Commit graph

8 commits

Author SHA1 Message Date
Toni
246462592e
Add additional msgpack protocol validations (Fix #3060, false-positives) (#3061)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2025-12-11 14:18:00 +01:00
Ivan Nardi
79f0cbd32a
Whois/DAS: avoid false positives (#2925)
Close #2922
2025-07-30 20:11:07 +02:00
Ivan Nardi
0fe81c842f
TLS: avoid sub-classification for RDP flows (#2769)
These flows are already classified as TLS.RDP.
This change also fix a memory leak

```
Direct leak of 62 byte(s) in 1 object(s) allocated from:
   #0 0x5883d762429f in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
   #1 0x5883d76fe46a in ndpi_malloc ndpi/src/lib/ndpi_memory.c:57:46
   #2 0x5883d76fe46a in ndpi_strdup ndpi/src/lib/ndpi_memory.c:110:13
   #3 0x5883d77adcd6 in ndpi_compute_ja4 ndpi/src/lib/protocols/tls.c:2298:46
   #4 0x5883d77ab2ec in processClientServerHello ndpi/src/lib/protocols/tls.c:3314:10
   #5 0x5883d77a4c51 in processTLSBlock ndpi/src/lib/protocols/tls.c:1319:5
```
Found by oss-fuzz.
See: https://oss-fuzz.com/testcase-detail/5244512192757760
2025-03-14 15:13:29 +01:00
Ivan Nardi
69c89f9061
TLS: heuristics: fix memory allocations (#2577)
Allocate heuristics state only if really needed.
Fix memory leak (it happened with WebSocket traffic on port 443)
2024-09-30 16:55:07 +02:00
Nardi Ivan
5d8edccef8 Bittorrent: improve detection of UTPv1 and avoid false positives 2024-09-03 12:39:07 +02:00
Ivan Nardi
b116456fc5
Viber: add detection of voip calls and avoid false positives (#2434) 2024-05-11 09:21:13 +02:00
Ivan Nardi
d4650f0f81
Raknet/RTP: avoid Raknet false positives and harden RTP heuristic (#2427)
There is some overlap between RTP and Raknet detection: give precedence
to RTP logic.
Consequences:
* Raknet might require a little bit more packets for some flows (not a
big issue)
* some very small (1-2 pkts) Raknet flows are not classified (not sure
what do do about that..)
2024-05-09 21:18:18 +02:00
Ivan Nardi
2e7fc82e55
Protobuf: fix false positives (#2428) 2024-05-09 15:38:06 +02:00