Commit graph

3724 commits

Author SHA1 Message Date
Ivan Nardi
4445989588
Update host content list match (#1633)
Improve classifications of Outlook, Cachefly, Cloudflare, Tiktok and
Cybersecurity.
2022-07-04 13:21:11 +02:00
Toni
a1de0285eb
Sync Psiphon unit test. (#1634)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-04 13:20:44 +02:00
Toni
75f7da5c26
Added Psiphon detection patterns. See #566 and #1099. (#1631)
* The traces are not up to date, but this is the best we got so far.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-04 10:34:54 +02:00
Ivan Nardi
192a32207c
OCSP: improve detection (#1629) 2022-07-04 07:22:56 +02:00
Toni
a74fc089c4
Added i3D and RiotGames protocol dissectors. (#1609)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-03 20:43:30 +02:00
Ivan Nardi
faaff58620
TargusDataspeed: avoid false positives (#1628)
TargusDataspeed dissector doesn't perform any real DPI checks but it only
looks at the TCP/UDP ports.
Delete it, and use standard logic to classify these flows by port.
2022-07-03 20:28:58 +02:00
Ivan Nardi
50c0212df1
Update ASN/IPs lists (#1627) 2022-07-03 19:50:47 +02:00
Ivan Nardi
b5fb2066cb
bins: add support for 64bit bins (#1626) 2022-07-03 19:25:15 +02:00
Ivan Nardi
422d002542
Skinny: rework and improve classification (#1625) 2022-07-03 19:25:00 +02:00
Ivan Nardi
eed47acfc8
Skype_Teams, Mining, SnapchatCall: fix flow category (#1624) 2022-07-03 18:51:16 +02:00
Ivan Nardi
77ac58e553
Minor changes in how classification results are set (#1623)
Protocol classification should always be set via
`ndpi_set_detected_protocol()`: this way, the values in
`flow->detected_protocol_stack[]` are always coherent.
2022-07-03 18:45:24 +02:00
Ivan Nardi
060e894d5b
Usenet: improve dissection (#1622) 2022-07-03 18:08:04 +02:00
Ivan Nardi
fdb1649a49
Fix category for mail sessions (#1621)
Close #629
2022-07-03 17:47:58 +02:00
Ivan Nardi
5fe6087686
TLS: add support for old DTLS versions and for detection of mid-sessions (#1619) 2022-07-03 17:44:17 +02:00
Ivan Nardi
5f6fa6d164
Fix a compilation warning (#1620)
With clang-15 (nightly build)
```
In file included from ndpi_bitmap.c:39:
./third_party/src/roaring.cc:14233:13: warning: variable 'run_count' set but not used [-Wunused-but-set-variable]
        int run_count = 0;
```
2022-07-03 17:43:38 +02:00
Toni Uhlig
69ccb39741 Generate profiling results as PNG.
* use -ltcmalloc_and_profiler and try to get rid of LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libprofiler.so

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-03 17:38:43 +02:00
lns
f2d1edbedf gprof test/CI integration
Signed-off-by: lns <matzeton@googlemail.com>
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-03 17:38:43 +02:00
Toni
1a01e8dc68
Improved TFTP. Dissect Read/Write Request filenames. (#1617)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-03 14:37:05 +02:00
Toni
5ca82ad84b
Added TSAN support. (#1613)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-03 14:35:21 +02:00
Toni
59b00b00a7
Fix byte-order issue during ndpiReader tcp/udp src/dst port serialization. Fixes #1608. (#1614)
* fixed possible memory leak caused by an invalid call to `node_proto_guess_walker()` during serialization
 * execute serialization code while running regression tests

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-03 11:16:52 +02:00
Toni
7c5c811eb0
Added Cloudflare WARP detection patterns. (#1615) (#1616)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-02 14:57:56 +02:00
Luca Deri
008a1790e4 Fixed SMTP default port 587 2022-07-02 11:49:22 +02:00
Toni
bb72aa4767
Added TunnelBear VPN detection patterns. (#1615)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-07-01 13:19:17 +02:00
Luca Deri
8f6a006e36 Updated (C) 2022-06-30 14:53:47 +02:00
Luca Deri
6cf7838295 Removed space from "Genshin Impact" 2022-06-30 14:50:05 +02:00
Toni
c96f4512fa
sync unit tests (#1612)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2022-06-30 09:37:30 +02:00
Luca Deri
5f1caeb54e Fix after the protocol name update 2022-06-28 17:26:11 +02:00
Luca
d393fb969d Renamed Z39.50 -> Z3950 as the '.' breaks the naming convention
QUIC is a network protocol
2022-06-28 17:20:58 +02:00
Luca Deri
227ab5c105 Enhanced TLS risk info reported to users 2022-06-28 00:01:00 +02:00
Luca Deri
4296ec969a Added default port for syslog TCP 2022-06-27 18:36:56 +02:00
Ivan Nardi
b2b61011ae
Fix compilation and sync unit tests results (#1606) 2022-06-20 14:27:13 +02:00
Luca Deri
ab09b8ce2e Added unidirectional traffic flow risk 2022-06-20 00:22:13 +02:00
Toni
c287eb835b
Improved SOAP via HTTP. (#1605)
Signed-off-by: lns <matzeton@googlemail.com>
2022-06-18 17:19:16 +02:00
Toni
6cd8f8cc6d
Improved GenshinImpact protocol dissector. (#1604)
Signed-off-by: lns <matzeton@googlemail.com>
2022-06-18 15:11:59 +02:00
Toni
432de5eb57
Added collectd dissector (again). (#1601)
Signed-off-by: lns <matzeton@googlemail.com>
2022-06-17 19:56:33 +02:00
Toni
9c8b2d63da
Replaced nDPI's internal hashmap with uthash. (#1602)
Signed-off-by: lns <matzeton@googlemail.com>
2022-06-17 19:50:31 +02:00
Toni
20a29c393f
Improved IPSec/ISAKMP detection. (#1600)
Signed-off-by: lns <matzeton@googlemail.com>
2022-06-16 09:16:18 +02:00
Luca
c43360f8e6 Added new test pcaps 2022-06-15 18:57:46 +02:00
claudio_burrafato
c73a0988cd
Add some statistics to ndpiReader (#1587)
* Add some statistics to ndpiReader

The purpose of this version of ndpiReader is too adding some other statistics printed by ndpiReader. In this simple version the domain names(in the flows) that are collected are:
flow-> ssh_tls.server_info
flow-> host_server_name
and are placed in a UT_hash_table, ordering them by number of occurrences.

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update example/ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>

* Update ndpiReader.c

* Update ndpiReader.c

* Update ndpiReader.c

* Update ndpiReader.c

Co-authored-by: Toni <matzeton@googlemail.com>
2022-06-15 16:36:25 +02:00
Ivan Nardi
e2cc08bfe5
Add support for PIM (Protocol Indipendent Multicast) protocol (#1599)
Close #1598
2022-06-15 12:25:26 +02:00
Toni
d1773cc8e3
Improved WhatsApp detection. (#1595)
Signed-off-by: lns <matzeton@googlemail.com>
2022-06-14 20:06:48 +02:00
Ivan Nardi
bdf54d725b
Fix invalid memory access (#1596)
We can access `flow->protos` union only after checking the protocol.

Checking `flow->detected_protocol.master_protocol` is redundant because
we already check it in `is_ndpi_proto`

```
AddressSanitizer:DEADLYSIGNAL
=================================================================
==29739==ERROR: AddressSanitizer: SEGV on unknown address 0x000000353820 (pc 0x7f9b64dd2717 bp 0x7fff161a52f0 sp 0x7fff161a4aa8 T0)
==29739==The signal is caused by a READ memory access.
    #0 0x7f9b64dd2717  /build/glibc-SzIz7B/glibc-2.31/string/../sysdeps/x86_64/multiarch/strlen-avx2.S:96
    #1 0x555c65e597d8 in __interceptor_strlen (/home/ivan/svnrepos/nDPI/fuzz/fuzz_ndpi_reader_with_main+0x6407d8) (BuildId: 11ac8ec30f1d49fb0276c9b03368e491505d2bba)
    #2 0x555c65fd85fa in ndpi_strdup /home/ivan/svnrepos/nDPI/src/lib/ndpi_main.c:269:13
    #3 0x555c65f3e8c6 in process_ndpi_collected_info /home/ivan/svnrepos/nDPI/example/reader_util.c:1188:36
    #4 0x555c65f52cab in packet_processing /home/ivan/svnrepos/nDPI/example/reader_util.c:1567:2
    #5 0x555c65f4b632 in ndpi_workflow_process_packet /home/ivan/svnrepos/nDPI/example/reader_util.c:2110:10
    #6 0x555c65f04d29 in LLVMFuzzerTestOneInput /home/ivan/svnrepos/nDPI/fuzz/fuzz_ndpi_reader.c:109:7
    #7 0x555c65f054bb in main /home/ivan/svnrepos/nDPI/fuzz/fuzz_ndpi_reader.c:181:17
    #8 0x7f9b64c6e082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16
    #9 0x555c65e4253d in _start (/home/ivan/svnrepos/nDPI/fuzz/fuzz_ndpi_reader_with_main+0x62953d) (BuildId: 11ac8ec30f1d49fb0276c9b03368e491505d2bba)

```

Found by oss-fuzzer.
See: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48020
2022-06-14 11:44:32 +02:00
Ivan Nardi
8dcaa5c0e1
DNS: fix TTL check and sync unit test results (#1594) 2022-06-14 09:29:16 +02:00
Luca Deri
defe7d7f79 Updated DNS alert triggered only with TTL == 0 2022-06-14 00:13:05 +02:00
Luca Deri
831562c141 Restored ndpi_set_proto_defaults() prototype
Updated test results
2022-06-13 23:53:32 +02:00
Luca Deri
7a172ce11e Added check for DGA names that resolve to a valid record 2022-06-13 23:42:07 +02:00
Luca Deri
cf5873ffd7 Improved DNS traffic analysis
Added ability to identify application and network protocols
2022-06-13 23:19:47 +02:00
Luca Deri
32428026d6 Added DNS record TTL check 2022-06-13 17:05:56 +02:00
Toni
df0ff9bcbd
Added gprof CPU/HEAP profiling support. (#1592)
* Some small auto{conf,make} improvements

Signed-off-by: lns <matzeton@googlemail.com>
2022-06-12 21:00:41 +02:00
Toni
341f58fd80
Removed Makefile references to legacy code. (#1589)
- feature removed with f5545a80f9

Signed-off-by: lns <matzeton@googlemail.com>
2022-06-08 13:37:11 +02:00