aboutsummaryrefslogtreecommitdiff
path: root/src/lib/protocols/netbios.c
Commit message (Collapse)AuthorAge
* Remove `struct ndpi_packet_struct` from `struct ndpi_flow_struct` (#1319)Ivan Nardi2021-10-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are no real reasons to embed `struct ndpi_packet_struct` (i.e. "packet") in `struct ndpi_flow_struct` (i.e. "flow"). In other words, we can avoid saving dissection information of "current packet" into the "flow" state, i.e. in the flow management table. The nDPI detection module processes only one packet at the time, so it is safe to save packet dissection information in `struct ndpi_detection_module_struct`, reusing always the same "packet" instance and saving a huge amount of memory. Bottom line: we need only one copy of "packet" (for detection module), not one for each "flow". It is not clear how/why "packet" ended up in "flow" in the first place. It has been there since the beginning of the GIT history, but in the original OpenDPI code `struct ipoque_packet_struct` was embedded in `struct ipoque_detection_module_struct`, i.e. there was the same exact situation this commit wants to achieve. Most of the changes in this PR are some boilerplate to update something like "flow->packet" into something like "module->packet" throughout the code. Some attention has been paid to update `ndpi_init_packet()` since we need to reset some "packet" fields before starting to process another packet. There has been one important change, though, in ndpi_detection_giveup(). Nothing changed for the applications/users, but this function can't access "packet" anymore. The reason is that this function can be called "asynchronously" with respect to the data processing, i.e in context where there is no valid notion of "current packet"; for example ndpiReader calls it after having processed all the traffic, iterating the entire session table. Mining LRU stuff seems a bit odd (even before this patch): probably we need to rethink it, as a follow-up.
* Minor fixLuca Deri2021-07-05
|
* Code cleanupLuca Deri2021-07-05
|
* NetBIOS decoding changesLuca Deri2021-06-16
|
* Added further checksLuca Deri2021-05-15
|
* Enhanced netbios decoding checkLuca Deri2021-04-28
|
* (C) UpdateLuca Deri2021-01-07
|
* Added extension to detect nested subdomains as used in Browsertunnel attack toolLuca Deri2020-09-09
| | | | https://github.com/veggiedefender/browsertunnel
* Check for avoiding buffer overflow in netbios dissectorLuca Deri2020-07-14
|
* Added checks for DGA detectionLuca Deri2020-06-17
|
* Added DGA risk for names that look like a DGALuca Deri2020-06-11
|
* Fixed invalid checkLuca Deri2020-04-15
|
* Adds netbios bound checkPhilippe Antoine2020-04-15
|
* Fixes netbios overreadSimone Mainardi2020-03-12
| | | | | | This commit inherits from https://github.com/ntop/nDPI/commit/7a2bcd9c395f9fe554109e04add33e9e65564d82 but leaves ndpi_netbios_name_interpret as part of the API as it is used by ntopng
* Fixed API change which removed ndpi_netbios_name_interpretSimone Mainardi2020-03-12
| | | | This reverts commit 7a2bcd9c395f9fe554109e04add33e9e65564d82.
* Fix buffer overread in netbiosPhilippe Antoine2020-03-12
|
* Added SMBv1 over NetBIOS detectionLuca Deri2020-03-01
|
* Merge branch 'dev' of https://github.com/ntop/nDPI into devLuca Deri2020-01-05
|\
| * Removed disable_metadata_export preference that is no longer usefulLuca2019-12-29
| | | | | | | | since ndpi_process_extra_packet() can drive limited or full metadata export
* | Updated (C)Luca Deri2020-01-05
|/
* Added NetBIOS metadata exportLuca Deri2019-10-08
|
* Adedd DTLS check in STUNLuca Deri2019-09-21
| | | | Uodated (C)
* Improved skype, teredo, netbios heuristicsLuca Deri2018-11-21
| | | | Changed ndpi_detection_giveup() API: guess is now part of the call
* Major code cleanupLuca2018-07-21
| | | | Converted some not popular protocols to NDPI_PROTOCOL_GENERIC with category detection
* Added ndpi_set_detection_preferences() APi callLuca Deri2018-05-14
|
* Refactoring the debugging output.Vitaly Lavrov2017-10-26
| | | | | | | | | | | | | | levels of debug output: 0 - ERROR: Only for errors. 1 - TRACE: Start of each packets and if found protocol. 2 - DEBUG: Start of searching each protocol and excluding protocols. 3 - DEBUG_EXTRA: For all other messages. Added field ndpi_struct->debug_logging for enable debug output of each protocols. Simple macros for debugging output are added: NDPI_LOG_ERR(), NDPI_LOG_INFO(), NDPI_LOG_DBG(), NDPI_LOG_DBG2(), NDPI_EXCLUDE_PROTO()
* Improved netbios name decodingLuca Deri2017-03-19
|
* Exported ndpi_netbios_name_interpret() to all nDPI appsLuca Deri2017-03-19
|
* Improved netbios dissectionLuca Deri2017-03-19
|
* Enhanced string boundary check to avoid crashes with malformed packetsLuca Deri2016-06-15
|
* Fixed string offsetLuca Deri2015-11-22
|
* Improvements on netbios name detectionLuca Deri2015-11-22
|
* Reworked protocol initialization. Work in progress (more cleanup is needed)Luca2015-07-08
|
* Split former protocol into upper and lower protocolLuca2015-07-01
|
* Removed commented codeLuca2015-07-01
| | | | Renamed ndpi_int_add_connection() with ndpi_set_detected_protocol()
* deleted protocol type (real-correlated)Michele Campus2015-06-29
|
* Initial import from SVNLuca Deri2015-04-19
Powered by cgit, Themed by Ted Yin.