aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Added printf/fprintf replacement for some internal modules.improved/logging_callback_ndpi_printflns2023-09-24
| | | | | | * logging is instead redirected to `ndpi_debug_printf` Signed-off-by: lns <matzeton@googlemail.com>
* Renamed HTTP/2 to HTTP2 as the '/' can have side effects with applications ↵Luca Deri2023-09-20
| | | | sitting on top of nDPI
* Fix some prototypes (#2085)Ivan Nardi2023-09-18
| | | | | ``` error: function declaration isn’t a prototype [-Werror=strict-prototypes] ```
* Add support for (un-encrypted) HTTP/2 (#2087)Ivan Nardi2023-09-18
| | | | Plaintext HTTP/2 is quite rare on the general "internet" but it is used in some private networks (example: 5G core network)
* fuzz: extend fuzzing coverageNardi Ivan2023-09-16
|
* Language fixLuca2023-09-15
|
* Add `ndpi_domain_classify_finalize()` function (#2084)Ivan Nardi2023-09-12
| | | | | | | | | The "domain classify" data structure is immutable, since it uses "bitmap64". Allow to finalize it before starting to process packets (i.e. before calling `ndpi_domain_classify_contains()`) to avoid, in the data-path, all the memory allocations due to compression. Calling `ndpi_domain_classify_finalize()` is optional.
* tftp: update pcap resultsThomas Winter2023-09-12
| | | | | | | | The two malformed TFTP packets are no longer considered as risk and instead match by port only. This is because the TFTP detection was rather sparse so could match on several other protocols if the first two opcode bytes happened to match.
* tftp: check incrementation for DATA and ACK packetsThomas Winter2023-09-12
| | | | | | | | | | | | | The 2 bytes following the opcode for DATA and ACK packets are the block number and this should be incrementing every packet. We should check to see that this is occurring otherwise false matches can occur, eg L2TPv3 over UDP matches the DATA opcode but the next two bytes are always zero. Remove the DATA max block size assumption since this can be false if the blksize option is used to increase it. Fixes #2070
* tftp: check for Option AcknowledgementsThomas Winter2023-09-12
| | | | | | | | | TFTP Option Acknowledgement packets were being excluded. When a read/write request contains options, an Option Acknowledgement is returned that contains the option strings that the transaction will use. The options sent in the request are not compared with what was acknowledged.
* tftp: rework request checking to account for optionsThomas Winter2023-09-12
| | | | | | | | | | | | | | | | | Read and write requests were not handling options. The existing code inspecting request messages assumed that the string before the end of the payload was the mode and that the filename length depended on the mode length. However the first two strings are the filename and mode which can be followed by any number of option strings. Rework the checking of the filename and mode to just search the first two strings which should always exist. Any options after that are ignored. Absence of the filename or mode is now excludes the TFTP protocol. Absence of the filename no longer is considered malformed packet because it can match other protocols falsely.
* Fixes matches with domain name strings that start with a dotLuca Deri2023-09-11
|
* fuzz: extend fuzzing coverage (#2083)Ivan Nardi2023-09-10
|
* fuzz: add fuzzers to test bitmap64 and domain_classify data structures (#2082)Ivan Nardi2023-09-10
|
* Update protocols documentation (#2081)Ivan Nardi2023-09-10
|
* fuzz: add fuzzers to test reader_util code (#2080)Ivan Nardi2023-09-10
|
* Update every ip lists (#2079)Ivan Nardi2023-09-10
|
* Fix some errors found by fuzzers (#2078)Ivan Nardi2023-09-10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix compilation on Windows. "dirent.h" file has been taken from https://github.com/tronkko/dirent/ Fix Python bindings Fix some warnings with x86_64-w64-mingw32-gcc: ``` protocols/dns.c: In function ‘ndpi_search_dns’: protocols/dns.c:775:41: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] 775 | unsigned long first_element_len = (unsigned long)dot - (unsigned long)_hostname; | ^ protocols/dns.c:775:62: error: cast from pointer to integer of different size [-Werror=pointer-to-int-cast] 775 | unsigned long first_element_len = (unsigned long)dot - (unsigned long)_hostname; | ``` ``` In file included from ndpi_bitmap64.c:31: third_party/include/binaryfusefilter.h: In function ‘binary_fuse8_hash’: third_party/include/binaryfusefilter.h:160:32: error: left shift count >= width of type [-Werror=shift-count-overflow] 160 | uint64_t hh = hash & ((1UL << 36) - 1); ``` ``` In function ‘ndpi_match_custom_category’, inlined from ‘ndpi_fill_protocol_category.part.0’ at ndpi_main.c:7056:16: ndpi_main.c:3419:3: error: ‘strncpy’ specified bound depends on the length of the source argument [-Werror=stringop-overflow=] 3419 | strncpy(buf, name, name_len); ```
* Reworked initializationLuca Deri2023-09-10
|
* Added OperaVPN detectionLuca Deri2023-09-09
|
* Enhance DNS risk for long hostnames (> 32)Luca Deri2023-09-09
|
* Improved detection of invalid chars in DNS namesLuca Deri2023-09-09
|
* Win fixLuca Deri2023-09-08
|
* Added NDPI_TLS_ALPN_SNI_MISMATCH flow riskLuca Deri2023-09-07
|
* CleanupLuca2023-09-07
|
* Disabled debug messageLuca Deri2023-09-05
|
* Minor warning fixesLuca Deri2023-09-05
|
* Improved classification further reducing memory usedLuca Deri2023-09-05
|
* Compilation fixes for old compilersLuca Deri2023-09-05
|
* Added sub-domain classification fixLuca Deri2023-09-05
|
* Classification fixesLuca Deri2023-09-05
|
* Added ndpi_bitmap64 supportLuca Deri2023-09-05
|
* Added ndpi_murmur_hash to the nDPI APILuca Deri2023-09-04
|
* Merged new and old version of ndpi_domain_classify.c codeLuca Deri2023-09-02
|
* Reworked domain classification based on binary filtersLuca Deri2023-09-02
|
* Improvement for reducing false positivesLuca Deri2023-09-01
|
* Code cleanupLuca Deri2023-09-01
|
* Added ndpi_binary_bitmap datastrutureLuca Deri2023-08-31
| | | | | It is similar to ndpi_filter but based on binary search and with the ability to store a category per value (as ndpi_domain_classify)
* Fixed heap-buffer-overflow issueLuca Deri2023-08-31
|
* Code cleanupLuca Deri2023-08-31
|
* Added commentLuca Deri2023-08-31
|
* Added missing lists filesLuca Deri2023-08-29
|
* Fixes distLuca Deri2023-08-29
|
* Added -G flagLuca Deri2023-08-29
|
* Warning fixesLuca Deri2023-08-29
|
* Added README fileLuca Deri2023-08-29
|
* Swap from Aho-Corasick to an experimental/home-grown algorithm that uses a ↵Luca Deri2023-08-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | probabilistic approach for handling Internet domain names. For switching back to Aho-Corasick it is necessary to edit ndpi-typedefs.h and uncomment the line // #define USE_LEGACY_AHO_CORASICK [1] With Aho-Corasick $ ./example/ndpiReader -G ./lists/ -i tests/pcap/ookla.pcap | grep Memory nDPI Memory statistics: nDPI Memory (once): 37.34 KB Flow Memory (per flow): 960 B Actual Memory: 33.09 MB Peak Memory: 33.09 MB [2] With the new algorithm $ ./example/ndpiReader -G ./lists/ -i tests/pcap/ookla.pcap | grep Memory nDPI Memory statistics: nDPI Memory (once): 37.31 KB Flow Memory (per flow): 960 B Actual Memory: 7.42 MB Peak Memory: 7.42 MB In essence from ~33 MB to ~7 MB This new algorithm will enable larger lists to be loaded (e.g. top 1M domans https://s3-us-west-1.amazonaws.com/umbrella-static/index.html) In ./lists there are file names that are named as <category>_<string>.list With -G ndpiReader can load all of them at startup
* Added `lists/gambling.list` to extra dist.Toni Uhlig2023-08-27
| | | | | | * make dist in `./fuzz`: fixed inconsistent `*.dict` file pattern Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* fix compilation and symbol checkToni Uhlig2023-08-27
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* fix compilationToni Uhlig2023-08-27
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Powered by cgit, Themed by Ted Yin.