| Commit message (Collapse) | Author | Age |
... | |
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
* added raw tcp fingerprint to json
* removed unnecessary change
* fixed key for json
* added configuration option for raw tcp fingerprint
* fixed typos
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
NDPI_PROTOCOL_CATEGORY_FINANCE
NDPI_PROTOCOL_CATEGORY_NEWS
NDPI_PROTOCOL_CATEGORY_SPORT
NDPI_PROTOCOL_CATEGORY_BUSINESS
NDPI_PROTOCOL_CATEGORY_INTERNET_HOSTING
NDPI_PROTOCOL_CATEGORY_BLOCKCHAIN_CRYPTO
NDPI_PROTOCOL_CATEGORY_BLOG_FORUM
NDPI_PROTOCOL_CATEGORY_GOVERNMENT
NDPI_PROTOCOL_CATEGORY_EDUCATION
NDPI_PROTOCOL_CATEGORY_CND_PROXY
NDPI_PROTOCOL_CATEGORY_HARDWARE_SOFTWARE
NDPI_PROTOCOL_CATEGORY_DATING
NDPI_PROTOCOL_CATEGORY_TRAVEL
|
| |
|
| |
|
|
|
|
| |
Cloudflare CDN
|
| |
|
|
|
|
|
| |
Remove the specific dissector and use the Blizzard's generic one.
For the time being, keep `NDPI_PROTOCOL_WORLDOFWARCRAFT`
|
| |
|
| |
|
|
|
|
| |
Follow-up of f56831336334dddcff00eaf2132e5e0f226f0e32: now the
configuration is for flow-risk, not global
|
|
|
|
|
|
|
| |
int ndpi_add_tcp_fingerprint(struct ndpi_detection_module_struct *ndpi_str,
char *fingerprint, enum operating_system_hint os);
int load_tcp_fingerprint_file_fd(struct ndpi_detection_module_struct *ndpi_str, FILE *fd);
int ndpi_load_tcp_fingerprint_file(struct ndpi_detection_module_struct *ndpi_str, const char *path);
|
|
|
|
|
| |
games (#2776)
Remove `NDPI_PROTOCOL_STARCRAFT` and add a generic `NDPI_PROTOCOL_BLIZZARD`.
|
|
|
|
|
|
|
| |
Use `NDPI_OBFUSCATED_TRAFFIC` instead; this way, all the obfuscated
traffic is identified via `NDPI_OBFUSCATED_TRAFFIC` flow risk.
Disable fully-encryption detection by default, like all the obfuscation
heuristics.
|
|
|
|
|
|
| |
That flow risk was introduced in 79b89d286605635f15edfe3c21297aaa3b5f3acf
but we can now use the generic `NDPI_TLS_SUSPICIOUS_EXTENSION` instead:
ESNI is quite suspicious nowadays in itself (i.e. even without SNI).
Note that ESNI support has been removed in cae9fb9989838f213eeb857b8fc4bbeac6940049
|
| |
|
| |
|
|
|
|
|
|
| |
(#2773)
Remove `NDPI_PROTOCOL_MAPLESTORY` and add a generic
`NDPI_PROTOCOL_NEXON`
|
|
|
|
| |
We are going to use HTTP metadata only for real HTTP traffic; FastCGI
should be the only protocol using them improperly
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
These flows are already classified as TLS.RDP.
This change also fix a memory leak
```
Direct leak of 62 byte(s) in 1 object(s) allocated from:
#0 0x5883d762429f in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
#1 0x5883d76fe46a in ndpi_malloc ndpi/src/lib/ndpi_memory.c:57:46
#2 0x5883d76fe46a in ndpi_strdup ndpi/src/lib/ndpi_memory.c:110:13
#3 0x5883d77adcd6 in ndpi_compute_ja4 ndpi/src/lib/protocols/tls.c:2298:46
#4 0x5883d77ab2ec in processClientServerHello ndpi/src/lib/protocols/tls.c:3314:10
#5 0x5883d77a4c51 in processTLSBlock ndpi/src/lib/protocols/tls.c:1319:5
```
Found by oss-fuzz.
See: https://oss-fuzz.com/testcase-detail/5244512192757760
|
|\
| |
| | |
Add a new internal function `internal_giveup()`
|
| |
| |
| |
| |
| |
| |
| |
| | |
This function is always called once for every flow, as last code
processing the flow itself.
As a first usage example, check here if the flow is unidirectional
(instead of checking it at every packets)
|
| |
| |
| | |
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
| |
| |
| |
| |
| | |
protocol dissector will follow
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
|/
|
| |
Co-authored-by: Leonardo Teixeira Alves <leonardo.alves@zerum.com>
|
|
|
|
| |
For the most common protocols, avoid creating the string message if we
are not going to use it
|
|
|
|
|
|
|
| |
There are no reasons to keep entropy calculation and sanity checks code
on the "guessing" algorithm.
BTW, this change also fix the entropy calculation for non TCP/UDP/ICMP
flows
|
|
|
|
| |
One list is from ingress nodes (used for protocol classification) and
the second one is from exit nodes (used for flow risk check)
|
| |
|
| |
|
|
|
| |
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
|
|
| |
Close #2738
|
|
|
|
|
| |
Thiw way, the code is ready to handle rtp info from STUN flows too.
And, most important, this change works as workaround to fix some crashes
reported by oss-fuzz
|
| |
|
|
|
|
| |
Added ndpi_rtp_payload_type2str() API call
|
| |
|
| |
|
|
|
| |
See 6899f6c17 and 9bf513b34
|
| |
|
|
|
| |
Close #2524
|
|
|
|
|
| |
Try to populate the FPC-DNS cache using directly the info from the current
packet, and not from the metadata saved in `struct ndpi_flow_struct`. This
will be important when adding monitoring support
|