Luca Deri
f3ea8ca6be
Improved ICMP malformed packet risk description
2024-07-25 12:54:59 +02:00
Ivan Nardi
85501c9aaa
FPC: add DPI information ( #2514 )
...
If the flow is classified (via DPI) after the first packet, we should
use this information as FPC
2024-07-23 08:50:27 +02:00
Vladimir Gavrilov
b15337a32b
Add OpenWire support ( #2513 )
2024-07-22 19:20:44 +02:00
Ivan Nardi
65e31b0ea3
FPC: small improvements ( #2512 )
...
Add printing of fpc_dns statistics and add a general cconfiguration option.
Rework the code to be more generic and ready to handle other logics.
2024-07-22 17:42:23 +02:00
mmanoj
67f5cdafc0
FPC: add DNS correlation ( #2497 )
...
Use DNS information to get a better First Packet Classification.
See: #2322
---------
Co-authored-by: Nardi Ivan <nardi.ivan@gmail.com>
2024-07-22 11:34:07 +02:00
Vladimir Gavrilov
6a77a891a8
Add Nano (XNO) protocol support ( #2508 )
2024-07-18 16:18:12 +02:00
Luca
86b67e6687
Added ClickHouse protocol
2024-07-17 14:21:45 +02:00
Vladimir Gavrilov
c3fff52646
Add HLS support ( #2502 )
2024-07-16 12:01:28 +02:00
Ivan Nardi
c3ba65311e
fuzzing: improve coverage ( #2495 )
...
Fix detection of WebDAV and Gnutella (over HTTP)
Fix detection of z3950
Add two fuzzers to test `ndpi_memmem()` and `ndpi_strnstr()`
Remove some dead code:
* RTP: the same exact check is performed at the very beginning of the
function
* MQTT: use a better helper to exclude the protocol
* Colletd: `ndpi_hostname_sni_set()` never fails
Update pl7m code (fix a Use-of-uninitialized-value error)
2024-07-12 14:22:25 +02:00
Ivan Nardi
456f0fd427
Improve detection of Cloudflare WARP traffic ( #2491 )
...
See: #2484
2024-07-04 08:59:04 +02:00
Ivan Nardi
843e487270
Add infrastructure for explicit support of Fist Packet Classification ( #2488 )
...
Let's start with some basic helpers and with FPC based on flow addresses.
See: #2322
2024-07-03 18:02:07 +02:00
Ivan Nardi
1e411e98fa
Reduce snaplen of some traces ( #2490 )
...
To avoid the following error with some old libpcap versions:
```
ERROR: could not open pcap file: invalid file capture length 524288, bigger than maximum of 262144
```
2024-07-03 16:17:08 +02:00
Ivan Nardi
fc334d56c4
tunnelbear: improve detection over wireguard ( #2485 )
...
See #2484
2024-07-01 08:20:18 +02:00
Ivan Nardi
4f05d21441
Improve detection of Twitter/X ( #2482 )
2024-07-01 08:20:04 +02:00
Ivan Nardi
26cc1f131f
fuzz: improve fuzzing coverage ( #2474 )
...
Remove some code never triggered
AFP: the removed check is included in the following one
MQTT: fix flags extraction
2024-06-17 13:45:47 +02:00
Nardi Ivan
a35fae6b75
Sync unit tests results
2024-06-17 11:23:39 +02:00
Toni
8fd649ab1e
Add Ripe Atlas probe protocol. ( #2473 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-06-17 11:00:38 +02:00
Nardi Ivan
bbe52da5cf
Zoom: harden RTP/RTCP detection
2024-06-17 10:19:55 +02:00
Nardi Ivan
526cf6f291
Zoom: remove "stun_zoom" LRU cache
...
Since 070a0908b
2024-06-17 10:19:55 +02:00
Mark Jeffery
f796c94375
Added protocol - JRMI - Java Remote Method Invocation ( #2470 )
2024-06-15 10:52:28 +02:00
Luca
7c7c375b45
Improved detection of Android connectiity checks
2024-06-12 10:55:07 +02:00
Ivan Nardi
070a0908b3
Zoom: faster detection of P2P flows ( #2467 )
2024-06-07 09:50:41 +02:00
Ivan Nardi
619005c5b2
STUN: add support for Microsoft Multiplexed TURN channels ( #2464 )
2024-06-05 16:55:58 +02:00
Ivan Nardi
7be482f5b1
Update unit tests results ( #2466 )
2024-06-05 11:55:30 +02:00
Ivan Nardi
81e42b748e
RTP: fix detection over TCP ( #2462 )
...
RFC4571 is not the only way to wrap RTP messages in TCP streams.
For example, when RTP is encapsulated over TURN flows (i.e. via DATA
attribute) there is no additional framing.
See also 6127e0490
2024-05-29 18:31:10 +02:00
Maatuq
6127e04900
support rtp/rtcp over tcp ( #2422 ) ( #2457 )
...
Support rtp/rtcp over tcp as per rfc4571.
Signed-off-by: mmaatuq <mahmoudmatook.mm@gmail.com>
2024-05-28 22:01:08 +02:00
Toni
80171dbcf3
Add ZUG consensus protocol dissector. ( #2458 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-05-28 20:29:48 +02:00
Ivan Nardi
25f8964a23
CiscoVPN: we detect it only over UDP ( #2454 )
...
The original code handled also TCP/TLS, but it was removed in 6fc29b3ae
2024-05-28 14:07:48 +02:00
Toni
abce6d4023
Improved Kafka dissector. ( #2456 )
...
* detect more Kafka request packet's
* requires less flow memory
* same detection behavior as before e.g. no asym detection implemented
(can be done by dissecting responses, requires more effort)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Co-authored-by: Nardi Ivan <nardi.ivan@gmail.com>
2024-05-27 09:46:32 +02:00
Vladimir Gavrilov
d1a59c0308
Rename Messenger to FacebookMessenger ( #2453 )
2024-05-23 09:23:31 +02:00
Nardi Ivan
521ce609c8
Sync unit tests results
2024-05-22 19:00:33 +02:00
Luca
44a290286b
More NDPI_PROBING_ATTEMPT changes
2024-05-22 18:04:33 +02:00
Luca
74d3843ebe
Added NDPI_PROBING_ATTEMPT risk
2024-05-22 17:55:16 +02:00
Ivan Nardi
fd02baa13a
DTLS: fix JA4 fingerprint ( #2446 )
2024-05-21 18:13:25 +02:00
Ivan Nardi
83840f1bb9
DTLS: add support for DTLS 1.3 ( #2445 )
2024-05-21 12:49:27 +02:00
Ivan Nardi
0109014f2c
Follow-up of 2093ac5bf ( #2451 )
2024-05-21 12:47:25 +02:00
Luca Deri
2093ac5bf6
Minor dissector optimizations
2024-05-20 12:17:04 +02:00
Vladimir Gavrilov
3d1da00d8d
Add Call of Duty Mobile support ( #2438 )
2024-05-15 12:46:02 +02:00
Ivan Nardi
0110623b4e
H323: improve detection and avoid false positives ( #2432 )
2024-05-11 23:39:54 +02:00
Vladimir Gavrilov
2d33431948
Add Ethernet Global Data support ( #2437 )
2024-05-11 16:49:16 +02:00
Vladimir Gavrilov
70c4920184
Remove Vevo support ( #2436 )
...
Co-authored-by: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
2024-05-11 11:57:53 +02:00
Ivan Nardi
b116456fc5
Viber: add detection of voip calls and avoid false positives ( #2434 )
2024-05-11 09:21:13 +02:00
Ivan Nardi
4b4b358562
Line: use common helper to detect RTP/RTCP packets ( #2429 )
...
Add an explicit upper limit on the number of packets processed before
giving up.
2024-05-10 19:23:50 +02:00
Ivan Nardi
d4650f0f81
Raknet/RTP: avoid Raknet false positives and harden RTP heuristic ( #2427 )
...
There is some overlap between RTP and Raknet detection: give precedence
to RTP logic.
Consequences:
* Raknet might require a little bit more packets for some flows (not a
big issue)
* some very small (1-2 pkts) Raknet flows are not classified (not sure
what do do about that..)
2024-05-09 21:18:18 +02:00
Ivan Nardi
2e7fc82e55
Protobuf: fix false positives ( #2428 )
2024-05-09 15:38:06 +02:00
Toni
18e03a26ca
Add extra entropy checks and more precise(?) analysis. ( #2383 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-05-09 15:24:11 +02:00
Ivan Nardi
1773d7ff2d
Add support for Mastodon, Bluesky and (FB-)Threads ( #2418 )
2024-05-06 13:37:18 +02:00
Ivan Nardi
95fe21015d
Remove "zoom" cache ( #2420 )
...
This cache was added in b6b4967aa63f349319
2024-05-06 12:51:45 +02:00
Ivan Nardi
b7d77972bc
Remove workaround for TCP flows with multiple SYNs ( #2421 )
...
Deciding when a session starts and ends is responsability of the
applicationi (via its flow manager)i, not of the library.
BTW, the removed code is incomplete at beast
2024-05-06 10:20:40 +02:00
Ivan Nardi
e31ef00715
TLS: avoid setting NDPI_TLS_SELFSIGNED_CERTIFICATE for webrtc traffic ( #2417 )
...
See RFC8122: it is quite likely that STUN/DTLS/SRTP flows use
self-signed certificates
Follow-up of b287d6ec8
2024-05-06 10:20:07 +02:00
