vikarti.anatra/safing-portmaster
1
0
Fork 0
mirror of https://github.com/safing/portmaster synced 2025-04-25 13:29:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Restructure detection packages

Browse source
This commit is contained in:
Daniel 2019-11-07 16:36:57 +01:00
parent 2d476eafc6
commit fc5b92118c
3 changed files with 4 additions and 4 deletions
detection/dga
lms.golms_test.go
nameserver
nameserver.go

2
analytics/algs/lms.go → detection/dga/lms.go
View file

@ -1,4 +1,4 @@
package algs
package dga
import (
"strings"

2
analytics/algs/lms_test.go → detection/dga/lms_test.go
View file

@ -1,4 +1,4 @@
package algs
package dga
import "testing"

4
nameserver/nameserver.go
View file

@ -12,7 +12,7 @@ import (
"github.com/safing/portbase/log"
"github.com/safing/portbase/modules"
"github.com/safing/portmaster/analytics/algs"
"github.com/safing/portmaster/detection/dga"
"github.com/safing/portmaster/firewall"
"github.com/safing/portmaster/intel"
"github.com/safing/portmaster/network"
@ -180,7 +180,7 @@ func handleRequest(ctx context.Context, w dns.ResponseWriter, query *dns.Msg) er
// check for possible DNS tunneling / data transmission
// TODO: improve this
lms := algs.LmsScoreOfDomain(q.FQDN)
lms := dga.LmsScoreOfDomain(q.FQDN)
// log.Tracef("nameserver: domain %s has lms score of %f", fqdn, lms)
if lms < 10 {
tracer.Warningf("nameserver: possible data tunnel by %s: %s has lms score of %f, returning nxdomain", comm.Process(), q.FQDN, lms)