aboutsummaryrefslogtreecommitdiff
path: root/src/include/ndpi_api.h.in
Commit message (Collapse)AuthorAge
* Add serialization of values list in TLVAlfredo Cardigliano2020-10-15
|
* Serialized doxygen docAlfredo Cardigliano2020-10-05
|
* Added ndpi_quick_16_byte_hashLuca2020-10-05
| | | | Warning fix
* Added back ndpi_check_flow_func (correct) prototypeLuca Deri2020-09-25
|
* Compilation fixLuca Deri2020-09-25
|
* Added extension to detect nested subdomains as used in Browsertunnel attack toolLuca Deri2020-09-09
| | | | https://github.com/veggiedefender/browsertunnel
* Add missing low-level serializer calls to the APIAlfredo Cardigliano2020-09-09
|
* Passes method_len param to ndpi_http_str2methodSimone Mainardi2020-08-27
|
* Added ndpi_http_method ndpi_http_str2method(const char* method) API callLuca Deri2020-08-26
|
* Added ndpi_http_method2str() API callLuca Deri2020-08-26
|
* Add (optional) dependency on external libraries: libgcrypt and libgpg-errorNardi Ivan2020-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To support QUIC payload and header decryption, it is necessary to choose an external crypto library to handle the low-level crypto stuff. Since we will use some Wireshark code, it is quite natural to choose the same library used by Wireshark itself: libgcrypt. More precisely, we will use libgcrypt and libgpg-error. Both libraries have LGPL license, so there should be no issue from this point of view. These libraries are not required to build nDPI, and their usage is optional: nDPI will keep working (and compiling) even if they are not available. However, without them, QUIC sub-classification is next to impossible. The configure flag "--disable-gcrypt" forces the build system to ignore these libraries. libgpg-error is only used for debug to have meaningful error messages and its usage is trivial. The same cannot be said for libgcrypt because its initialization is a significant issue. The rest of this commit message try explaining how libgcrypt is initialized. According to the documentation https://gnupg.org/documentation/manuals/gcrypt/Initializing-the-library.html https://gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html#Multi_002dThreading libgcrypt must be initialized before using it, but such initialization should be performed by the actual application and not by any library. Forcing the users to proper initialize libgcrypt in their own code seems unreasonable: most people using nDPI might be complete unaware of any crypto stuff and update each and every one application linking to nDPI with specific libgcrypt code should be out of question, anyway. Fortunately, it seems a workaround exists to initialize libgcrypt in a library https://lists.gnupg.org/pipermail/gcrypt-devel/2003-August/000458.html Therefore, we could provide a wrapper to this initialization stuff in a nDPI function. Unfortunately nDPI API lacks a global init function that must be called only once, before any other functions. We could add it, but that would be a major API break. AFAIK, ndpi_init_detection_module() might be called multiple times, for example to create multiple independent dpi engines in the same program. The proposed solution is to (optionally) initialize libgcrypt in ndpi_init_detection_module() anyway: * if the actual application doesn't directly use libgcrypt and only calls ndpi_init_detection_module() once, everything is formally correct and it should work out of the box [by far the most common user case]; * if the actual application already uses libgcrypt directly, it already performs the required initialization. In this case the ndpi_prefs.ndpi_dont_init_libgcrypt flag should be passed to ndpi_init_detection_module() to avoid further initializations. The only scenario not supported by this solution is when the application is unaware of libgcrypt and calls ndpi_init_detection_module() multiple times concurrently. But this scenario should be uncommon. A completely different option should be to switch to another crypto library, with a huge impact on the QUIC dissector code. Bottom line: crypto is hard, using libgcrypt is complex and the proposed initialization, even if not perfect, should cover the most frequent user cases and should work, for the time being. If anyone has some suggestions...
* Major rework of QUIC dissectorNardi Ivan2020-08-21
| | | | | Improve support for GQUIC (up to Q046) and add support for Q050 and (IETF-)QUIC Still no sub-classification for Q050 and QUIC
* Added note on memory managementLuca Deri2020-08-06
|
* Added new ndpi_string_sha1_hash API callLuca Deri2020-08-05
|
* Added ndpi_reset_data_analysis() API callLuca Deri2020-07-17
|
* Added ndpi_data_last() API callLuca Deri2020-07-16
|
* Added ndpi_data_window_variance() and ndpi_data_window_stddev() API callsLuca Deri2020-07-15
|
* Add ndpi_hll_reset() API callLuca Deri2020-07-15
| | | | Fixes bug in ndpi_data_window_average() with zero points
* Fixed race condition in ndpi_ssl_version2str() caused by static qualifier in ↵Toni Uhlig2020-07-11
| | | | | | | | | the version string buffer. * added also GREASE supported tls versions as specified in https://tools.ietf.org/html/draft-davidben-tls-grease-01#page-4 Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Various fixes in bins implementationLuca Deri2020-07-09
| | | | Added -b flag in ndpiReader to test bins
* Added -b to ndpiReader to evaluate binsLuca Deri2020-07-09
|
* Added ndpi_cluster_bins() for clustering bins and ancillary functions for ↵Luca Deri2020-07-07
| | | | bins manipulation
* Merge pull request #932 from IvanNardi/logLuca Deri2020-07-07
|\ | | | | Log
| * Fix compilation with --enable-debug-messages flagNardi Ivan2020-06-26
| | | | | | | | | | | | | | | | | | | | | | | | NDPI_LOG* macros dereference ndpi_detection_module_struct object which is private to ndpi library (via NDPI_LIB_COMPILATION define). So we can't use them outside the library itself, i.e. in ndpiReader code Therefore, in files in example/, convert all (rare) uses of NDPI_LOG* macros to a new very simple macro, private to ndpiReader program. If necessary, such macro may be improved. According to a comment in ndpi_define.h, each dissector must define its own NDPI_CURRENT_PROTO macro before including ndpi_api.h file
* | Added ndpi_print_bin() API callLuca Deri2020-06-29
| |
* | Added ndpi_bin_similarity() for computing bin similarityLuca Deri2020-06-29
| |
* | Values stored in patricia tree are now 32 bit (they used to be 16 bit) longLuca Deri2020-06-26
|/
* Added ndpi_bin_XXX APILuca Deri2020-06-22
| | | | Added packet lenght distribution bins
* Fixed API documentation: packet tiestamp is expressed in millisecondsLuca Deri2020-06-18
|
* Add API ndpi_serializer_get_formatAlfredo Cardigliano2020-06-16
|
* Added DGA risk for names that look like a DGALuca Deri2020-06-11
|
* Added HyperLogLog cardinality estimator API callsLuca Deri2020-06-10
| | | | | | | | | | | | | /* Memory lifecycle */ int ndpi_hll_init(struct ndpi_hll *hll, u_int8_t bits); void ndpi_hll_destroy(struct ndpi_hll *hll); /* Add values */ void ndpi_hll_add(struct ndpi_hll *hll, const char *data, size_t data_len); void ndpi_hll_add_number(struct ndpi_hll *hll, u_int32_t value) ; /* Get cardinality estimation */ double ndpi_hll_count(struct ndpi_hll *hll);
* Add ndpi_serializer_get_header API (CSV only)Alfredo Cardigliano2020-06-05
|
* Added ndpi_dpi2json() API callLuca Deri2020-06-05
|
* Reworked ndpi_strncasestrLuca Deri2020-05-31
|
* Added ndpi_serialize_risk() API functionLuca Deri2020-05-27
|
* Add ndpi_serialize_start_of_list/ndpi_serialize_end_of_list to serialize ↵Alfredo Cardigliano2020-05-25
| | | | simple lists in JSON
* Fixed docstring typos for ndpi_finalize_initalizationToni Uhlig2020-05-17
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added check for invalid HTTP URLsLuca Deri2020-05-16
|
* Added the ability to detect when a known protocol is using a non-standard portLuca Deri2020-05-10
| | | | Added check to spot executables exchanged via HTTP
* Fixed category matchingLuca Deri2020-05-06
|
* API cleanup for indetifying explicitly in automa's what we're searching ↵Luca Deri2020-05-06
| | | | | | (protocol or category) Removed hyperscan support that is apperently unused
* Updated automa API to use 32 bit values splits from protocol/categpryLuca Deri2020-05-06
|
* Introduced custom protocols with IP and (optional) port supportLuca Deri2020-05-06
| | | | | | | | | | | | | | | | Example - Single IP address ip:213.75.170.11@CustomProtocol - IP address with CIDR ip:213.75.170.11/32@CustomProtocol - IP address with CIDR and port ip:213.75.170.11/32:443@CustomProtocol Please note that there are some restrictions on the port usage. They have been listed in example/protos.txt
* Updated APILuca Deri2020-05-06
|
* Added ndpi_serialize_raw_record() API callLuca Deri2020-04-10
|
* Compilation fixLuca Deri2020-03-27
|
* Fix ndpi_get_api_version version truncationemanuele-f2020-03-25
|
* NDPI_API_VERSION is now computed automaticallyLuca Deri2020-03-25
Powered by cgit, Themed by Ted Yin.