Initial tunnel decoding (GRE - Layer4 only atm). Fixes#53
* make finally use of the thread distribution seed
* Handle GRE/PPP subprotocol the right way
* Add `-t` command line / config option
* Removed duplicated and obsolete IP{4,6}_SIZE_SMALLER_THAN_HEADER which is the same as IP{4,6}_PACKET_TOO_SHORT
* Updated error event schema
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* replaced dumb `dumb_fuzzer.sh`
* fixed nDPId NULL pointer deref found by fuzzer
* nDPI: `--enable-debug-build` and `--enable-debug-messages` for non release builds
* nDPI: do not force `log.level` to `3` anymore, use config value instead
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* support for adding *.ndpiconf for nDPI config tests
* all other configs should have the suffix *.conf
* fixed nDPI malloc/free wrapper set (was already too late set)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Read and parse configuration files. Fixes#41.
* supports nDPId / nDPIsrvd via command line parameter `-f`
* nDPId: read general/tuning and libnDPI settings
* support for settings risk domains libnDPI option via config file or via `-R` (Fixes#45, thanks to @UnveilTech)
* added some documentation in the config file
* adjusted Systemd and Debian packaging to make use of config files
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* a "detection-update" event was thrown even if nothing changed
* in some cases "not-detected" events were spammed if detection not completed
* tell `libnDPI` how many packets per flow we want to dissect
* `nDPId-test` validates total active flows in the right way
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Add MacOS to Github CI builds.
* Fixed libnDPI-4.8 CI build.
* Fixed missing include for `struct sockaddr*`.
* Reworked IPv4 address and netmask retrieval.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Finalize Event I/O abstraction layer.
* Fix possible fd leakage, Gitlab-CI build and error logging.
* Fixed possible uninitialized signalfd variable.
* Fixed possible memory leak.
* Fixed some SonarCloud complaints.
* Fixed nDPId-test nDPIsrvd-arpa-mockup stuck indefinitely.
* Add nDPId / nDPIsrvd command line option to use poll() on Linux instead of the default epoll().
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* nDPId-test: Increased the max-packets-per-flow-to-send from 3 to 5.
This is quite useful for TCP as the first 3 packets are usually part of the three-way-handshake.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Still not perfect, but the code before was not even able to deal with JSON arrays.
Use common "speaking" function names for all functions in nDPIsrvd.h
* Provide a more or less generic and easy extendable JSON walk function.
* Modified C examples to align with the changed C API.
* c-collectd: Reduced lot's of code duplication by providing mapping tables.
* nDPId: IAT array requires one slot less (first packet has always an IAT of 0).
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* The goal was to provide a separate event for extracted feature that are not required
and only useful for a few (e.g. someone who wants do ML).
* Increased network buffer size to 32kB (8192 * 4).
* Switched timestamp precision from ms to us for *ALL* timestamps.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* export env vars AR / CMAKE_C_COMPILER_AR and RANLIB / CMAKE_C_COMPILER_RANLIB while building libnDPI
* nDPId check API version during startup (macro vs. function call) and print a warning if they are different
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* nDPId: imrpvoed collector socket error messages on connect/write/etc failures
* reverted `netcat` parts of the README
Signed-off-by: lns <matzeton@googlemail.com>
* no use for `flow_avg_l4_payload_len' -> removed
* test/run_tests.sh does not fail if git-worktree's are used
Signed-off-by: lns <matzeton@googlemail.com>
