From 380286c06974451bed47f14455272f051f809cbe Mon Sep 17 00:00:00 2001
From: Luca Deri <deri@ntop.org>
Date: Fri, 11 Jun 2021 22:21:03 +0200
Subject: Fixes https://github.com/ntop/ntopng/issues/5482

---
 example/ndpiReader.c | 17 ++++++++++-------
 src/lib/ndpi_main.c  |  2 +-
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/example/ndpiReader.c b/example/ndpiReader.c
index 450b47d0f..fceffa30a 100644
--- a/example/ndpiReader.c
+++ b/example/ndpiReader.c
@@ -224,7 +224,7 @@ extern void ndpi_report_payload_stats();
 
 /* ********************************** */
 
-#define DEBUG_TRACE
+// #define DEBUG_TRACE
 
 #ifdef DEBUG_TRACE
 FILE *trace = NULL;
@@ -3592,6 +3592,7 @@ static void dgaUnitTest() {
   };
 
   const char *non_dga[] = {
+    "dns.msftncsi.com",
     "www.confindustriabrescia.it",
     "mz.gov.pl",
     "zoomam104zc.zoom.us",
@@ -3624,7 +3625,7 @@ static void dgaUnitTest() {
     "mqtt.facebook.com",
     NULL
   };
-  int i;
+  int debug = 0, i;
   NDPI_PROTOCOL_BITMASK all;
   struct ndpi_detection_module_struct *ndpi_str = ndpi_init_detection_module(enable_ja3_plus ? ndpi_enable_ja3_plus : ndpi_no_prefs);
 
@@ -3637,14 +3638,16 @@ static void dgaUnitTest() {
 
   assert(ndpi_str != NULL);
 
-  for(i=0; dga[i] != NULL; i++)
-    assert(ndpi_check_dga_name(ndpi_str, NULL, (char*)dga[i], 1) == 1);
-
   for(i=0; non_dga[i] != NULL; i++) {
-    /* printf("Checking non DGA %s\n", non_dga[i]); */
+    if(debug) printf("Checking non DGA %s\n", non_dga[i]);
     assert(ndpi_check_dga_name(ndpi_str, NULL, (char*)non_dga[i], 1) == 0);
   }
-
+  
+  for(i=0; dga[i] != NULL; i++) {
+    if(debug) printf("Checking DGA %s\n", non_dga[i]);
+    assert(ndpi_check_dga_name(ndpi_str, NULL, (char*)dga[i], 1) == 1);
+  }
+  
   ndpi_exit_detection_module(ndpi_str);
 }
 
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index d4940868c..2a3e8664d 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -7595,7 +7595,7 @@ int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
 	     || enough(num_found, num_impossible)
 	     || ((num_trigram_checked > 2)
 		 && ((num_trigram_found < (num_trigram_checked/2))
-		     || ((num_trigram_vowels < (num_trigram_found-1)) && (num_dash == 0) && (num_dots > 1)))
+		     || ((num_trigram_vowels < (num_trigram_found-1)) && (num_dash == 0) && (num_dots > 1) && (num_impossible > 0)))
 		 )
 	     )
 	 )
-- 
cgit v1.2.3