Add (kind of) support for loading a list of JA4C malicious fingerprints (#2678)

It might be usefull to be able to match traffic against a list of
suspicious JA4C fingerprints

Use the same code/logic/infrastructure used for JA3C (note that we are
going to remove JA3C...)

See: #2551
This commit is contained in:
Ivan Nardi 2025-01-14 12:05:03 +01:00 committed by GitHub
parent 69a4f8120a
commit 63a3547f99
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
33 changed files with 200 additions and 299 deletions

View file

@ -0,0 +1,27 @@
#include "ndpi_api.h"
#include "ndpi_private.h"
#include "fuzz_common_code.h"
int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
struct ndpi_detection_module_struct *ndpi_struct;
FILE *fd;
NDPI_PROTOCOL_BITMASK all;
/* To allow memory allocation failures */
fuzz_set_alloc_callbacks_and_seed(size);
ndpi_struct = ndpi_init_detection_module(NULL);
NDPI_BITMASK_SET_ALL(all);
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
ndpi_set_config(ndpi_struct, NULL, "log.level", "3");
ndpi_set_config(ndpi_struct, "all", "log", "1");
fd = buffer_to_file(data, size);
load_malicious_ja4_file_fd(ndpi_struct, fd);
if(fd)
fclose(fd);
ndpi_exit_detection_module(ndpi_struct);
return 0;
}