| Commit message (Collapse) | Author | Age |
... | |
|
|
|
|
|
|
|
|
| |
Even if it is only an early internet draft, DoQ has already (at least)
one deployed implementation.
See: https://www.zdnet.com/article/ad-blocker-adguard-deploys-worlds-first-dns-over-quic-resolver/
Draft: https://tools.ietf.org/html/draft-huitema-dprive-dnsoquic-00
In the future, if this protocol will be really used, it might be worth to
rename NDPI_PROTOCOL_DOH_DOT in NDPI_PROTOCOL_DOH_DOT_DOQ
|
|
|
|
|
| |
* QUIC: fix heap-buffer-overflow
* TLS: fix parsing of QUIC Transport Parameters
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* QUIC: SNI should be always saved in flow->protos.stun_ssl.ssl.client_requested_server_name
Close #1077
* QUIC: fix matching of custom categories
* QUIC: add NDPI_TLS_MISSING_SNI support for older GQUIC versions
* QUIC: fix serialization
* QUIC: add DGA check for older GQUIC versions
|
|
|
|
| |
be present with POSTs and not with other methods such as GET
|
| |
|
|
|
| |
QUIC (final!?) constants for v1 are defined in draft-33
|
| |
|
|
|
|
|
|
| |
FB_ZERO was an experimental protocol run by Facebook.
They switched to QUIC/TLS1.3 more than 2 years ago; no one ever used it but
them so it is definitely dead.
See: https://engineering.fb.com/2018/08/06/security/fizz/
|
|
|
|
|
| |
ndpi_flow_struct but not the struct itself. (#1101)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
| |
this bug is from commit `427002d14` `2020-05-06 00:31:40`
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
| |
invalidate dissection
|
| |
|
| |
|
| |
|
| |
|
|
|
| |
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
|
|
| |
Close #1082
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
START_TLS used. (#1079)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
|
|
|
|
|
|
| |
* Add connectionless DCE/RPC detection
* Add DCE/RPC pcap file as well as its test result
Co-authored-by: rafal <rafal.burzynski@cryptomage.com>
|
|
|
|
|
|
|
|
|
| |
Most of the QUIC crypto code has been "copied-and-pasted" from Wireshark;
try to stay in sync with the original sources to ease backporting of fixes.
Only cosmetic changes and code refactoring; no behaviour changes or bugfixes.
See:
https://gitlab.com/wireshark/wireshark/-/commit/5e45f770fd79ca979c41ed397fee72d2e8fb5f1e
https://gitlab.com/wireshark/wireshark/-/commit/5798b91c1526747bf688b6746b33562c1b24a9e0
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
| |
* Fixed stack overflow caused by missing buffer space for the trailing \0 added by sprintf()
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Remove the autoconf cache value from the previous and failed check before checking again.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
| |
* QUIC: fix return value on error path on quic_cipher_init()
* QUIC: allow dissection of sessions forcing version negotiation
Enhance heuristic to avoid false positives.
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Add AmazonAlexa protocol.
* Add AmazonAlexa test file and result.
* Include pcapng as file format.
* Rename Category to VirtualAssistant.
* Add AppleSiri virtual assistant.
* Fix pcapng test files format support.
Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
|
|
|
| |
Signed-off-by: Oleksandr Natalenko <oleksandr@natalenko.name>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* Improve Spotify detection.
* Improve Skype detection.
* Improve Microsoft detection.
* Fix Microsoft detection categories.
* Improve Waze detection.
* Improve Apple detection.
* Improve WindowsUpdate detection.
* Improve TikTok detection.
* Improve Teams detection.
* Improve Youtube detection.
* Improve Messenger detection.
* Improve Twitch detection.
* Improve Hulu detection.
* Improve Facebook detection.
* Improve AmazonVideo detection.
|
|
|
|
|
|
|
| |
* Add Tumblr protocol.
* Add Tumblr test file and result.
Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
|