aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
...
* Syntax error fixesLuca Deri2021-06-11
|
* Fixed flow score labelLuca Deri2021-06-11
|
* Changed output for the sharkfest lua scriptsMatteo Biscosi2021-06-11
|
* Bug in ndpi_lru_find_cache (#1204)Vitaly Lavrov2021-06-10
| | | Key value check is missing.
* Minor code cleanupLuca2021-06-09
|
* autoconf: Do not check for json-c if --with-only-libndpi is set. (#1202)Toni2021-06-09
| | | | | | * json-c is used by a unit test * required to fix some libnDPI cross compilation issues Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* OpenWRT document fixLuca Deri2021-06-08
|
* Win changesLuca Deri2021-06-08
|
* Updated scriptsLuca Deri2021-06-08
|
* New testing pcap with syn scan attackLuca2021-06-08
|
* Companion scripts written for the Sharkfest conferenceLuca2021-06-08
|
* Added report on score cli/srv breakdownLuca Deri2021-06-07
|
* New version of the ahocorasick library (#1200)Vitaly Lavrov2021-06-07
| | | | | | | | | | | | | | | | The new version is about 25% faster with -O2 and 45% faster with -O3. No recursion is used (smaller stack size required). Uses less memory (by valgrind info) bigram: - original 1796 allocs, 247864 bytes allocated - new 1232 allocs, 158880 bytes allocated host_match: - original 18038 allocs, 3004576 bytes allocated - new 6861 allocs, 396624 bytes allocated The function ac_automata_search() is thread safe. Optional case-insensitive comparison. Matching at the beginning and at the end of the string is supported. One code file and one header file.
* Fixed uninitialized memory use. (#1198)Vitaly Lavrov2021-06-07
| | | The pointer "header" must be initialized before first call pcap_next_ex().
* Fixed expected outputLuca Deri2021-06-03
|
* Warnign fixLuca Deri2021-06-03
|
* Renamed Skyp in Skype_Teams as the protocol is now shared across these appsLuca Deri2021-06-02
|
* wireshark/lua: improve flow risk visualization (#1194)Ivan Nardi2021-06-02
| | | | | Create a separated proto field entry for each possible flow risk. This way, filtering will be more natural: you can use something like "ndpi.flow_risk.desktop_file_sharing_session"
* Removed xbox and playstation invalid port guessesLuca Deri2021-06-02
|
* ndpiReader: fix collecting of risks statistics (#1192)Ivan Nardi2021-06-01
|
* TLS: improve check for common ALPNs (#1191)Ivan Nardi2021-06-01
| | | Facebook is still using its own ALPN for HTTP2 as well
* Reworked ndpi flow risk score adding client and server scoreLuca2021-06-01
|
* Fix warningsAlfredo Cardigliano2021-05-25
|
* Added TLS check to avoid crash with UDP-based trafficLuca2021-05-25
|
* Improved TLS browser detection heuristicsLuca Deri2021-05-19
|
* wireshark/lua: fix offsets (#1187)Ivan Nardi2021-05-18
|
* Added flow risk scoreLuca Deri2021-05-18
|
* TypoLuca Deri2021-05-18
|
* Added risk/score dump (ndpiReader -h)Luca Deri2021-05-18
| | | | Added ndpi_dump_risks_score() API score
* Updated API for ndpi_risk2score()Luca Deri2021-05-17
| | | | Added ndpi_get_upper_proto() API call
* Reworked human readeable string search in flowsLuca Deri2021-05-17
| | | | Removed fragment manager code
* Added further checksLuca Deri2021-05-15
|
* Updated protocol categoryLuca Deri2021-05-15
|
* Added ndpi_check_subprotocol_risk() API call definitionLuca Deri2021-05-15
|
* Added TLS certifiacate cachingLuca Deri2021-05-15
| | | | Added Fortigate protocol
* Converted some test .pcapng files to pcap formatLuca Deri2021-05-13
|
* Added browser TLS heuristicLuca Deri2021-05-13
|
* Implemented heuristic to detect Safari and Firefox TLS browsingLuca Deri2021-05-13
|
* Fixed obsolete error printing if CTRL-C is pressed. #1165 (#1184)Toni2021-05-11
| | | | | * This fix was proposed by @robertsong2019 Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved SSL certificate name wildcard handling and risk. #1182 (#1183)Toni2021-05-11
| | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Changes for sonarcloud integrationLuca Deri2021-05-11
|
* Fixed typoLuca Deri2021-05-11
|
* Implemented flow score in Wireshark integrationLuca Deri2021-05-10
|
* Added check to reduce MongoDB false positive detectionLuca Deri2021-05-10
|
* Added (partial) Activision protocol support (based on tencent cloud)Luca Deri2021-05-10
|
* Fix some warnings (#1181)Ivan Nardi2021-05-09
| | | | | | | | | | | | | | | | | | | ``` In file included from protocols/fasttrack.c:29: ../include/ndpi_api.h:1504:3: warning: type qualifiers ignored on function return type [-Wignored-qualifiers] 1504 | const ndpi_risk_severity ndpi_risk2severity(ndpi_risk_enum risk); | ^~~~~ In file included from protocols/amazon_video.c:28: ../include/ndpi_api.h:1504:3: warning: type qualifiers ignored on function return type [-Wignored-qualifiers] 1504 | const ndpi_risk_severity ndpi_risk2severity(ndpi_risk_enum risk); | ^~~~~ ... ndpi_utils.c: In function ‘ndpi_risk2severity’: ndpi_utils.c:1834:1: warning: control reaches end of non-void function [-Wreturn-type] 1834 | } | ^ ```
* TLS: fix extraction for TLS signature algorithms (#1180)Ivan Nardi2021-05-09
| | | | | | | | | | ``` ==69562==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6100009000fb at pc 0x7f41882003a7 bp 0x7f4183cfbfc0 sp 0x7f4183cfb768 READ of size 32 at 0x6100009000fb thread T1 #0 0x7f41882003a6 in __interceptor_memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 #1 0x560b2d7462a1 in processClientServerHello protocols/tls.c:1647 #2 0x560b2d73be6a in processTLSBlock protocols/tls.c:712 #3 0x560b2d73e61f in ndpi_search_tls_udp protocols/tls.c:968 ```
* TLS: fix another use-of-uninitialized-value error in ClientHello parsing (#1179)Ivan Nardi2021-05-09
| | | | | | | | | | | | Error detected with valgrind. ==13127== Conditional jump or move depends on uninitialised value(s) ==13127== at 0x483EF58: strlen (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so) ==13127== by 0x1A93B6: ndpi_strdup (ndpi_main.c:159) ==13127== by 0x1C07CC: processClientServerHello (tls.c:1678) ==13127== by 0x1C0C4C: processTLSBlock (tls.c:712) ==13127== by 0x1C0C4C: ndpi_search_tls_tcp.part.0 (tls.c:849) See also 8c3674e9
* Check datalink during fuzzing to prevent console / logfile spam. See #1175 ↵Toni2021-05-09
| | | | | for more information. (#1177) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Allow to override build date with SOURCE_DATE_EPOCH (#1176)Bernhard M. Wiedemann2021-05-09
| | | | | | in order to make builds reproducible. See https://reproducible-builds.org/ for why this is good and https://reproducible-builds.org/specs/source-date-epoch/ for the definition of this variable.
Powered by cgit, Themed by Ted Yin.