diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/include/ndpi_typedefs.h | 2 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 6 | ||||
| -rw-r--r-- | src/lib/ndpi_utils.c | 14 |
3 files changed, 11 insertions, 11 deletions
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 0a80da57c..4eb003567 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -162,7 +162,7 @@ typedef enum { NDPI_PERIODIC_FLOW, /* Set in case a flow repeats at a specific pace [used by apps on top of nDPI] */ NDPI_MINOR_ISSUES, /* Generic packet issues (e.g. DNS with 0 TTL) */ NDPI_TCP_ISSUES, /* 50 */ /* TCP issues such as connection failed or scan */ - NDPI_FULLY_ENCRYPTED, /* This (unknown) session is fully encrypted */ + NDPI_FREE_51, /* FREE */ NDPI_TLS_ALPN_SNI_MISMATCH, /* Invalid ALPN/SNI combination */ NDPI_MALWARE_HOST_CONTACTED, /* Flow client contacted a malware host */ NDPI_BINARY_DATA_TRANSFER, /* Attempt to transfer something in binary format */ diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 5df5f36ae..6a715dd16 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -201,7 +201,7 @@ static ndpi_risk_info ndpi_known_risks[] = { { NDPI_PERIODIC_FLOW, NDPI_RISK_LOW, CLIENT_LOW_RISK_PERCENTAGE, NDPI_CLIENT_ACCOUNTABLE }, { NDPI_MINOR_ISSUES, NDPI_RISK_LOW, CLIENT_LOW_RISK_PERCENTAGE, NDPI_BOTH_ACCOUNTABLE }, { NDPI_TCP_ISSUES, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE, NDPI_CLIENT_ACCOUNTABLE }, - { NDPI_FULLY_ENCRYPTED, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE, NDPI_CLIENT_ACCOUNTABLE }, + { NDPI_FREE_51, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE, NDPI_CLIENT_ACCOUNTABLE }, { NDPI_TLS_ALPN_SNI_MISMATCH, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE, NDPI_CLIENT_ACCOUNTABLE }, { NDPI_MALWARE_HOST_CONTACTED, NDPI_RISK_SEVERE, CLIENT_HIGH_RISK_PERCENTAGE, NDPI_CLIENT_ACCOUNTABLE }, { NDPI_BINARY_DATA_TRANSFER, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE, NDPI_CLIENT_ACCOUNTABLE }, @@ -8155,7 +8155,7 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st /* TODO: not sure about the best "order" among fully encrypted logic, classification by-port and classification by-ip...*/ if(ret.proto.app_protocol == NDPI_PROTOCOL_UNKNOWN && flow->first_pkt_fully_encrypted == 1) { - ndpi_set_risk(ndpi_str, flow, NDPI_FULLY_ENCRYPTED, NULL); + ndpi_set_risk(ndpi_str, flow, NDPI_OBFUSCATED_TRAFFIC, "Fully Encrypted"); } /* If guess_ip_before_port is enabled, classify by-ip first */ @@ -11836,7 +11836,7 @@ static const struct cfg_param { { NULL, "flow.use_client_ip_in_guess", "enable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(use_client_ip_in_guess), NULL}, { NULL, "flow.use_client_port_in_guess", "enable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(use_client_port_in_guess), NULL}, { NULL, "tcp_ack_payload_heuristic", "disable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(tcp_ack_paylod_heuristic), NULL }, - { NULL, "fully_encrypted_heuristic", "enable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(fully_encrypted_heuristic), NULL }, + { NULL, "fully_encrypted_heuristic", "disable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(fully_encrypted_heuristic), NULL }, { NULL, "libgcrypt.init", "1", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(libgcrypt_init), NULL }, { NULL, "dpi.guess_on_giveup", "0x3", "0", "3", CFG_PARAM_INT, __OFF(guess_on_giveup), NULL }, { NULL, "dpi.guess_ip_before_port", "disable", NULL, NULL, CFG_PARAM_ENABLE_DISABLE, __OFF(guess_ip_before_port), NULL}, diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c index ef179246a..7a31f0df2 100644 --- a/src/lib/ndpi_utils.c +++ b/src/lib/ndpi_utils.c @@ -2299,8 +2299,8 @@ const char* ndpi_risk2str(ndpi_risk_enum risk) { case NDPI_TCP_ISSUES: return("TCP Connection Issues"); - case NDPI_FULLY_ENCRYPTED: - return("Fully Encrypted Flow"); + case NDPI_FREE_51: + return("FREE51"); case NDPI_TLS_ALPN_SNI_MISMATCH: return("ALPN/SNI Mismatch"); @@ -2431,8 +2431,8 @@ const char* ndpi_risk2code(ndpi_risk_enum risk) { return STRINGIFY(NDPI_MINOR_ISSUES); case NDPI_TCP_ISSUES: return STRINGIFY(NDPI_MINOR_ISSUES); - case NDPI_FULLY_ENCRYPTED: - return STRINGIFY(NDPI_FULLY_ENCRYPTED); + case NDPI_FREE_51: + return STRINGIFY(NDPI_FREE_51); case NDPI_TLS_ALPN_SNI_MISMATCH: return STRINGIFY(NDPI_TLS_ALPN_SNI_MISMATCH); case NDPI_MALWARE_HOST_CONTACTED: @@ -2554,8 +2554,8 @@ ndpi_risk_enum ndpi_code2risk(const char* risk) { return(NDPI_MINOR_ISSUES); else if(strcmp(STRINGIFY(NDPI_TCP_ISSUES), risk) == 0) return(NDPI_MINOR_ISSUES); - else if(strcmp(STRINGIFY(NDPI_FULLY_ENCRYPTED), risk) == 0) - return(NDPI_FULLY_ENCRYPTED); + else if(strcmp(STRINGIFY(NDPI_FREE_51), risk) == 0) + return(NDPI_FREE_51); else if(strcmp(STRINGIFY(NDPI_TLS_ALPN_SNI_MISMATCH), risk) == 0) return(NDPI_TLS_ALPN_SNI_MISMATCH); else if(strcmp(STRINGIFY(NDPI_MALWARE_HOST_CONTACTED), risk) == 0) @@ -2703,7 +2703,7 @@ const char *ndpi_risk_shortnames[NDPI_MAX_RISK] = { "periodic_flow", "minor_issues", "tcp_issues", /* NDPI_TCP_ISSUES */ - "fully_encrypted", + "free51", "tls_alpn_mismatch", "malware_host", "binary_data_transfer", |