-rw-r--r--src/lib/protocols/dns.c3
-rw-r--r--src/lib/protocols/http.c2
-rw-r--r--src/lib/protocols/netbios.c5
-rw-r--r--src/lib/protocols/tls.c4
9 files changed, 196 insertions, 63 deletions
diff --git a/src/include/ndpi_api.h.in b/src/include/ndpi_api.h.in
index 8f6738920..0b8ff24b5 100644
--- a/src/include/ndpi_api.h.in
+++ b/src/include/ndpi_api.h.in
@@ -280,13 +280,13 @@ extern "C" {
* (like SSL getting both client and server certificate even if we already know after
* seeing the client certificate what the protocol is)
*
- * @par ndpi_struct = the detection module
- * @par flow = pointer to the connection state machine
- * @par packet = unsigned char pointer to the Layer 3 (IP header)
- * @par packetlen = the length of the packet
- * @par current_tick = the current timestamp for the packet
- * @par src = pointer to the source subscriber state machine
- * @par dst = pointer to the destination subscriber state machine
+ * @par ndpi_struct = the detection module
+ * @par flow = pointer to the connection state machine
+ * @par packet = unsigned char pointer to the Layer 3 (IP header)
+ * @par packetlen = the length of the packet
+ * @par packet_time_ms = the current timestamp for the packet (expressed in msec)
+ * @par src = pointer to the source subscriber state machine
+ * @par dst = pointer to the destination subscriber state machine
* @return void
*
*/
@@ -294,7 +294,7 @@ extern "C" {
struct ndpi_flow_struct *flow,
const unsigned char *packet,
const unsigned short packetlen,
- const u_int64_t current_tick,
+ const u_int64_t packet_time_ms,
struct ndpi_id_struct *src,
struct ndpi_id_struct *dst);
@@ -302,13 +302,13 @@ extern "C" {
* Processes one packet and returns the ID of the detected protocol.
* This is the MAIN PACKET PROCESSING FUNCTION.
*
- * @par ndpi_struct = the detection module
- * @par flow = pointer to the connection state machine
- * @par packet = unsigned char pointer to the Layer 3 (IP header)
- * @par packetlen = the length of the packet
- * @par current_tick = the current timestamp for the packet
- * @par src = pointer to the source subscriber state machine
- * @par dst = pointer to the destination subscriber state machine
+ * @par ndpi_struct = the detection module
+ * @par flow = pointer to the connection state machine
+ * @par packet = unsigned char pointer to the Layer 3 (IP header)
+ * @par packetlen = the length of the packet
+ * @par packet_time_ms = the current timestamp for the packet (expressed in msec)
+ * @par src = pointer to the source subscriber state machine
+ * @par dst = pointer to the destination subscriber state machine
* @return the detected ID of the protocol
*
*/
@@ -316,7 +316,7 @@ extern "C" {
struct ndpi_flow_struct *flow,
const unsigned char *packet,
const unsigned short packetlen,
- const u_int64_t current_tick,
+ const u_int64_t packet_time_ms,
struct ndpi_id_struct *src,
struct ndpi_id_struct *dst);
/**
@@ -991,6 +991,7 @@ extern "C" {
u_int32_t ndpi_serializer_get_buffer_len(ndpi_serializer *serializer);
u_int32_t ndpi_serializer_get_internal_buffer_size(ndpi_serializer *serializer);
int ndpi_serializer_set_buffer_len(ndpi_serializer *serializer, u_int32_t l);
+ ndpi_serialization_format ndpi_serializer_get_format(ndpi_serializer *serializer);
void ndpi_serializer_set_csv_separator(ndpi_serializer *serializer, char separator);
char* ndpi_serializer_get_header(ndpi_serializer *serializer, u_int32_t *buffer_len);
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index e2951ec22..01f54c0f9 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -281,6 +281,7 @@ typedef enum {
NDPI_PROTOCOL_S7COMM = 249,
NDPI_PROTOCOL_MSTEAMS = 250,
NDPI_PROTOCOL_WEBSOCKET = 251, /* Leonn Paiva <leonn.paiva@gmail.com> */
+ NDPI_PROTOCOL_ANYDESK = 252, /* Toni Uhlig <matzeton@googlemail.com> */
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_protocol_ids.h"
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 148ee9443..7828c50f7 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -8390,6 +8390,14 @@ static ndpi_network host_protocol_list[] = {
{ 0xD0163900 /* 208.22.57.0/24 */, 24, NDPI_PROTOCOL_BLOOMBERG },
{ 0x45BFC000 /* 69.191.192.0/18 */, 18, NDPI_PROTOCOL_BLOOMBERG },
+ /* AnyDesk */
+ { 0x3353EF8E /* 51.83.239.142/31 */, 31, NDPI_PROTOCOL_ANYDESK },
+ { 0x3353EF90 /* 51.83.239.144/31 */, 31, NDPI_PROTOCOL_ANYDESK },
+ { 0x3353EEC8 /* 51.83.238.200/29 */, 29, NDPI_PROTOCOL_ANYDESK },
+ { 0x3353EED0 /* 51.83.238.208/29 */, 29, NDPI_PROTOCOL_ANYDESK },
+ { 0x3353EED8 /* 51.83.238.216/30 */, 30, NDPI_PROTOCOL_ANYDESK },
+ { 0x3353EEDC /* 51.83.238.220/31 */, 31, NDPI_PROTOCOL_ANYDESK },
+
/*
Microsoft
@@ -9127,6 +9135,8 @@ static ndpi_protocol_match host_match[] =
{ "brasilbandalarga.com.br", "EAQ", NDPI_PROTOCOL_EAQ, NDPI_PROTOCOL_CATEGORY_NETWORK, NDPI_PROTOCOL_ACCEPTABLE },
{ ".eaqbr.com.br", "EAQ", NDPI_PROTOCOL_EAQ, NDPI_PROTOCOL_CATEGORY_NETWORK, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".net.anydesk.com", "AnyDesk", NDPI_PROTOCOL_ANYDESK, NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, NDPI_PROTOCOL_ACCEPTABLE },
+
{ NULL, NULL, NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED, NDPI_PROTOCOL_SAFE }
};
@@ -9223,6 +9233,10 @@ static ndpi_category_match category_match[] = {
word or just random chars.
http://www3.nd.edu/~busiforc/handouts/cryptography/Letter%20Frequencies.html
+
+ DGA Datasets
+ - https://data.netlab.360.com/dga/
+ - https://github.com/baderj/domain_generation_algorithms
*/
static const char *ndpi_en_bigrams[] = {
@@ -9263,6 +9277,49 @@ static const char *ndpi_en_bigrams[] = {
/* ******************************************************************** */
+static const char *ndpi_en_popular_bigrams[] = {
+ "th", "he", "in", "er", "an", "re", "on", "at", "en", "nd", "ti", "es", "or", "te", "of", "ed", "is", "it",
+ "al", "ar", "st", "to", "nt", "ng", "se", "ha", "as", "ou", "io", "le", "ve", "co", "me", "de", "hi", "ri",
+ "ro", "ic", "ne", "ea", "ra", "ce", "li", "ch", "ll", "be", "ma", "si", "om", "ur", "ca", "el", "ta", "la",
+ "ns", "di", "fo", "ho", "pe", "ec", "pr", "no", "ct", "us", "ac", "ot", "il", "tr", "ly", "nc", "et", "ut",
+ "ss", "so", "rs", "un", "lo", "wa", "ge", "ie", "wh", "ee", "wi", "em", "ad", "ol", "rt", "po", "we", "na",
+ "ul", "ni", "ts", "mo", "ow", "pa", "im", "mi", "ai", "sh", "ir", "su", "id", "os", "iv", "ia", "am", "fi",
+ "ci", "vi", "pl", "ig", "tu", "ev", "ld", "ry", "mp", "fe", "bl", "ab", "gh", "ty", "op", "wo", "sa", "ay",
+ "ex", "ke", "fr", "oo", "av", "ag", "if", "ap", "gr", "od", "bo", "sp", "rd", "do", "uc", "bu", "ei", "ov",
+ "by", "rm", "ep", "tt", "oc", "fa", "ef", "cu", "rn", "sc", "gi", "da", "yo", "cr", "cl", "du", "ga", "qu",
+ "ue", "ff", "ba", "ey", "ls", "va", "um", "pp", "ua", "up", "lu", "go", "ht", "ru", "ug", "ds", "lt", "pi",
+ "rc", "rr", "eg", "au", "ck", "ew", "mu", "br", "bi", "pt", "ak", "pu", "ui", "rg", "ib", "tl", "ny", "ki",
+ "rk", "ys", "ob", "mm", "fu", "ph", "og", "ms", "ye", "ud", "mb", "ip", "ub", "oi", "rl", "gu", "dr", "hr",
+ "cc", "tw", "ft", "wn", "nu", "af", "hu", "nn", "eo", "vo", "rv", "nf", "xp", "gn", "sm", "fl", "iz", "ok",
+ "nl", "my", "gl", "aw", "ju", "oa", "eq", "sy", "sl", "ps", "jo", "lf", "nv", "je", "nk", "kn", "gs", "dy",
+ "hy", "ze", "ks", "xt", "bs", "ik", "dd", "cy", "rp", "sk", "xi", "oe", "oy", "ws", "lv", "dl", "rf", "eu",
+ "dg", "wr", "xa", "yi", "nm", "eb", "rb", "tm", "xc", "eh", "tc", "gy", "ja", "hn", "yp", "za", "gg", "ym",
+ "sw", "bj", "lm", "cs", "ii", "ix", "xe", "oh", "lk", "dv", "lp", "ax", "ox", "uf", "dm", "iu", "sf", "bt",
+ "ka", "yt", "ek", "pm", "ya", "gt", "wl", "rh", "yl", "hs", "ah", "yc", "yn", "rw", "hm", "lw", "hl", "ae",
+ "zi", "az", "lc", "py", "aj", "iq", "nj", "bb", "nh", "uo", "kl", "lr", "tn", "gm", "sn", "nr", "fy", "mn",
+ "dw", "sb", "yr", "dn", "sq", "zo", "oj", "yd", "lb", "wt", "lg", "ko", "np", "sr", "nq", "ky", "ln", "nw",
+ "tf", "fs", "cq", "dh", "sd", "vy", "dj", "hw", "xu", "ao", "ml", "uk", "uy", "ej", "ez", "hb", "nz", "nb",
+ "mc", "yb", "tp", "xh", "ux", "tz", "bv", "mf", "wd", "oz", "yw", "kh", "gd", "bm", "mr", "ku", "uv", "dt",
+ "hd", "aa", "xx", "df", "db", "ji", "kr", "xo", "cm", "zz", "nx", "yg", "xy", "kg", "tb", "dc", "bd", "sg",
+ "wy", "zy", "aq", "hf", "cd", "vu", "kw", "zu", "bn", "ih", "tg", "xv", "uz", "bc", "xf", "yz", "km", "dp",
+ "lh", "wf", "kf", "pf", "cf", "mt", "yu", "cp", "pb", "td", "zl", "sv", "hc", "mg", "pw", "gf", "pd", "pn",
+ "pc", "rx", "tv", "ij", "wm", "uh", "wk", "wb", "bh", "oq", "kt", "rq", "kb", "cg", "vr", "cn", "pk", "uu",
+ "yf", "wp", "cz", "kp", "dq", "wu", "fm", "wc", "md", "kd", "zh", "gw", "rz", "cb", "iw", "xl", "hp", "mw",
+ "vs", "fc", "rj", "bp", "mh", "hh", "yh", "uj", "fg", "fd", "gb", "pg", "tk", "kk", "hq", "fn", "lz", "vl",
+ "gp", "hz", "dk", "yk", "qi", "lx", "vd", "zs", "bw", "xq", "mv", "uw", "hg", "fb", "sj", "ww", "gk", "uq",
+ "bg", "sz", "jr", "ql", "zt", "hk", "vc", "xm", "gc", "fw", "pz", "kc", "hv", "xw", "zw", "fp", "iy", "pv",
+ "vt", "jp", "cv", "zb", "vp", "zr", "fh", "yv", "zg", "zm", "zv", "qs", "kv", "vn", "zn", "qa", "yx", "jn",
+ "bf", "mk", "cw", "jm", "lq", "jh", "kj", "jc", "gz", "js", "tx", "fk", "jl", "vm", "lj", "tj", "jj", "cj",
+ "vg", "mj", "jt", "pj", "wg", "vh", "bk", "vv", "jd", "tq", "vb", "jf", "dz", "xb", "jb", "zc", "fj", "yy",
+ "qn", "xs", "qr", "jk", "jv", "qq", "xn", "vf", "px", "zd", "qt", "zp", "qo", "dx", "hj", "gv", "jw", "qc",
+ "jy", "gj", "qb", "pq", "jg", "bz", "mx", "qm", "mz", "qf", "wj", "zq", "xr", "zk", "cx", "fx", "fv", "bx",
+ "vw", "vj", "mq", "qv", "zf", "qe", "yj", "gx", "kx", "xg", "qd", "xj", "sx", "vz", "vx", "wv", "yq", "bq",
+ "gq", "vk", "zj", "xk", "qp", "hx", "fz", "qh", "qj", "jz", "vq", "kq", "xd", "qw", "jx", "qx", "kz", "wx",
+ "fq", "xz", "zx", "jq", "qg", "qk", "qy", "qz", "wq", "wz", NULL
+ };
+
+/* ******************************************************************** */
+
static const char *ndpi_en_impossible_bigrams[] = {
"bk", "bq", "bx", "cb", "cf", "cg", "cj", "cp", "cv", "cw", "cx", "dx", "fk", "fq", "fv", "fx", /* "ee", removed it can be found in 'meeting' */
"fz", "gq", "gv", "gx", "hh", "hk", "hv", "hx", "hz", "iy", "jb", /* "jc", jcrew.com */ "jd", "jf", "jg", "jh", "jk",
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 59780d288..a945573a1 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -131,7 +131,7 @@ void *ndpi_realloc(void *ptr, size_t old_size, size_t new_size) {
/* ****************************************** */
char *ndpi_strdup(const char *s) {
- if( s == NULL ){
+ if(s == NULL ){
return NULL;
}
@@ -571,9 +571,14 @@ static void init_string_based_protocols(struct ndpi_detection_module_struct *ndp
// ac_automata_display(ndpi_str->host_automa.ac_automa, 'n');
#endif
+#if 1
for (i = 0; ndpi_en_bigrams[i] != NULL; i++)
ndpi_string_to_automa(ndpi_str, &ndpi_str->bigrams_automa, (char *) ndpi_en_bigrams[i], 1, 1, 1, 0);
-
+#else
+ for (i = 0; ndpi_en_popular_bigrams[i] != NULL; i++)
+ ndpi_string_to_automa(ndpi_str, &ndpi_str->bigrams_automa, (char *) ndpi_en_popular_bigrams[i], 1, 1, 1, 0);
+#endif
+
for (i = 0; ndpi_en_impossible_bigrams[i] != NULL; i++)
ndpi_string_to_automa(ndpi_str, &ndpi_str->impossible_bigrams_automa, (char *) ndpi_en_impossible_bigrams[i], 1,
1, 1, 0);
@@ -1476,6 +1481,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "WebSocket", NDPI_PROTOCOL_CATEGORY_WEB,
ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
+ ndpi_set_proto_defaults(ndpi_str, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_ANYDESK,
+ 1 /* no subprotocol */, no_master,
+ no_master, "AnyDesk", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS,
+ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */,
+ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */);
#ifdef CUSTOM_NDPI_PROTOCOLS
#include "../../../nDPI-custom/custom_ndpi_main.c"
@@ -4367,6 +4377,13 @@ static void ndpi_reconcile_protocols(struct ndpi_detection_module_struct *ndpi_s
Skype for a host doing MS Teams means MS Teams
(MS Teams uses Skype as transport protocol for voice/video)
*/
+
+ if(flow) {
+ /* Do not go for DNS when there is an application protocol. Example DNS.Apple */
+ if((flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN)
+ && (flow->detected_protocol_stack[0] /* app */ != flow->detected_protocol_stack[1] /* major */))
+ NDPI_CLR_BIT(flow->risk, NDPI_SUSPICIOUS_DGA_DOMAIN);
+ }
switch(ret->app_protocol) {
case NDPI_PROTOCOL_MSTEAMS:
@@ -6078,8 +6095,12 @@ int ndpi_match_bigram(struct ndpi_detection_module_struct *ndpi_str,
return(-1);
if(!automa->ac_automa_finalized) {
+#if 1
+ ndpi_finalize_initalization(ndpi_str);
+#else
printf("[%s:%d] [NDPI] Internal error: please call ndpi_finalize_initalization()\n", __FILE__, __LINE__);
return(0); /* No matches */
+#endif
}
ac_input_text.astring = bigram_to_match, ac_input_text.length = 2;
@@ -6478,79 +6499,123 @@ void ndpi_md5(const u_char *data, size_t data_len, u_char hash[16]) {
static int enough(int a, int b) {
u_int8_t percentage = 20;
-
+
if(b == 0) return(0);
if(a == 0) return(1);
- if(b > ((a*percentage)/100)) return(1);
-
+ if(b > (((a+1)*percentage)/100)) return(1);
+
return(0);
}
/* ******************************************************************** */
+// #define DGA_DEBUG 1
+
int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
struct ndpi_flow_struct *flow,
char *name) {
- int len = strlen(name), rc = 0;
-
+ int len, rc = 0;
+
+ len = strlen(name);
+
if(len >= 5) {
- int i, j, num_found = 0, num_impossible = 0, num_bigram_checks = 0;
- char tmp[128];
+ int i, j, num_found = 0, num_impossible = 0, num_bigram_checks = 0, num_digits = 0, num_vowels = 0, num_words = 0;
+ char tmp[128], *word, *tok_tmp;
len = snprintf(tmp, sizeof(tmp)-1, "%s", name);
if(len < 0) return(0);
-
+
for(i=0, j=0; (i<len) && (j<(sizeof(tmp)-1)); i++) {
- if(isdigit(name[i]))
- continue;
- else
tmp[j++] = tolower(name[i]);
}
+ tmp[j] = '\0';
len = j;
-
- for(i = 0; tmp[i+1] != '\0'; i++) {
- if(isdigit(tmp[i])) continue;
+
+ for(word = strtok_r(tmp, ".", &tok_tmp); ; word = strtok_r(NULL, ".", &tok_tmp)) {
+ if(!word) break;
+
+ num_words++;
+
+ if(strlen(word) < 3) continue;
+
+#ifdef DGA_DEBUG
+ printf("-> %s [%s][len: %u]\n", word, name, (unsigned int)strlen(word));
+#endif
+
+ for(i = 0; word[i+1] != '\0'; i++) {
+ if(isdigit(word[i])) {
+ num_digits++;
+
+ // if(!isdigit(word[i+1])) num_impossible++;
+
+ continue;
+ }
- switch(tmp[i]) {
- case '-':
- case ':':
- case '.':
- continue;
- break;
- }
+ switch(word[i]) {
+ case '_':
+ case '-':
+ case ':':
+ continue;
+ break;
+
+ case '.':
+ continue;
+ break;
+ }
- if(isdigit(tmp[i+1])) continue;
-
- num_bigram_checks++;
+ switch(word[i]) {
+ case 'a':
+ case 'e':
+ case 'i':
+ case 'o':
+ case 'u':
+ num_vowels++;
+ break;
+ }
+
+ if(isdigit(word[i+1])) {
+ num_digits++;
+ // num_impossible++;
+ continue;
+ }
+
+ num_bigram_checks++;
- if(ndpi_match_bigram(ndpi_str, &ndpi_str->bigrams_automa, &tmp[i])) {
- num_found++;
- } else if(ndpi_match_bigram(ndpi_str,
- &ndpi_str->impossible_bigrams_automa,
- &tmp[i])) {
+ if(ndpi_match_bigram(ndpi_str, &ndpi_str->bigrams_automa, &word[i])) {
+ num_found++;
+ } else {
+ if(ndpi_match_bigram(ndpi_str,
+ &ndpi_str->impossible_bigrams_automa,
+ &word[i])) {
#ifdef DGA_DEBUG
- printf("IMPOSSIBLE %s\n", &tmp[i]);
+ printf("IMPOSSIBLE %s\n", &word[i]);
#endif
- num_impossible++;
- }
- }
+ num_impossible++;
+ }
+ }
+ } /* for */
+ } /* for */
+#ifdef DGA_DEBUG
+ printf("[num_found: %u][num_impossible: %u][num_digits: %u][num_bigram_checks: %u][num_vowels: %u/%u]\n",
+ num_found, num_impossible, num_digits, num_bigram_checks, num_vowels, j-num_vowels);
+#endif
+
if(num_bigram_checks
- && ((num_found == 0)
- || (enough(num_found, num_impossible))))
- rc = 1;
+ && ((num_found == 0) || ((num_digits > 5) && (num_words <= 3)) || enough(num_found, num_impossible)))
+ rc = 1;
if(rc && flow)
NDPI_SET_BIT(flow->risk, NDPI_SUSPICIOUS_DGA_DOMAIN);
#ifdef DGA_DEBUG
if(rc)
- printf("DGA %s [%s][num_found: %u][num_impossible: %u]\n",
- tmp, name, num_found, num_impossible);
+ printf("DGA %s [num_found: %u][num_impossible: %u]\n",
+ name, num_found, num_impossible);
#endif
}
-
+
return(rc);
}
diff --git a/src/lib/ndpi_serializer.c b/src/lib/ndpi_serializer.c
index 4e4e51f0d..87b2c06a8 100644
--- a/src/lib/ndpi_serializer.c
+++ b/src/lib/ndpi_serializer.c
@@ -364,6 +364,13 @@ char* ndpi_serializer_get_header(ndpi_serializer *_serializer, u_int32_t *buffer
/* ********************************** */
+ndpi_serialization_format ndpi_serializer_get_format(ndpi_serializer *_serializer) {
+ ndpi_private_serializer *serializer = (ndpi_private_serializer*)_serializer;
+ return serializer->fmt;
+}
+
+/* ********************************** */
+
void ndpi_serializer_set_csv_separator(ndpi_serializer *_serializer, char separator) {
ndpi_private_serializer *serializer = (ndpi_private_serializer*)_serializer;
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index 099f343e4..897fb1e4b 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -294,11 +294,12 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
}
flow->host_server_name[j] = '\0';
- ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name);
if(j > 0) {
ndpi_protocol_match_result ret_match;
+ ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name);
+
ret.app_protocol = ndpi_match_host_subprotocol(ndpi_struct, flow,
(char *)flow->host_server_name,
strlen((const char*)flow->host_server_name),
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index a896c6214..7d54d1470 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -450,7 +450,7 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
flow->host_server_name[len] = '\0';
flow->extra_packets_func = NULL; /* We're good now */
- ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name);
+ if(len > 0) ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name);
flow->server_id = flow->dst;
if(packet->forwarded_line.ptr) {
diff --git a/src/lib/protocols/netbios.c b/src/lib/protocols/netbios.c
index c396a392b..66224557a 100644
--- a/src/lib/protocols/netbios.c
+++ b/src/lib/protocols/netbios.c
@@ -80,8 +80,9 @@ static void ndpi_int_netbios_add_connection(struct ndpi_detection_module_struct
char name[64];
u_int off = flow->packet.payload[12] == 0x20 ? 12 : 14;
- if((off < flow->packet.payload_packet_len) &&
- ndpi_netbios_name_interpret((char*)&flow->packet.payload[off], flow->packet.payload_packet_len - off, name, sizeof(name)) > 0) {
+ if((off < flow->packet.payload_packet_len)
+ && ndpi_netbios_name_interpret((char*)&flow->packet.payload[off],
+ flow->packet.payload_packet_len - off, name, sizeof(name)) > 0) {
snprintf((char*)flow->host_server_name, sizeof(flow->host_server_name)-1, "%s", name);
ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name);
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index c8a0e43b2..eac9e0f77 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -1208,14 +1208,14 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
printf("Client SSL [ALPN: %u]\n", alpn_len);
#endif
- if((alpn_str_len+alpn_len+1) < sizeof(alpn_str)) {
+ if((alpn_str_len+alpn_len+1) < (sizeof(alpn_str)-1)) {
if(alpn_str_len > 0) {
alpn_str[alpn_str_len] = ',';
alpn_str_len++;
}
for(alpn_i=0; alpn_i<alpn_len; alpn_i++)
- alpn_str[alpn_str_len+alpn_i] = packet->payload[s_offset+alpn_i];
+ alpn_str[alpn_str_len+alpn_i] = packet->payload[s_offset+alpn_i];
s_offset += alpn_len, alpn_str_len += alpn_len;;
} else
Powered by cgit, Themed by Ted Yin.