Commit graph

39 commits

Author SHA1 Message Date
Ivan Nardi
91fd1bccd2
Rework the old MapleStory code to identify traffic from generic Nexon games (#2773)
Remove `NDPI_PROTOCOL_MAPLESTORY` and add a generic
`NDPI_PROTOCOL_NEXON`
2025-03-19 17:58:42 +01:00
Ivan Nardi
0fe81c842f
TLS: avoid sub-classification for RDP flows (#2769)
These flows are already classified as TLS.RDP.
This change also fix a memory leak

```
Direct leak of 62 byte(s) in 1 object(s) allocated from:
   #0 0x5883d762429f in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
   #1 0x5883d76fe46a in ndpi_malloc ndpi/src/lib/ndpi_memory.c:57:46
   #2 0x5883d76fe46a in ndpi_strdup ndpi/src/lib/ndpi_memory.c:110:13
   #3 0x5883d77adcd6 in ndpi_compute_ja4 ndpi/src/lib/protocols/tls.c:2298:46
   #4 0x5883d77ab2ec in processClientServerHello ndpi/src/lib/protocols/tls.c:3314:10
   #5 0x5883d77a4c51 in processTLSBlock ndpi/src/lib/protocols/tls.c:1319:5
```
Found by oss-fuzz.
See: https://oss-fuzz.com/testcase-detail/5244512192757760
2025-03-14 15:13:29 +01:00
Ivan Nardi
b02e85f7ee
Merge pull request #2760 from IvanNardi/internal_giveup
Add a new internal function `internal_giveup()`
2025-03-11 11:20:34 +01:00
Toni
6a591b67aa
Add GearUP Booster protocol dissector (heuristic based). (#2765)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2025-03-07 20:05:44 +01:00
Ivan Nardi
34dcf18128 Add a new internal function internal_giveup()
This function is always called once for every flow, as last code
processing the flow itself.

As a first usage example, check here if the flow is unidirectional
(instead of checking it at every packets)
2025-03-05 20:51:06 +01:00
Ivan Nardi
85fb7eb2e5 Flow risk infos are always exported "in order" (by flow risk id)
This way, the `ndpiReader` output doesn't change if we change the
internal logic about the order we set/check the various flow risks.

Note that the flow risk *list* is already printed by `ndpiReader`
in order.
2025-03-04 13:23:58 +01:00
Toni
5858e1debf
Add LagoFast protocol dissector. (#2743)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2025-02-23 13:13:38 +01:00
Ivan Nardi
2d3f08362e
RTP: payload type info should be set only for real RTP flows (#2742) 2025-02-22 13:35:40 +01:00
Luca Deri
30c3613f2f Improved RTP dissection with EVS and other mobile voice codecs 2025-02-20 22:59:23 +01:00
Luca Deri
9ee24d5bc1 Updated test rsults after RTP payload extraction 2025-02-19 11:40:00 +01:00
Ivan Nardi
3dbc6d2523
DNS: faster exclusion (#2719) 2025-02-12 17:42:00 +01:00
Luca Deri
511228d36d Added DigitalOcean protocol 2025-01-17 18:26:27 +01:00
Ivan Nardi
5c0143ce58
HTTP: fix entropy calculation (#2666)
We calculate HTTP entropy according to "Content-type:" header, see
`ndpi_validate_http_content()` on HTTP code
2025-01-12 12:49:32 +01:00
Toni
9a0a3bb8e7
Improved WebSocket-over-HTTP detection (#2664)
* detect `chisel` SSH-over-HTTP-WebSocket
 * use `strncasecmp()` for `LINE_*` matching macros

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2025-01-11 11:23:42 +01:00
Ivan Nardi
c5bd9d8bff
RTP, STUN: improve detection of multimedia flow type (#2620)
Let's see if we are able to tell audio from video calls only looking at
RTP Payload Type field...
2024-11-19 16:38:14 +01:00
Luca Deri
3ce8d0e508
Implemented Mikrotik discovery protocol dissection and metadata extraction (#2618) 2024-11-14 23:34:31 +01:00
Luca Deri
d5236c0aaf Fixes TCP fingerprint calculation when multiple EOL are specified in TCP options 2024-10-27 08:17:27 +01:00
Luca Deri
14b076a58b Improved TCP fingerprint 2024-10-20 22:25:55 +02:00
Luca Deri
0cc84e4fdd Improved TCP fingepring calculation
Adde basidc OS detection based on TCP fingerprint
2024-10-18 23:47:34 +02:00
Luca Deri
0ef0752c80
Increased struct ndpi_flow_struct size (#2596)
Build fix
2024-10-18 07:17:03 +02:00
Luca Deri
ec5efe5cf2 Added sonos dissector 2024-10-13 18:50:34 +02:00
Ivan Nardi
69c89f9061
TLS: heuristics: fix memory allocations (#2577)
Allocate heuristics state only if really needed.
Fix memory leak (it happened with WebSocket traffic on port 443)
2024-09-30 16:55:07 +02:00
Nardi Ivan
5d8edccef8 Bittorrent: improve detection of UTPv1 and avoid false positives 2024-09-03 12:39:07 +02:00
Vladimir Gavrilov
64a5dc3cb3
Add TRDP protocol support (#2528)
The Train Real Time Data Protocol (TRDP) is a UDP/TCP-based communication protocol designed for IP networks in trains, enabling data exchange between devices such as door controls and air conditioning systems. It is standardized by the IEC under IEC 61375-2-3 and is not related to the Remote Desktop Protocol (RDP).
2024-08-25 13:31:39 +02:00
Vladimir Gavrilov
a10c48c80a
Add CNP/IP protocol support (#2521)
ISO/IEC 14908-4 defines how to tunnel Control Network Protocol (CNP) over IP networks. It encapsulates protocols like EIA-709, EIA-600, and CNP, making it a versatile solution for building automation and control systems.
2024-08-22 15:26:32 +02:00
Ivan Nardi
65e31b0ea3
FPC: small improvements (#2512)
Add printing of fpc_dns statistics and add a general cconfiguration option.
Rework the code to be more generic and ready to handle other logics.
2024-07-22 17:42:23 +02:00
Ivan Nardi
456f0fd427
Improve detection of Cloudflare WARP traffic (#2491)
See: #2484
2024-07-04 08:59:04 +02:00
Ivan Nardi
843e487270
Add infrastructure for explicit support of Fist Packet Classification (#2488)
Let's start with some basic helpers and with FPC based on flow addresses.

See: #2322
2024-07-03 18:02:07 +02:00
Toni
8fd649ab1e
Add Ripe Atlas probe protocol. (#2473)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-06-17 11:00:38 +02:00
Nardi Ivan
526cf6f291 Zoom: remove "stun_zoom" LRU cache
Since 070a0908b we are able to detect P2P calls directly from the packet
content, without any correlation among flows
2024-06-17 10:19:55 +02:00
Toni
80171dbcf3
Add ZUG consensus protocol dissector. (#2458)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-05-28 20:29:48 +02:00
Ivan Nardi
0109014f2c
Follow-up of 2093ac5bf (#2451) 2024-05-21 12:47:25 +02:00
Luca Deri
2093ac5bf6 Minor dissector optimizations 2024-05-20 12:17:04 +02:00
Vladimir Gavrilov
3d1da00d8d
Add Call of Duty Mobile support (#2438) 2024-05-15 12:46:02 +02:00
Ivan Nardi
0110623b4e
H323: improve detection and avoid false positives (#2432) 2024-05-11 23:39:54 +02:00
Vladimir Gavrilov
2d33431948
Add Ethernet Global Data support (#2437) 2024-05-11 16:49:16 +02:00
Ivan Nardi
b116456fc5
Viber: add detection of voip calls and avoid false positives (#2434) 2024-05-11 09:21:13 +02:00
Ivan Nardi
d4650f0f81
Raknet/RTP: avoid Raknet false positives and harden RTP heuristic (#2427)
There is some overlap between RTP and Raknet detection: give precedence
to RTP logic.
Consequences:
* Raknet might require a little bit more packets for some flows (not a
big issue)
* some very small (1-2 pkts) Raknet flows are not classified (not sure
what do do about that..)
2024-05-09 21:18:18 +02:00
Ivan Nardi
2e7fc82e55
Protobuf: fix false positives (#2428) 2024-05-09 15:38:06 +02:00