aboutsummaryrefslogtreecommitdiff
path: root/src/include/ndpi_main.h
Commit message (Collapse)AuthorAge
* Use Doxygen to generate the API documentation.add/doxygen-genlns2022-05-29
| | | | | | * Integrated Doxygen documentation into Sphinx Signed-off-by: lns <matzeton@googlemail.com>
* Improved detection of invalid SNI and hostnames in TLS, HTTPLuca Deri2022-05-24
|
* Added generic user agent setter. (#1530)Toni2022-04-25
| | | | | * ndpiReader: Print user agent if one was set and not just for certain protocols. Signed-off-by: lns <matzeton@googlemail.com>
* Add ICMP checksum check and set risk if mismatch detected. (#1464)Toni2022-03-02
| | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Bug fixing. (#1459)Vitaly Lavrov2022-02-28
| | | | | The '--enable-debug-messages' option works again. Fixed warning in ahocorasick.c Fixed integer overflow in ndpiReader.c for 32bit systems.
* Add a "confidence" field about the reliability of the classification. (#1395)Ivan Nardi2022-01-11
| | | | | | | | | | | | | As a general rule, the higher the confidence value, the higher the "reliability/precision" of the classification. In other words, this new field provides an hint about "how" the flow classification has been obtained. For example, the application may want to ignore classification "by-port" (they are not real DPI classifications, after all) or give a second glance at flows classified via LRU caches (because of false positives). Setting only one value for the confidence field is a bit tricky: more work is probably needed in the next future to tweak/fix/improve the logic.
* Update copyrightAlfredo Cardigliano2022-01-03
|
* Added support for Log4J/Log4Shell detection in nDPI via a new flow risk ↵Luca Deri2021-12-23
| | | | named NDPI_POSSIBLE_EXPLOIT
* Improve IPv6 support, enabling IPv6 traffic on (almost) all dissectors. (#1380)Ivan Nardi2021-12-04
| | | | | | | | | | | There are no valid reasons for a (generic) protocol to ignore IPv6 traffic. Note that: * I have not found the specifications of "CheckPoint High Availability Protocol", so I don't know how/if it supports IPv6 * all LRU caches are still IPv4 only Even if src_id/dst_id stuff is probably useless (see #1279), the right way to update the protocol classification is via `ndpi_set_detected_protocol()`
* Rework how hostname/SNI info is saved (#1330)Ivan Nardi2021-11-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | Looking at `struct ndpi_flow_struct` the two bigger fields are `host_server_name[240]` (mainly for HTTP hostnames and DNS domains) and `protos.tls_quic.client_requested_server_name[256]` (for TLS/QUIC SNIs). This commit aims to reduce `struct ndpi_flow_struct` size, according to two simple observations: 1) maximum one of these two fields is used for each flow. So it seems safe to merge them; 2) even if hostnames/SNIs might be very long, in practice they are rarely longer than a fews tens of bytes. So, using a (single) large buffer is a waste of memory for all kinds of flows. If we need to truncate the name, we keep the *last* characters, easing domain matching. Analyzing some real traffic, it seems safe to assume that the vast majority of hostnames/SNIs is shorter than 80 bytes. Hostnames/SNIs are always converted to lowercase. Attention was given so as to be sure that unit-tests outputs are not affected by this change. Because of a bug, TLS/QUIC SNI were always truncated to 64 bytes (the *first* 64 ones): as a consequence, there were some "Suspicious DGA domain name" and "TLS Certificate Mismatch" false positives.
* Detect invalid characters in text and set a risk. Fixes #1347. (#1363)Toni2021-10-26
| | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fix broken fuzz_process_packet fuzzer by adding a call to ↵Toni2021-10-18
| | | | | | | | | | | | ndpi_finalize_initialization(). (#1334) * fixed several memory errors (heap-overflow, unitialized memory, etc) * ability to build fuzz_process_packet with a main() allowing to replay crash data generated with fuzz_process_packet by LLVMs libfuzzer * temporarily disable fuzzing if `tests/do.sh` executed with env FUZZY_TESTING_ENABLED=1 Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Remove `detected_protocol_stack` field from `ndpi_packet_struct` (#1317)Ivan Nardi2021-09-29
| | | | | | | | | | | | | This field is an exact copy of `ndpi_flow_struct->detected_protocol_stack[2]`: * at the very beginning of packet dissection, the value saved in `flow->detected_protocol_stack` is copied in `packet->detected_protocol_stack` (via `ndpi_detection_process_packet()` -> `ndpi_init_packet_header()`) * every time we update `flow->detected_protocol_stack` we update `packet->detected_protocol_stack` too (via `ndpi_int_change_protocol()` -> `ndpi_int_change_packet_protocol()`) These two fields are always in sync: keeping the same value in two different places is useless.
* Added entropy calculation to check for suspicious (encrypted) payload. (#1270)Toni2021-08-08
| | | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com> Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
* Added ability to report whether a protocol is encryptedLuca Deri2021-08-07
| | | | | | | | | Added new API calls - u_int8_t ndpi_is_valid_protoId(u_int16_t protoId); Cleaned up code and organized in a function. - u_int8_t ndpi_is_encrypted_proto(struct ndpi_detection_module_struct *ndpi_str, ndpi_protocol proto); Check whether a protocol is encrypted or not based on master and app protocols
* Implemented ALPN automa for checking uncommon ALPNsLuca Deri2021-07-24
|
* Reworked flow risk implementationLuca Deri2021-07-23
|
* Added risk: TLS_EXTENSION_SUSPICIOUS (#1252)Toni2021-07-19
| | | | | | * validates client/server hello TLS extensions * inspects content for some extensions Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* NetBIOS decoding changesLuca Deri2021-06-16
|
* Refactored nDPI subprotocol handling and aimini protocol detection. (#1156)Toni2021-03-23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Refactored and merged callback buffer routines for non-udp-tcp / udp / tcp / tcp-wo-payload. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Try to detect one subprotocol if a detected protocol can have one. * This adds a performance overhead due to much more protocol detection routine calls. See #1148 for more information. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Refactor subprotocol handling (1/2). Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Refactor subprotocol handling (2/2). Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Prevent some code duplication by using macros for ndpi_int_one_line_struct string comparision. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Refactored aimini HTTP detection parts (somehow related to #1148). Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Added aimini client/server test pcap. Signed-off-by: Toni Uhlig <matzeton@googlemail.com> * Removed master protocol as it was only used for STUN and via also removed API function ndpi_get_protocol_id_master_proto * Adjusted Python code to conform to the changes made during the refactoring process. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved DGA detection with trigrams. Disadvantage: slower startup timeLuca Deri2021-03-03
| | | | | Reworked Tor dissector embedded in TLS (fixes #1141) Removed false positive on HTTP User-Agent
* Removed now obsolete NDPI_DETECTION_SUPPORT_IPV6: code is more readeable nowLuca Deri2021-02-10
|
* (C) UpdateLuca Deri2021-01-07
|
* Use ndpi_handle_ipv6_extension_headers in reader_utilPhilippe Antoine2020-04-15
|
* Fixes netbios overreadSimone Mainardi2020-03-12
| | | | | | This commit inherits from https://github.com/ntop/nDPI/commit/7a2bcd9c395f9fe554109e04add33e9e65564d82 but leaves ndpi_netbios_name_interpret as part of the API as it is used by ntopng
* Fixed API change which removed ndpi_netbios_name_interpretSimone Mainardi2020-03-12
| | | | This reverts commit 7a2bcd9c395f9fe554109e04add33e9e65564d82.
* Fix buffer overread in netbiosPhilippe Antoine2020-03-12
|
* Updated (C)Luca Deri2020-01-05
|
* Implement nDPI patricia tree APIemanuele-f2019-10-15
|
* Adedd DTLS check in STUNLuca Deri2019-09-21
| | | | Uodated (C)
* Add ndpi_parse_ip_string and ndpi_get_ip_string APIemanuele-f2019-09-19
|
* Fixed false positive with FTP_DATA protocolLuca2019-04-05
| | | | | Added coherency in application protol guess by exploiting the host server name Various protocol optimizations
* Added the concept of protocols that can have subprotocols. Example Spotify ↵Luca2018-11-30
| | | | | | cannot have subprotocols, DNS can (DNS.Spotify) Merged Skype call in/out in Skype Call
* Improved WeChat supportLuca Deri2018-11-19
| | | | | Removed Musical.ly protocol as the service has been merged with another one and thus it is no longer used Improved guess for UDP protocols
* Completed custom category implementationLuca Deri2018-08-16
|
* Major code cleanupLuca2018-07-21
| | | | Converted some not popular protocols to NDPI_PROTOCOL_GENERIC with category detection
* Hidden ndpi_detection_module_struct definitionLuca Deri2018-05-14
|
* Moved ndpi_config.h from ndpi_main.h to ndpi_main.c, and example source files.Darryl Sokoloski2018-04-24
|
* Added option --enable-debug-messages.Vitaly Lavrov2018-02-07
| | | | | | The configurator option "--enable-debug-messages" is added to enable debug information output (define NDPI_ENABLE_DEBUG_MESSAGES=1). Mandatory inclusion of the file ndpi_config.h in all the compiled files.
* Added LISP protocol. By Huniya Arif (xFlowResearch)huniya arif, xflowResearch2017-09-14
|
* Exported ndpi_netbios_name_interpret() to all nDPI appsLuca Deri2017-03-19
|
* Add protocol category idsemanuele-f2016-10-22
|
* Added ndpi_get_proto_by_name() for mapping protocolIDs to protocol namesLuca Deri2016-07-25
| | | | Added a new parameter to ndpi_guess_protocol_id() to indicate if the guessed protocol has been set by the user through a custom protocols file
* rework some stuffs - added missing comments on functionsCampus2016-04-24
|
* Fixed buffer overflows with safe str searchtheirix2016-04-12
| | | | | | | | | | | | 1. Detected a lot of memory errors using address sanitizer and ndpi-scapy tool. 2. Added ndpi_match_prefix function that compares strings with taking care of payload packet len. Almost drop-in replacement for match_first_bytes function. 3. Replaced unsafe match_first_bytes usage with a ndpi_match_prefix and additional length checks.
* reorganized header files - added ndpi_includes.hCampus2015-11-30
|
* Win32 compilation fixesLuca Deri2015-11-26
|
* fixed missed library netinet/in.h under FreeBSDCampus2015-11-26
|
* deleted useless or not used functions and #ifdefCampus2015-11-10
|
* initial refactoring nDPI - typedef defined only in ndpi_typedef.hCampus2015-11-09
|
Powered by cgit, Themed by Ted Yin.