aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_api.h.in2
-rw-r--r--src/lib/ndpi_main.c5
-rw-r--r--src/lib/protocols/dns.c4
-rw-r--r--src/lib/protocols/fastcgi.c2
-rw-r--r--src/lib/protocols/http.c6
-rw-r--r--src/lib/protocols/netbios.c2
-rw-r--r--src/lib/protocols/quic.c2
-rw-r--r--src/lib/protocols/tls.c2
8 files changed, 14 insertions, 11 deletions
diff --git a/src/include/ndpi_api.h.in b/src/include/ndpi_api.h.in
index 0fd177557..cf6c1e469 100644
--- a/src/include/ndpi_api.h.in
+++ b/src/include/ndpi_api.h.in
@@ -1149,7 +1149,7 @@ extern "C" {
/* DGA */
int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
struct ndpi_flow_struct *flow,
- char *name, u_int8_t is_hostname);
+ char *name, u_int8_t is_hostname, u_int8_t check_subproto);
/* Serializer (supports JSON, TLV, CSV) */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index fed529297..1f47daa7c 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -8511,7 +8511,7 @@ static int ndpi_is_vowel(char c) {
int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
struct ndpi_flow_struct *flow,
- char *name, u_int8_t is_hostname) {
+ char *name, u_int8_t is_hostname, u_int8_t check_subproto) {
if(ndpi_dga_function != NULL) {
/* A custom DGA function is defined */
int rc = ndpi_dga_function(name, is_hostname);
@@ -8542,7 +8542,8 @@ int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
if(flow && (flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN))
return(0); /* Ignore DGA check for protocols already fully detected */
- if(ndpi_match_string_subprotocol(ndpi_str, name, strlen(name), &ret_match) > 0)
+ if(check_subproto &&
+ ndpi_match_string_subprotocol(ndpi_str, name, strlen(name), &ret_match) > 0)
return(0); /* Ignore DGA for known domain names */
if(isdigit((int)name[0])) {
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index ecf283a77..e12ece12c 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -529,8 +529,6 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
if(j > 0) {
ndpi_protocol_match_result ret_match;
- ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
ret.app_protocol = ndpi_match_host_subprotocol(ndpi_struct, flow,
flow->host_server_name,
strlen(flow->host_server_name),
@@ -544,6 +542,8 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
ret.master_protocol = checkDNSSubprotocol(s_port, d_port);
else
ret.master_protocol = NDPI_PROTOCOL_DNS;
+
+ ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
}
/* Report if this is a DNS query or reply */
diff --git a/src/lib/protocols/fastcgi.c b/src/lib/protocols/fastcgi.c
index 9fad2c044..f70bd6cf5 100644
--- a/src/lib/protocols/fastcgi.c
+++ b/src/lib/protocols/fastcgi.c
@@ -212,7 +212,7 @@ void ndpi_search_fastcgi(struct ndpi_detection_module_struct *ndpi_struct,
strlen(flow->host_server_name),
&ret_match, NDPI_PROTOCOL_FASTCGI);
ndpi_check_dga_name(ndpi_struct, flow,
- flow->host_server_name, 1);
+ flow->host_server_name, 1, 0);
if(ndpi_is_valid_hostname(flow->host_server_name,
strlen(flow->host_server_name)) == 0) {
char str[128];
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 6fe6cab33..f9d6abd90 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -722,8 +722,6 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
ndpi_hostname_sni_set(flow, packet->host_line.ptr, packet->host_line.len);
if(strlen(flow->host_server_name) > 0) {
- ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
if(ndpi_is_valid_hostname(flow->host_server_name,
strlen(flow->host_server_name)) == 0) {
char str[128];
@@ -749,6 +747,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
ndpi_http_parse_subprotocol(ndpi_struct, flow);
+ if(strlen(flow->host_server_name) > 0) {
+ ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
+ }
+
/**
check result of host subprotocol detection
diff --git a/src/lib/protocols/netbios.c b/src/lib/protocols/netbios.c
index 710f18a71..45119ecbf 100644
--- a/src/lib/protocols/netbios.c
+++ b/src/lib/protocols/netbios.c
@@ -104,7 +104,7 @@ static void ndpi_int_netbios_add_connection(struct ndpi_detection_module_struct
(u_int)(packet->payload_packet_len - off), name, sizeof(name)-1) > 0) {
ndpi_hostname_sni_set(flow, (const u_int8_t *)name, strlen((char *)name));
- ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
+ ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 1);
}
if(sub_protocol == NDPI_PROTOCOL_UNKNOWN)
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index af43bf7e5..7889dad4d 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1391,7 +1391,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
flow->protos.tls_quic.hello_processed = 1; /* Allow matching of custom categories */
ndpi_check_dga_name(ndpi_struct, flow,
- flow->host_server_name, 1);
+ flow->host_server_name, 1, 0);
if(ndpi_is_valid_hostname(flow->host_server_name,
strlen(flow->host_server_name)) == 0) {
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 98a8d8208..fe36555ed 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -1923,7 +1923,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
}
if(ndpi_check_dga_name(ndpi_struct, flow,
- sni, 1)) {
+ sni, 1, 0)) {
#ifdef DEBUG_TLS
printf("[TLS] SNI: (DGA) [%s]\n", sni);
#endif
Powered by cgit, Themed by Ted Yin.