aboutsummaryrefslogtreecommitdiff
path: root/example/reader_util.c
Commit message (Collapse)AuthorAge
* Fixed Mingw64 build.improved/sonarcloud-ciToni Uhlig2021-08-10
| | | | | | | | * adapted to SonarCloud-CI workflow * removed broken and incomplete Windows example (tested on VS2017/VS2019) * removed unnecessary include (e.g. pthread.h for the library which does not make use of it) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Implemented ALPN automa for checking uncommon ALPNsLuca Deri2021-07-24
|
* Reworked flow risk implementationLuca Deri2021-07-23
|
* Implemented function to retrieve flow information. #1253 (#1254)Toni2021-07-23
| | | | | * fixed [h]euristic typo Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Implementation of flow risk eception (work in progress)Luca Deri2021-07-22
|
* ndpiReader: add statistics about nDPI performance (#1240)Ivan Nardi2021-07-13
| | | | | | | The goal is to have a (roughly) idea about how many packets nDPI needs to properly classify a flow. Log this information (and guessed flows number too) during unit tests, to keep track of improvements/regressions across commits.
* Reworked human readeable string search in flowsLuca Deri2021-05-17
| | | | Removed fragment manager code
* Check datalink during fuzzing to prevent console / logfile spam. See #1175 ↵Toni2021-05-09
| | | | | for more information. (#1177) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Initial work towards detection via TLS of browser typesLuca2021-05-06
|
* Check for common ALPNs and set a flow risk if not known. (#1175)Toni2021-04-27
| | | | | | * Increased risk bitmask to 64bit (instead of 32bit). * Removed annoying "Unknown datalink" error message for fuzzers. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added flow risk to wireshark dissectionLuca Deri2021-04-26
|
* Fix detunneling of GTP-U traffic (#1168)Ivan Nardi2021-04-18
| | | | | Fuzzing #1161 exposed some (completely unrelated) issues on GTP-U detunneling code. (see https://github.com/ntop/nDPI/actions/runs/719882047)
* Fixed invalid guess statsLuca Deri2021-03-30
|
* ndpiReader: print an error msg if we found an unsupported datalink type (#1157)Ivan Nardi2021-03-23
|
* Reworked extendal dependency across testing toolsLuca Deri2021-03-14
|
* Added experiemntal JA3+ implementation that can be used with -z i ndpiReaderLuca Deri2021-03-09
|
* Add support for Snapchat voip calls (#1147)Ivan Nardi2021-03-06
| | | | | | | | | * Add support for Snapchat voip calls Snapchat multiplexes some of its audio/video real time traffic with QUIC sessions. The peculiarity of these sessions is that they are Q046 and don't have any SNI. * Fix tests with libgcrypt disabled
* Fixed memory leaks caused by conditional free'ing for some TLS connec… (#1132)Toni2021-02-10
| | | | | | | | | | | | | | | * Fixed memory leaks caused by conditional free'ing for some TLS connections. * Members of tls_quic struct should also free'd if the detected master protocol is IMAPS / POPS / SMTPS / etc. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Prevent reader_util.c from exit()'ing if maximum flow count reached. This confuses the fuzzer. * Improved fuzz/Makefile.am to use LDADD for ../example/libndpiReader.a instead of LDFLAGS. That way, fuzz_ndpi_reader re-links to ../example/libndpiReader.a if something changed there. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* RSI enhancementsLuca Deri2021-02-05
|
* Improved debug messageLuca Deri2021-02-03
|
* Cleaned up tls/quic datatypesLuca Deri2021-01-21
|
* Reworked TLS fingerprint calcolationLuca Deri2021-01-21
| | | | Modified TLS memory free
* (C) UpdateLuca Deri2021-01-07
|
* Split HTTP request from response Content-Type. Request Content-Type should ↵Luca Deri2021-01-06
| | | | be present with POSTs and not with other methods such as GET
* Restored QUIC statsLuca Deri2020-12-30
|
* Fixed output when tLS (nad not QUIC) is usedLuca Deri2020-12-28
|
* Fixes bug introduced by https://github.com/ntop/nDPI/pull/1085Luca Deri2020-12-12
|
* Fix minimum packet length condition (#1087)Zied Aouini2020-12-12
|
* Added --ignore-vlanid / -I to exclude VLAN ids for flow hash calculation. ↵Toni2020-12-11
| | | | | #1073 (#1085) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Support raw IPv4 / IPv6 pcap packet processing. (#1053)Toni2020-11-09
| | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Cosmetic changesLuca Deri2020-11-03
|
* Moved global in reader_util.cLuca Deri2020-10-27
|
* Added -D flag for detecting DoH in the wildLuca Deri2020-10-26
| | | | Removed heuristic from CiscoVPN as it leads to false positives
* Various improvemement when using ndpi_pref_enable_tls_block_dissection:Luca Deri2020-10-24
| | | | | | application data TLS blocks are now ignored when exchanged before - the end of certificate negotiation (up to TLS 1.2) - change cipher
* Fix parsing of DLT_PPP datalink type (#1042)Ivan Nardi2020-10-21
|
* CAPWAP tunnel decoding fix (#1038)Zied Aouini2020-10-21
| | | | | * Fix CAPWAP processing. * Update result.
* Fix CAPWAP handling.aouinizied2020-10-13
|
* Added ndpi_quick_16_byte_hashLuca2020-10-05
| | | | Warning fix
* Warning fixLuca Deri2020-10-03
|
* Reworked MDNS dissector that is not based on the DNS dissectorLuca Deri2020-09-17
|
* http: create a common function to parse User Agent fieldNardi Ivan2020-09-08
| | | | Prepare the code to handle UA information from flows other than HTTP
* OpenBSD: Introduce pkt_timeval to deal with (bpf_)_timevalAdrian Zgorzałek2020-08-09
| | | | | | Some BSD APIs called in example/ return `struct bpf_timeval`, where nDPI APIs expect `struct timeval`. These two structs, besides having a different name, share the exact same set of fields.
* Tiny changes for TLS block lenght dissectionLuca Deri2020-07-29
|
* wrapper cleanupLuca Deri2020-07-13
|
* Fixed heap overflow caused by missing lengthcheck in 802.11 LLC header parsing.Toni Uhlig2020-07-11
| | | | | | * triggered by fuzz traces from wireshark Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Removed csv_fp as external symbol. Instead passing csv_fp through as argument.Toni Uhlig2020-07-08
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added ndpi_cluster_bins() for clustering bins and ancillary functions for ↵Luca Deri2020-07-07
| | | | bins manipulation
* Merge pull request #932 from IvanNardi/logLuca Deri2020-07-07
|\ | | | | Log
| * Fix compilation with --enable-debug-messages flagNardi Ivan2020-06-26
| | | | | | | | | | | | | | | | | | | | | | | | NDPI_LOG* macros dereference ndpi_detection_module_struct object which is private to ndpi library (via NDPI_LIB_COMPILATION define). So we can't use them outside the library itself, i.e. in ndpiReader code Therefore, in files in example/, convert all (rare) uses of NDPI_LOG* macros to a new very simple macro, private to ndpiReader program. If necessary, such macro may be improved. According to a comment in ndpi_define.h, each dissector must define its own NDPI_CURRENT_PROTO macro before including ndpi_api.h file
* | Fixed heap overflow caused by missing lengthcheck in reader uutil.Toni Uhlig2020-07-06
| | | | | | | | | | | | * triggered by fuzz traces from wireshark Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Powered by cgit, Themed by Ted Yin.