| Commit message (Collapse) | Author | Age |
|
|
|
|
| |
- RSH vs Syslog may still happen for midstream traffic
Signed-off-by: lns <matzeton@googlemail.com>
|
| |
|
|
|
|
|
|
| |
- added syslog false-positive pcap that was missing in 09fbe0a64a11b08a35435f516e9a19f7e0c20d7c
- added NDPI_ARRAY_LENGTH() macro, usable on `type var[]` declarations
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
There is some overlap with Citrix protocol.
|
|
|
|
|
|
|
| |
* syslog: removed unnecessary/unreliable printable string check
* added `ndpi_isalnum()`
* splitted `ndpi_is_printable_string()` into `ndpi_is_printable_buffer()` and `ndpi_normalize_printable_string()`
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
|
|
|
| |
GCC analyzer won't complain about possible use-after-free (false positive).
* tests/do.sh prints word diff's only once and not the same over and over again
* sync unit tests
Signed-off-by: lns <matzeton@googlemail.com>
|
| |
|
|
|
|
|
| |
* Sync unit tests
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
This way, the CI results are consistent
|
| |
|
|
|
|
| |
Code cleanup
|
|
|
| |
Update .gitignore file
|
|
|
|
|
|
| |
* Improved HTTP POST detection
* Refactored subprotocol detection
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
| |
* If HTTP was already detected, there is no need to overwrite the detection again
Signed-off-by: lns <matzeton@googlemail.com>
|
| |
|
| |
|
| |
|
|
|
|
| |
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
| |
* Merged Xiaomi pcap files
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
| |
in PR #1534. (#1543)
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
|
| |
* #1532 did fx TLS appdata detection only partially
* use flow->l4.tcp.tls.message.buffer_used instead of packet->payload
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
|
|
|
| |
* Improved ASN update script
* Ran `utils/update_every_lists.sh'
* `tests/do.sh.in' prints the amount of failed pcap(s)
* `utils/asn_update.sh' prints the amount of failed download(s)
Signed-off-by: lns <matzeton@googlemail.com>
|
| |
|
| |
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
| |
Fixed typo
|
| |
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
| |
* ndpiReader: Print user agent if one was set and not just for certain protocols.
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
Most of the credits should go to @utoni (see #1521)
|
|
|
|
|
| |
* Frame Set PDU's do not get fully dissected for the sake of simplicity
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
|
|
|
| |
addresses/ranges. (#1524)
* Replaced return statements in `utils/*.sh' with exit's (such scripts should never source'd)
* Ran `utils/update_every_lists.sh'
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
| |
Follow-up of 8b062295
Add a new protocol id for generic Tencent/Wechat flows
|
|
|
|
|
| |
dissector. (#1520)
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
| |
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
|
|
| |
* Removed Visual Studio leftovers. Maintaining an autotools project with VS integration requires some additional overhead.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Signed-off-by: lns <matzeton@googlemail.com>
|
|
|
|
|
|
| |
* This is a quick fix, the Kerberos protocol dissector requires some refactoring effort.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Signed-off-by: lns <matzeton@googlemail.com>
|
| |
|
|
|
|
| |
Update unit tests results
Follow-up of d668ab4b
|
| |
|
|
|
|
|
|
| |
[SSDP] Added capture file with UA header.
[SSDP] Added pcap test output log file.
Signed-off-by: Darryl Sokoloski <darryl@sokoloski.ca>
|
|
|
|
|
|
| |
Support for v2-00 has been removed (it has never been used in real
networks and it is incompatible with v2-01).
Chrome already supports v2-01 in latest versions in Chrome Beta channel.
|
|
|
|
|
|
|
|
|
|
|
| |
* handling QUIC out-of-order fragments
* minor fix
* updated quic_frags_ch_out_of_order_same_packet_craziness.pcapng.out
* quic test: buf_len + last_pos
* QUIC: comment update in __reassemble function and minor change is_ch_complete function
|
|
|
|
| |
QUIC-34 is probably not used in production, but fixing it is trivial and
it doesn't add any noise to the already complex QUIC code.
|