aboutsummaryrefslogtreecommitdiff
path: root/python
Commit message (Collapse)AuthorAge
* Added NDPI_DESKTOP_OR_FILE_SHARING_SESSION flow riskLuca Deri2021-04-11
|
* Refactored nDPI subprotocol handling and aimini protocol detection. (#1156)Toni2021-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactored and merged callback buffer routines for non-udp-tcp / udp / tcp / tcp-wo-payload. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Try to detect one subprotocol if a detected protocol can have one. * This adds a performance overhead due to much more protocol detection routine calls. See #1148 for more information. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Refactor subprotocol handling (1/2). Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Refactor subprotocol handling (2/2). Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Prevent some code duplication by using macros for ndpi_int_one_line_struct string comparision. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Refactored aimini HTTP detection parts (somehow related to #1148). Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Added aimini client/server test pcap. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Removed master protocol as it was only used for STUN and via also removed API function ndpi_get_protocol_id_master_proto * Adjusted Python code to conform to the changes made during the refactoring process. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* HTTP: fix user-agent parsing (#1124)Ivan Nardi2021-02-03
| | | | | | | | | | | User-agent information is used to try to detect the user OS; since the UA is extracted for QUIC traffic too, the "detected_os" field must be generic and not associated to HTTP flows only. Otherwise, you might overwrite some "tls_quic_stun" fields (SNI...) with random data. Strangely enough, the "detected_os" field is never used: it is never logged, or printed, or exported...
* Added missing libraryLuca Deri2021-01-22
|
* Added HTTP suspicious content securirty risk (useful for tracking trickbot)Luca Deri2021-01-02
|
* Added missing files to `make dist' target which are not required to build ↵Toni2020-09-29
| | | | | nDPI but still somehow essential. (#1024) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added risks for checkingLuca Deri2020-09-21
| | | | | - invalid DNS traffic (probably carrying exfiltrated data) - TLS traffic with no SNI extension
* Update example.aouinizied2020-09-14
|
* Added new risk for NDPI_UNSAFE_PROTOCOL that identifies protocols that are ↵Luca Deri2020-08-30
| | | | not condidered safe/secure
* Add Connectivity check category and blacklisted host risk.aouinizied2020-08-10
|
* Add risk flag about suspicious ESNI usageNardi Ivan2020-08-05
| | | | | | | | | | | | | | | In a Client Hello, the presence of both SNI and ESNI may obfuscate the real domain of an HTTPS connection, fooling DPI engines and firewalls, similarly to Domain Fronting. Such technique is reported in a presentation at DEF CON 28: "Domain Fronting is Dead, Long Live Domain Fronting: Using TLS 1.3 to evade censors, bypass network defenses, and blend in with the noise" Full credit for the idea must go the original author At the moment, the only way to get the pdf presention and related video is via https://forum.defcon.org/node/234492 Hopefully a direct link (and an example pcap) will be available soon
* Sync TLS definitions.aouinizied2020-08-01
|
* Update CFFI definitions.aouinizied2020-07-29
|
* added modified risksMrRadix2020-07-22
|
* added new risks to ndpi_risk_enumMrRadix2020-07-22
|
* Add ssl_version_str to flow structure.aouinizied2020-07-13
|
* Add NDPI_MALFORMED_PACKET risk.aouinizied2020-07-09
|
* Synchronize type definitions.aouinizied2020-06-12
|
* Update APIs and structures.aouinizied2020-05-22
|
* Fix flow_printer example.Zied Aouini2020-04-15
|
* Update Python cffi bindings.Zied Aouini2020-02-21
|
* nDPI now detect RCE in HTTP GET requestsMrTiz92020-01-24
|
* Update ndpi_flow_struct definition.Zied Aouini2019-12-23
|
* Implement cffi bindings.aouinizied2019-11-28
|
* Polish.aouinizied2019-11-15
|
* Improve python bindings.aouinizied2019-11-15
|
* Reworked categories handlingLuca Deri2019-09-29
| | | | | Removed GenericProtocol and replaced with categories Removed ndpi_pref_enable_category_substring_match option: substring matching is now default
* Add files via uploadbohmax2019-09-29
|
* Fixes #777Luca Deri2019-09-23
|
* Add files via uploadbohmax2019-09-23
|
* Delete ndpi_typestruct.pybohmax2019-09-23
|
* Added python bindings for nDPILuca Deri2019-09-15
Powered by cgit, Themed by Ted Yin.