From f9bd7d29ced8e596aeaab2258bc7f56f14521a2e Mon Sep 17 00:00:00 2001 From: Toni Uhlig Date: Tue, 6 Sep 2022 14:50:46 +0200 Subject: [PATCH] Bump libnDPI to 37f918322c0a489b5143a987c8f1a44a6f78a6f3 and updated flow json schema file. * export env vars AR / CMAKE_C_COMPILER_AR and RANLIB / CMAKE_C_COMPILER_RANLIB while building libnDPI * nDPId check API version during startup (macro vs. function call) and print a warning if they are different Signed-off-by: Toni Uhlig --- CMakeLists.txt | 2 + libnDPI | 2 +- nDPId-test.c | 7 + nDPId.c | 19 +- schema/flow_event_schema.json | 201 +- scripts/get-and-build-libndpi.sh | 7 +- test/results/1kxun.pcap.out | 782 ++-- test/results/443-chrome.pcap.out | 8 +- test/results/443-curl.pcap.out | 18 +- test/results/443-firefox.pcap.out | 18 +- test/results/443-git.pcap.out | 18 +- test/results/443-opvn.pcap.out | 14 +- test/results/443-safari.pcap.out | 18 +- test/results/4in4tunnel.pcap.out | 6 +- test/results/4in6tunnel.pcap.out | 12 +- test/results/6in4tunnel.pcap.out | 14 +- test/results/6in6tunnel.pcap.out | 14 +- test/results/BGP_Cisco_hdlc_slarp.pcap.out | 14 +- test/results/BGP_redist.pcap.out | 14 +- test/results/EAQ.pcap.out | 134 +- .../FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out | 26 +- test/results/IEC104.pcap.out | 18 +- test/results/KakaoTalk_chat.pcap.out | 213 +- test/results/KakaoTalk_talk.pcap.out | 81 +- test/results/NTPv2.pcap.out | 10 +- test/results/NTPv3.pcap.out | 14 +- test/results/NTPv4.pcap.out | 14 +- test/results/Oscar.pcap.out | 16 +- test/results/TivoDVR.pcap.out | 23 + test/results/WebattackRCE.pcap.out | 1604 +++---- test/results/WebattackSQLinj.pcap.out | 46 +- test/results/WebattackXSS.pcap.out | 1376 +++--- test/results/activision.pcap.out | 44 + test/results/afp.pcap.out | 14 +- test/results/agora-sd-rtn.pcap.out | 116 +- test/results/ah.pcapng.out | 14 +- test/results/aimini-http.pcap.out | 26 +- test/results/ajp.pcap.out | 14 +- test/results/alexa-app.pcapng.out | 920 ++-- test/results/alicloud.pcap.out | 120 + test/results/among_us.pcap.out | 14 +- test/results/amqp.pcap.out | 18 +- test/results/android.pcap.out | 334 +- test/results/anyconnect-vpn.pcap.out | 330 +- test/results/anydesk-2.pcap.out | 34 +- test/results/anydesk.pcap.out | 25 +- test/results/avast.pcap.out | 96 + test/results/avast_securedns.pcapng.out | 166 +- test/results/bad-dns-traffic.pcap.out | 38 +- test/results/badpackets.pcap.out | 6 +- test/results/bitcoin.pcap.out | 30 +- test/results/bittorrent.pcap.out | 102 +- test/results/bittorrent_utp.pcap.out | 14 +- test/results/bjnp.pcap.out | 50 +- test/results/bot.pcap.out | 14 +- test/results/bt_search.pcap.out | 12 +- test/results/cachefly.pcapng.out | 18 +- test/results/capwap.pcap.out | 28 +- test/results/cassandra.pcap.out | 18 +- test/results/check_mk_new.pcap.out | 14 +- test/results/chrome.pcap.out | 53 +- test/results/citrix.pcap.out | 14 +- test/results/cloudflare-warp.pcap.out | 40 +- test/results/coap_mqtt.pcap.out | 74 +- test/results/collectd.pcap.out | 44 +- test/results/corba.pcap.out | 22 +- test/results/cpha.pcap.out | 14 +- test/results/dazn.pcapng.out | 24 +- test/results/dcerpc.pcap.out | 22 +- test/results/dhcp-fuzz.pcapng.out | 12 +- test/results/diameter.pcap.out | 10 +- test/results/discord.pcap.out | 231 +- test/results/dlt_ppp.pcap.out | 6 +- test/results/dnp3.pcap.out | 42 +- test/results/dns-invalid-chars.pcap.out | 16 +- test/results/dns-tunnel-iodine.pcap.out | 16 +- test/results/dns_ambiguous_names.pcap.out | 70 +- test/results/dns_doh.pcap.out | 16 +- test/results/dns_dot.pcap.out | 16 +- test/results/dns_exfiltration.pcap.out | 16 +- test/results/dns_fragmented.pcap.out | 130 +- test/results/dns_invert_query.pcapng.out | 12 +- test/results/dns_long_domainname.pcap.out | 16 +- .../dnscrypt-v1-and-resolver-pings.pcap.out | 998 ++-- test/results/dnscrypt-v2-doh.pcap.out | 214 +- test/results/dnscrypt-v2.pcap.out | 18 +- .../dnscrypt_skype_false_positive.pcapng.out | 14 +- test/results/doq.pcapng.out | 14 +- test/results/doq_adguard.pcapng.out | 10 +- test/results/dos_win98_smb_netbeui.pcap.out | 22 +- test/results/drda_db2.pcap.out | 14 +- test/results/dropbox.pcap.out | 86 +- test/results/dtls.pcap.out | 12 +- test/results/dtls2.pcap.out | 18 +- test/results/dtls_certificate.pcapng.out | 10 +- .../dtls_certificate_fragments.pcap.out | 16 +- test/results/dtls_mid_sessions.pcapng.out | 22 +- test/results/dtls_old_version.pcapng.out | 16 +- .../dtls_session_id_and_coockie_both.pcap.out | 16 +- test/results/emotet.pcap.out | 45 +- test/results/encrypted_sni.pcap.out | 12 +- test/results/esp.pcapng.out | 14 +- test/results/ethereum.pcap.out | 296 +- test/results/ethernetIP.pcap.out | 22 +- test/results/exe_download.pcap.out | 16 +- test/results/exe_download_as_png.pcap.out | 16 +- test/results/facebook.pcap.out | 24 +- test/results/fastcgi.pcap.out | 24 + test/results/firefox.pcap.out | 52 +- test/results/fix.pcap.out | 58 +- test/results/fix2.pcap.out | 18 +- test/results/forticlient.pcap.out | 50 +- test/results/ftp-start-tls.pcap.out | 20 +- test/results/ftp.pcap.out | 22 +- test/results/ftp_failed.pcap.out | 14 +- test/results/fuzz-2006-06-26-2594.pcap.out | 902 ++-- test/results/fuzz-2006-09-29-28586.pcap.out | 100 +- test/results/fuzz-2020-02-16-11740.pcap.out | 302 +- .../fuzz-2021-06-07-c6c72a0a56.pcap.out | 6 +- test/results/fuzz-2021-10-13.pcap.out | 6 +- test/results/genshin-impact.pcap.out | 34 +- test/results/git.pcap.out | 14 +- test/results/gnutella.pcap.out | 2134 ++++----- test/results/google_ssl.pcap.out | 12 +- test/results/googledns_android10.pcap.out | 56 +- test/results/gquic.pcap.out | 10 +- test/results/gre_no_options.pcapng.out | 14 +- test/results/gtp_c.pcap.out | 14 +- test/results/gtp_false_positive.pcapng.out | 12 +- test/results/gtp_prime.pcapng.out | 6 +- test/results/h323-overflow.pcap.out | 12 +- test/results/h323.pcap.out | 18 +- test/results/hangout.pcap.out | 14 +- test/results/hpvirtgrp.pcap.out | 46 +- test/results/hsrp0.pcap.out | 26 +- test/results/hsrp2.pcap.out | 18 +- test/results/hsrp2_ipv6.pcapng.out | 18 +- .../http-crash-content-disposition.pcap.out | 14 +- test/results/http-lines-split.pcap.out | 14 +- test/results/http-manipulated.pcap.out | 18 +- test/results/http-proxy.pcapng.out | 24 + test/results/http_auth.pcap.out | 14 +- test/results/http_connect.pcap.out | 26 +- test/results/http_ipv6.pcap.out | 72 +- test/results/http_on_sip_port.pcap.out | 24 + test/results/i3d.pcap.out | 22 +- test/results/iax.pcap.out | 14 +- test/results/icmp-tunnel.pcap.out | 30 +- test/results/iec60780-5-104.pcap.out | 34 +- test/results/imap-starttls.pcap.out | 20 +- test/results/imap.pcap.out | 14 +- test/results/imaps.pcap.out | 36 +- test/results/imo.pcap.out | 14 +- test/results/instagram.pcap.out | 182 +- test/results/ip_fragmented_garbage.pcap.out | 68 +- test/results/iphone.pcap.out | 291 +- test/results/ipp.pcap.out | 22 +- test/results/ipsec_isakmp_esp.pcap.out | 174 +- test/results/ipv6_in_gtp.pcap.out | 6 +- test/results/irc.pcap.out | 14 +- .../ja3_lots_of_cipher_suites.pcap.out | 6 +- .../ja3_lots_of_cipher_suites_2_anon.pcap.out | 10 +- test/results/jabber.pcap.out | 54 +- test/results/kerberos-error.pcap.out | 14 +- test/results/kerberos-login.pcap.out | 60 +- test/results/kerberos.pcap.out | 98 +- test/results/kerberos_fuzz.pcapng.out | 12 +- test/results/kismet.pcap.out | 24 + test/results/kontiki.pcap.out | 34 +- test/results/lisp_registration.pcap.out | 26 +- test/results/log4j-webapp-exploit.pcap.out | 40 +- test/results/long_tls_certificate.pcap.out | 21 +- test/results/malformed_dns.pcap.out | 14 +- test/results/malformed_icmp.pcap.out | 14 +- test/results/malware.pcap.out | 32 +- test/results/memcached.cap.out | 14 +- test/results/mgcp.pcapng.out | 43 +- test/results/modbus.pcap.out | 14 +- test/results/monero.pcap.out | 18 +- test/results/mongo_false_positive.pcapng.out | 8 +- test/results/mongodb.pcap.out | 30 +- test/results/mpeg-dash.pcap.out | 25 +- test/results/mpeg.pcap.out | 16 +- test/results/mpegts.pcap.out | 10 +- test/results/mqtt.pcap.out | 14 +- test/results/mssql_tds.pcap.out | 52 +- test/results/mysql-8.pcap.out | 14 +- test/results/nats.pcap.out | 18 +- ...match_string_subprotocol__error.pcapng.out | 10 +- test/results/nest_log_sink.pcap.out | 88 +- test/results/netbios.pcap.out | 68 +- .../netbios_wildcard_dns_query.pcap.out | 12 +- test/results/netflix.pcap.out | 367 +- test/results/netflow-fritz.pcap.out | 14 +- test/results/netflowv9.pcap.out | 10 +- test/results/nfsv2.pcap.out | 38 +- test/results/nfsv3.pcap.out | 42 +- test/results/nintendo.pcap.out | 103 +- test/results/nntp.pcap.out | 14 +- test/results/no_sni.pcap.out | 54 +- test/results/ocs.pcap.out | 60 +- test/results/ocsp.pcapng.out | 50 +- test/results/ookla.pcap.out | 18 +- test/results/openvpn.pcap.out | 22 +- test/results/oracle12.pcapng.out | 12 +- test/results/os_detected.pcapng.out | 10 +- test/results/ospfv2_add_new_prefix.pcap.out | 14 +- test/results/pgm.pcap.out | 14 +- test/results/pgsql.pcap.out | 18 +- test/results/pim.pcap.out | 14 +- test/results/pinterest.pcap.out | 196 +- test/results/pluralsight.pcap.out | 54 +- test/results/pop3.pcap.out | 14 +- test/results/pop3_stls.pcap.out | 28 + test/results/pops.pcapng.out | 17 +- test/results/pps.pcap.out | 362 +- test/results/pptp.pcap.out | 14 +- test/results/psiphon3.pcap.out | 21 +- test/results/punycode-idn.pcap.out | 24 +- test/results/quic-23.pcap.out | 10 +- test/results/quic-24.pcap.out | 10 +- test/results/quic-27.pcap.out | 10 +- test/results/quic-28.pcap.out | 10 +- test/results/quic-29.pcap.out | 10 +- test/results/quic-33.pcapng.out | 10 +- test/results/quic-34.pcap.out | 10 +- test/results/quic-fuzz-overflow.pcapng.out | 10 +- test/results/quic-mvfst-22.pcap.out | 10 +- .../quic-mvfst-22_decryption_error.pcap.out | 10 +- test/results/quic-mvfst-27.pcapng.out | 10 +- test/results/quic-mvfst-exp.pcap.out | 10 +- test/results/quic-v2-01.pcapng.out | 10 +- test/results/quic.pcap.out | 44 +- test/results/quic046.pcap.out | 10 +- test/results/quic_0RTT.pcap.out | 29 +- .../quic_crypto_aes_auth_size.pcap.out | 14 +- ...ic_frags_ch_in_multiple_packets.pcapng.out | 12 +- ..._of_order_same_packet_craziness.pcapng.out | 458 +- test/results/quic_interop_V.pcapng.out | 314 +- test/results/quic_q39.pcap.out | 10 +- test/results/quic_q43.pcap.out | 10 +- test/results/quic_q46.pcap.out | 10 +- test/results/quic_q46_b.pcap.out | 10 +- test/results/quic_q50.pcap.out | 10 +- test/results/quic_t50.pcap.out | 10 +- test/results/quic_t51.pcap.out | 10 +- test/results/quickplay.pcap.out | 74 +- test/results/radius_false_positive.pcapng.out | 8 +- test/results/raknet.pcap.out | 54 +- test/results/rdp.pcap.out | 14 +- test/results/reasm_crash_anon.pcapng.out | 14 +- test/results/reasm_segv_anon.pcapng.out | 14 +- test/results/reddit.pcap.out | 428 +- test/results/riotgames.pcap.out | 46 +- .../rsh-syslog-false-positive.pcap.out | 10 +- test/results/rsh.pcap.out | 18 +- test/results/rsync.pcap.out | 14 +- test/results/rtmp.pcap.out | 14 +- test/results/rtsp.pcap.out | 38 +- test/results/rtsp_setup_http.pcapng.out | 14 +- test/results/rx.pcap.out | 26 +- test/results/s7comm.pcap.out | 14 +- test/results/safari.pcap.out | 59 +- test/results/salesforce.pcap.out | 18 +- test/results/sccp_hw_conf_register.pcapng.out | 14 +- test/results/sctp.cap.out | 18 +- test/results/selfsigned.pcap.out | 16 +- test/results/sflow.pcap.out | 14 +- test/results/signal.pcap.out | 135 +- test/results/simple-dnscrypt.pcap.out | 46 +- test/results/sip.pcap.out | 36 +- test/results/sip_hello.pcapng.out | 18 +- test/results/sites.pcapng.out | 307 +- test/results/skinny.pcap.out | 46 +- test/results/skype-conference-call.pcap.out | 14 +- test/results/skype.pcap.out | 1008 ++--- test/results/skype_no_unknown.pcap.out | 948 ++-- test/results/skype_udp.pcap.out | 14 +- test/results/smb_deletefile.pcap.out | 10 +- test/results/smb_frags.pcap.out | 14 +- test/results/smbv1.pcap.out | 14 +- test/results/smpp_in_general.pcap.out | 14 +- test/results/smtp-starttls.pcap.out | 38 +- test/results/smtp.pcap.out | 14 +- test/results/smtps.pcapng.out | 15 +- test/results/snapchat.pcap.out | 28 +- test/results/snapchat_call.pcapng.out | 12 +- test/results/snmp.pcap.out | 80 +- test/results/soap.pcap.out | 26 +- test/results/socks-http-example.pcap.out | 20 +- test/results/softether-http.pcap.out | 24 - test/results/softether.pcap.out | 79 + test/results/someip-tp.pcap.out | 10 +- .../results/someip-udp-method-call.pcapng.out | 18 +- test/results/someip_sd_sample.pcap.out | 6 +- test/results/sql_injection.pcap.out | 10 +- test/results/ssdp-m-search-ua.pcap.out | 14 +- test/results/ssdp-m-search.pcap.out | 14 +- test/results/ssh.pcap.out | 22 +- test/results/ssl-cert-name-mismatch.pcap.out | 18 +- test/results/starcraft_battle.pcap.out | 210 +- test/results/steam.pcap.out | 230 +- .../steam_datagram_relay_ping.pcapng.out | 10 +- test/results/stun_dtls.pcapng.out | 24 + test/results/stun_facebook.pcapng.out | 14 +- test/results/stun_signal.pcapng.out | 100 +- test/results/synscan.pcap.out | 4000 ++++++++--------- test/results/syslog.pcap.out | 82 +- .../targusdataspeed_false_positives.pcap.out | 14 +- test/results/teams.pcap.out | 453 +- test/results/teamspeak3.pcap.out | 14 +- test/results/teamviewer.pcap.out | 18 +- test/results/telegram.pcap.out | 216 +- test/results/telnet.pcap.out | 20 +- test/results/teredo.pcap.out | 30 +- test/results/tftp.pcap.out | 34 +- test/results/threema.pcap.out | 30 +- test/results/tinc.pcap.out | 22 +- test/results/tk.pcap.out | 28 +- test/results/tls-appdata.pcap.out | 14 +- test/results/tls-esni-fuzzed.pcap.out | 12 +- test/results/tls-rdn-extract.pcap.out | 18 +- test/results/tls_2_reasms.pcapng.out | 25 + test/results/tls_2_reasms_b.pcapng.out | 25 + test/results/tls_alert.pcap.out | 16 +- .../results/tls_certificate_too_long.pcap.out | 188 +- test/results/tls_cipher_lens.pcap.out | 20 +- test/results/tls_esni_sni_both.pcap.out | 22 +- test/results/tls_false_positives.pcapng.out | 12 +- test/results/tls_invalid_reads.pcap.out | 20 +- test/results/tls_long_cert.pcap.out | 18 +- test/results/tls_missing_ch_frag.pcap.out | 24 + ...s_multiple_synack_different_seq.pcapng.out | 26 + test/results/tls_port_80.pcapng.out | 14 +- test/results/tls_torrent.pcapng.out | 18 +- .../results/tls_verylong_certificate.pcap.out | 21 +- test/results/toca-boca.pcap.out | 82 +- test/results/tor.pcap.out | 68 +- test/results/trickbot.pcap.out | 16 +- test/results/tumblr.pcap.out | 164 +- test/results/tunnelbear.pcap.out | 126 +- test/results/ubntac2.pcap.out | 42 +- test/results/ultrasurf.pcap.out | 22 +- test/results/upnp.pcap.out | 14 +- test/results/viber.pcap.out | 163 +- test/results/vnc.pcap.out | 18 +- test/results/vrrp3.pcapng.out | 18 +- test/results/vxlan.pcap.out | 42 +- test/results/wa_video.pcap.out | 64 +- test/results/wa_voice.pcap.out | 128 +- test/results/waze.pcap.out | 184 +- test/results/webex.pcap.out | 283 +- test/results/websocket.pcap.out | 14 +- test/results/wechat.pcap.out | 497 +- test/results/weibo.pcap.out | 152 +- test/results/whatsapp.pcap.out | 354 +- test/results/whatsapp_login_call.pcap.out | 215 +- test/results/whatsapp_login_chat.pcap.out | 43 +- .../whatsapp_voice_and_message.pcap.out | 62 +- test/results/whatsappfiles.pcap.out | 24 +- test/results/whois.pcapng.out | 18 +- test/results/windowsupdate_over_http.pcap.out | 16 +- test/results/wireguard.pcap.out | 14 +- test/results/wow.pcap.out | 30 +- test/results/xdmcp.pcap.out | 14 +- test/results/xiaomi.pcap.out | 36 +- test/results/xss.pcap.out | 16 +- test/results/youtube_quic.pcap.out | 18 +- test/results/youtubeupload.pcap.out | 22 +- test/results/z3950.pcapng.out | 16 +- test/results/zabbix.pcap.out | 14 +- test/results/zattoo.pcap.out | 20 +- test/results/zcash.pcap.out | 14 +- test/results/zoom.pcap.out | 179 +- test/results/zoom2.pcap.out | 40 +- 375 files changed, 16651 insertions(+), 15694 deletions(-) create mode 100644 test/results/TivoDVR.pcap.out create mode 100644 test/results/activision.pcap.out create mode 100644 test/results/alicloud.pcap.out create mode 100644 test/results/avast.pcap.out create mode 100644 test/results/fastcgi.pcap.out create mode 100644 test/results/http-proxy.pcapng.out create mode 100644 test/results/http_on_sip_port.pcap.out create mode 100644 test/results/kismet.pcap.out create mode 100644 test/results/pop3_stls.pcap.out delete mode 100644 test/results/softether-http.pcap.out create mode 100644 test/results/softether.pcap.out create mode 100644 test/results/stun_dtls.pcapng.out create mode 100644 test/results/tls_2_reasms.pcapng.out create mode 100644 test/results/tls_2_reasms_b.pcapng.out create mode 100644 test/results/tls_missing_ch_frag.pcap.out create mode 100644 test/results/tls_multiple_synack_different_seq.pcapng.out diff --git a/CMakeLists.txt b/CMakeLists.txt index e44e223eb..d9a0ccb61 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -190,6 +190,8 @@ if(BUILD_NDPI) CONFIGURE_COMMAND env CC=${CMAKE_C_COMPILER} CXX=false + AR=${CMAKE_C_COMPILER_AR} + RANLIB=${CMAKE_C_COMPILER_RANLIB} PKG_CONFIG=${PKG_CONFIG_EXECUTABLE} CFLAGS=${CMAKE_C_FLAGS} LDFLAGS=${CMAKE_MODULE_LINKER_FLAGS} diff --git a/libnDPI b/libnDPI index 7c19de490..37f918322 160000 --- a/libnDPI +++ b/libnDPI @@ -1 +1 @@ -Subproject commit 7c19de49047a5731f3107ff17854e9afe839cc61 +Subproject commit 37f918322c0a489b5143a987c8f1a44a6f78a6f3 diff --git a/nDPId-test.c b/nDPId-test.c index da152f17f..48cf6e003 100644 --- a/nDPId-test.c +++ b/nDPId-test.c @@ -1076,6 +1076,13 @@ int main(int argc, char ** argv) nDPId_return.total_active_flows != nDPId_return.total_idle_flows) { logger(1, "%s: %s", argv[0], "Memory / Flow leak detected."); + logger(1, "%s: Allocated / Free'd bytes: %lu / %lu", argv[0], ndpi_memory_alloc_bytes, ndpi_memory_free_bytes); + logger(1, "%s: Allocated / Free'd count: %lu / %lu", argv[0], ndpi_memory_alloc_count, ndpi_memory_free_count); + logger(1, + "%s: Total Active / Idle Flows: %llu / %llu", + argv[0], + nDPId_return.total_active_flows, + nDPId_return.total_idle_flows); return 1; } diff --git a/nDPId.c b/nDPId.c index f57419de9..6e044abc9 100644 --- a/nDPId.c +++ b/nDPId.c @@ -2400,11 +2400,13 @@ static void jsonize_flow_event(struct nDPId_reader_thread * const reader_thread, { struct nDPId_flow * const flow = (struct nDPId_flow *)flow_ext; + ndpi_serialize_start_of_block(&workflow->ndpi_serializer, "ndpi"); ndpi_serialize_proto(workflow->ndpi_struct, &workflow->ndpi_serializer, flow->finished.risk, flow->finished.confidence, flow->flow_extended.detected_l7_protocol); + ndpi_serialize_end_of_block(&workflow->ndpi_serializer); } break; @@ -2821,7 +2823,7 @@ static int process_datalink_layer(struct nDPId_reader_thread * const reader_thre return 1; } - struct ndpi_chdlc const * const chdlc = (struct ndpi_chdlc const * const)&packet[eth_offset]; + struct ndpi_chdlc const * const chdlc = (struct ndpi_chdlc const * const) & packet[eth_offset]; *ip_offset = sizeof(struct ndpi_chdlc); *layer3_type = ntohs(chdlc->proto_code); break; @@ -2843,7 +2845,7 @@ static int process_datalink_layer(struct nDPId_reader_thread * const reader_thre if (packet[0] == 0x0f || packet[0] == 0x8f) { - struct ndpi_chdlc const * const chdlc = (struct ndpi_chdlc const * const)&packet[eth_offset]; + struct ndpi_chdlc const * const chdlc = (struct ndpi_chdlc const * const) & packet[eth_offset]; *ip_offset = sizeof(struct ndpi_chdlc); /* CHDLC_OFF = 4 */ *layer3_type = ntohs(chdlc->proto_code); } @@ -2881,7 +2883,7 @@ static int process_datalink_layer(struct nDPId_reader_thread * const reader_thre } struct ndpi_radiotap_header const * const radiotap = - (struct ndpi_radiotap_header const * const)&packet[eth_offset]; + (struct ndpi_radiotap_header const * const) & packet[eth_offset]; uint16_t radio_len = radiotap->len; /* Check Bad FCS presence */ @@ -3761,7 +3763,8 @@ static void ndpi_process_packet(uint8_t * const args, &flow_to_process->info.detection_data->flow, ip != NULL ? (uint8_t *)ip : (uint8_t *)ip6, ip_size, - workflow->last_thread_time); + workflow->last_thread_time, + NULL); if (ndpi_is_protocol_detected(workflow->ndpi_struct, flow_to_process->flow_extended.detected_l7_protocol) != 0 && flow_to_process->info.detection_completed == 0) @@ -4848,6 +4851,14 @@ int main(int argc, char ** argv) "----------------------------------\n", ndpi_get_gcrypt_version()); } + if (NDPI_API_VERSION != ndpi_get_api_version()) + { + logger_early(1, + "Unforeseen Consequences; nDPId was compiled with libnDPI api version %u, but the api version of " + "the shared library is: %u.", + NDPI_API_VERSION, + ndpi_get_api_version()); + } #ifdef ENABLE_MEMORY_PROFILING logger_early(0, "size/workflow...: %zu bytes", sizeof(struct nDPId_workflow)); diff --git a/schema/flow_event_schema.json b/schema/flow_event_schema.json index 8724ecfd2..649e21891 100644 --- a/schema/flow_event_schema.json +++ b/schema/flow_event_schema.json @@ -208,91 +208,126 @@ }, "ndpi": { "type": "object", - "required": [ "proto", "breed" ], + "required": [ "proto", "proto_id", "breed", "encrypted" ], - "if": { - "properties": { "proto": { "enum": [ "Unknown", "Skype_Teams" ] } } + "properties": { + "proto": { + "type": "string" + }, + "proto_id": { + "type": "string" + }, + "category": { + "type": "string" + }, + "category_id": { + "type": "number" + }, + "encrypted": { + "type": "number", + "enum": [ + 0, + 1 + ] + }, + "breed": { + "type": "string" + }, + "flow_risk": { + "type": "object" + }, + "confidence": { + "type": "object", + "properties": { + "0": { + "type": "string" + }, + "1": { + "type": "string" + }, + "2": { + "type": "string" + }, + "3": { + "type": "string" + }, + "4": { + "type": "string" + }, + "5": { + "type": "string" + }, + "6": { + "type": "string" + } + }, + "additionalProperties": false + }, + "entropy": { + "type": "number" + }, + "hostname": { + "type": "string" + }, + "dhcp": { + "type": "object" + }, + "discord": { + "type": "object" + }, + "bittorrent": { + "type": "object" + }, + "mdns": { + "type": "object" + }, + "ntp": { + "type": "object" + }, + "ubntac2": { + "type": "object" + }, + "kerberos": { + "type": "object" + }, + "telnet": { + "type": "object" + }, + "tls": { + "type": "object" + }, + "quic": { + "type": "object" + }, + "imap": { + "type": "object" + }, + "http": { + "type": "object" + }, + "pop": { + "type": "object" + }, + "smtp": { + "type": "object" + }, + "dns": { + "type": "object" + }, + "ftp": { + "type": "object" + }, + "ssh": { + "type": "object" + }, + "stun": { + "type": "object" + }, + "softether": { + "type": "object" + } }, - "then": { - "return": true - }, - "else": { - "required": [ "category", "confidence" ] - }, - - "proto": { - "type": "string" - }, - "category": { - "type": "string" - }, - "breed": { - "type": "string" - }, - "flow_risk": { - "type": "object" - }, - "confidence": { - "type": "string", - "enum": [ - "0", - "1", - "2", - "3", - "4" - ] - } - }, - "entropy": { - "type": "number" - }, - "dhcp": { - "type": "object" - }, - "bittorrent": { - "type": "object" - }, - "mdns": { - "type": "object" - }, - "ntp": { - "type": "object" - }, - "ubntac2": { - "type": "object" - }, - "kerberos": { - "type": "object" - }, - "telnet": { - "type": "object" - }, - "tls": { - "type": "object" - }, - "quic": { - "type": "object" - }, - "imap": { - "type": "object" - }, - "http": { - "type": "object" - }, - "pop": { - "type": "object" - }, - "smtp": { - "type": "object" - }, - "dns": { - "type": "object" - }, - "ftp": { - "type": "object" - }, - "ssh": { - "type": "object" + "additionalProperties": false } }, "additionalProperties": false diff --git a/scripts/get-and-build-libndpi.sh b/scripts/get-and-build-libndpi.sh index f9851c852..518ae820a 100755 --- a/scripts/get-and-build-libndpi.sh +++ b/scripts/get-and-build-libndpi.sh @@ -14,6 +14,8 @@ cat <