aboutsummaryrefslogtreecommitdiff
path: root/src/lib/ndpi_main.c
Commit message (Collapse)AuthorAge
* Various optimizations to reduce not-necessary callsLuca Deri2020-09-24
| | | | | Optimized various UDP dissectors Removed dead protocols such as pando and pplive
* Merge pull request #1017 from lnslbrty/fix/mingw-xcompileLuca Deri2020-09-20
|\ | | | | Added support for mingw xcompile.
| * Fixed shlib xcompile for x86_64-w64-mingw32Toni Uhlig2020-09-08
| | | | | | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* | Added MDNS in extra packet dissection functionLuca Deri2020-09-18
| |
* | Reworked MDNS dissector that is not based on the DNS dissectorLuca Deri2020-09-17
| |
* | Reworked DGA checksLuca Deri2020-09-11
| |
* | Added buffer check in DGA analysisLuca Deri2020-09-10
| |
* | Complation fix as not on all platforms isnumber() is availablelucaderi2020-09-10
| |
* | Added extension to detect nested subdomains as used in Browsertunnel attack toolLuca Deri2020-09-09
| | | | | | | | https://github.com/veggiedefender/browsertunnel
* | Improved dnscrypt v1/v2 protocol detection.Toni Uhlig2020-09-06
|/ | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added (optional) notifier for LRU addLuca Deri2020-08-31
|
* Added new risk for NDPI_UNSAFE_PROTOCOL that identifies protocols that are ↵Luca Deri2020-08-30
| | | | not condidered safe/secure
* Fixed false positive in suspicous user agentLuca Deri2020-08-30
| | | | Optimized stddev calculation
* Creared IoT-Scada categoryLuca Deri2020-08-23
| | | | Minor dnp3 changes
* Cosmetic fixLuca Deri2020-08-22
|
* Update TLS dissector to handle QUIC flowsNardi Ivan2020-08-21
| | | | | | | Latest QUIC versions use TLS for the encryption layer: reuse existing code to allow Client Hello parsing and sub-classification based on SNI value. Side effect: we might have J3AC, TLS negotiated version, SNI value and supported cipher list for QUIC, too.
* Add (optional) dependency on external libraries: libgcrypt and libgpg-errorNardi Ivan2020-08-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To support QUIC payload and header decryption, it is necessary to choose an external crypto library to handle the low-level crypto stuff. Since we will use some Wireshark code, it is quite natural to choose the same library used by Wireshark itself: libgcrypt. More precisely, we will use libgcrypt and libgpg-error. Both libraries have LGPL license, so there should be no issue from this point of view. These libraries are not required to build nDPI, and their usage is optional: nDPI will keep working (and compiling) even if they are not available. However, without them, QUIC sub-classification is next to impossible. The configure flag "--disable-gcrypt" forces the build system to ignore these libraries. libgpg-error is only used for debug to have meaningful error messages and its usage is trivial. The same cannot be said for libgcrypt because its initialization is a significant issue. The rest of this commit message try explaining how libgcrypt is initialized. According to the documentation https://gnupg.org/documentation/manuals/gcrypt/Initializing-the-library.html https://gnupg.org/documentation/manuals/gcrypt/Multi_002dThreading.html#Multi_002dThreading libgcrypt must be initialized before using it, but such initialization should be performed by the actual application and not by any library. Forcing the users to proper initialize libgcrypt in their own code seems unreasonable: most people using nDPI might be complete unaware of any crypto stuff and update each and every one application linking to nDPI with specific libgcrypt code should be out of question, anyway. Fortunately, it seems a workaround exists to initialize libgcrypt in a library https://lists.gnupg.org/pipermail/gcrypt-devel/2003-August/000458.html Therefore, we could provide a wrapper to this initialization stuff in a nDPI function. Unfortunately nDPI API lacks a global init function that must be called only once, before any other functions. We could add it, but that would be a major API break. AFAIK, ndpi_init_detection_module() might be called multiple times, for example to create multiple independent dpi engines in the same program. The proposed solution is to (optionally) initialize libgcrypt in ndpi_init_detection_module() anyway: * if the actual application doesn't directly use libgcrypt and only calls ndpi_init_detection_module() once, everything is formally correct and it should work out of the box [by far the most common user case]; * if the actual application already uses libgcrypt directly, it already performs the required initialization. In this case the ndpi_prefs.ndpi_dont_init_libgcrypt flag should be passed to ndpi_init_detection_module() to avoid further initializations. The only scenario not supported by this solution is when the application is unaware of libgcrypt and calls ndpi_init_detection_module() multiple times concurrently. But this scenario should be uncommon. A completely different option should be to switch to another crypto library, with a huge impact on the QUIC dissector code. Bottom line: crypto is hard, using libgcrypt is complex and the proposed initialization, even if not perfect, should cover the most frequent user cases and should work, for the time being. If anyone has some suggestions...
* Added new check for detecting suspicious (too long) namesLuca Deri2020-08-21
|
* Added the ability do identigy as DGA those host/domain names with too many ↵Luca Deri2020-08-21
| | | | | | | consucutive repeated characters such as ckaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa used fr netbios reflection attacks https://www.akamai.com/uk/en/multimedia/documents/state-of-the-internet/ddos-reflection-netbios-name-server-rpc-portmap-sentinel-udp-threat-advisory.pdf
* Merge pull request #985 from lnslbrty/add/SOAPLuca Deri2020-08-19
|\ | | | | Added support for SOAP.
| * Added support for SOAP.Toni Uhlig2020-08-18
| | | | | | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* | Added support for discordLuca Deri2020-08-16
|/
* Fixes invalid detection on traffic on non standard portsLuca Deri2020-08-12
|
* Improved DGA detection algoritmLuca Deri2020-08-11
|
* Added case-insensitive substring matchingLuca Deri2020-08-10
|
* Added new traffic category for connectivity check detectionLuca Deri2020-08-04
|
* Tiny changes for TLS block lenght dissectionLuca Deri2020-07-29
|
* TLS dissection improvementsLuca Deri2020-07-28
|
* Improved bin clusteringLuca Deri2020-07-22
|
* User agent detection improvementsLuca Deri2020-07-21
|
* Indendentation fixLuca Deri2020-07-16
|
* 1:add free pointer NULL check;2:fix xbox and teredo protocol detected error ↵ysk2020-07-16
| | | | when use the commm udp port 3544
* add improved boundary check and check malloc return is NULLysk2020-07-10
|
* Merge pull request #932 from IvanNardi/logLuca Deri2020-07-07
|\ | | | | Log
| * Incorporated some feedbackNardi Ivan2020-07-01
| |
| * Fix compilation with --enable-debug-messages flagNardi Ivan2020-06-26
| | | | | | | | | | | | | | | | | | | | | | | | NDPI_LOG* macros dereference ndpi_detection_module_struct object which is private to ndpi library (via NDPI_LIB_COMPILATION define). So we can't use them outside the library itself, i.e. in ndpiReader code Therefore, in files in example/, convert all (rare) uses of NDPI_LOG* macros to a new very simple macro, private to ndpiReader program. If necessary, such macro may be improved. According to a comment in ndpi_define.h, each dissector must define its own NDPI_CURRENT_PROTO macro before including ndpi_api.h file
* | IndentLuca Deri2020-06-30
| |
* | Fix segfault on ndpi_guess_protocol_id with flow = nullAlfredo Cardigliano2020-06-30
| |
* | Fix use-after-free in http content parsingNardi Ivan2020-06-28
| |
* | DNP3: add missing initializationNardi Ivan2020-06-28
| |
* | Added malformed packet risk supportLuca Deri2020-06-26
|/
* Fixed use after free caused by dangling pointerToni Uhlig2020-06-21
| | | | | | * This fix also improved RCE Injection detection Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fixed API documentation: packet tiestamp is expressed in millisecondsLuca Deri2020-06-18
|
* DGA detection improvementsLuca Deri2020-06-18
|
* Added checks for DGA detectionLuca Deri2020-06-17
|
* Implemented proprietary AnyDesk protocolToni Uhlig2020-06-17
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fixed invalid assignment (typo)Luca Deri2020-06-14
|
* Added improved boundary checkLuca Deri2020-06-14
|
* Added DGA risk for names that look like a DGALuca Deri2020-06-11
|
* Added HTTP checkLuca Deri2020-06-07
|
Powered by cgit, Themed by Ted Yin.