mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-04-29 07:29:39 +00:00
Add (kind of) support for loading a list of JA4C malicious fingerprints (#2678)
It might be usefull to be able to match traffic against a list of suspicious JA4C fingerprints Use the same code/logic/infrastructure used for JA3C (note that we are going to remove JA3C...) See: #2551
This commit is contained in:
parent
69a4f8120a
commit
63a3547f99
33 changed files with 200 additions and 299 deletions
27
fuzz/fuzz_filecfg_malicious_ja4.c
Normal file
27
fuzz/fuzz_filecfg_malicious_ja4.c
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
#include "ndpi_api.h"
|
||||
#include "ndpi_private.h"
|
||||
#include "fuzz_common_code.h"
|
||||
|
||||
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
|
||||
struct ndpi_detection_module_struct *ndpi_struct;
|
||||
FILE *fd;
|
||||
NDPI_PROTOCOL_BITMASK all;
|
||||
|
||||
/* To allow memory allocation failures */
|
||||
fuzz_set_alloc_callbacks_and_seed(size);
|
||||
|
||||
ndpi_struct = ndpi_init_detection_module(NULL);
|
||||
NDPI_BITMASK_SET_ALL(all);
|
||||
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
|
||||
|
||||
ndpi_set_config(ndpi_struct, NULL, "log.level", "3");
|
||||
ndpi_set_config(ndpi_struct, "all", "log", "1");
|
||||
|
||||
fd = buffer_to_file(data, size);
|
||||
load_malicious_ja4_file_fd(ndpi_struct, fd);
|
||||
if(fd)
|
||||
fclose(fd);
|
||||
|
||||
ndpi_exit_detection_module(ndpi_struct);
|
||||
return 0;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue