IPv6: add support for IPv6 risk exceptions

ntop · Oct 27, 2023 · d891c26 · d891c26
1 parent e8e4b9e
commit d891c26
Show file tree

Hide file tree

Showing 456 changed files with 566 additions and 17 deletions.
diff --git a/example/ndpiReader.c b/example/ndpiReader.c
@@ -3895,6 +3895,9 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
       printf("\tPatricia risk mask:   %llu/%llu (search/found)\n",
 	     (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK].n_search,
 	     (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK].n_found);
+      printf("\tPatricia risk mask IPv6: %llu/%llu (search/found)\n",
+	     (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK6].n_search,
+	     (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK6].n_found);
       printf("\tPatricia risk:        %llu/%llu (search/found)\n",
 	     (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK].n_search,
 	     (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK].n_found);
@@ -3997,6 +4000,9 @@ static void printResults(u_int64_t processing_time_usec, u_int64_t setup_time_us
       fprintf(results_file, "Patricia risk mask:   %llu/%llu (search/found)\n",
 	      (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK].n_search,
 	      (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK].n_found);
+      fprintf(results_file, "Patricia risk mask IPv6: %llu/%llu (search/found)\n",
+	      (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK6].n_search,
+	      (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK_MASK6].n_found);
       fprintf(results_file, "Patricia risk:        %llu/%llu (search/found)\n",
 	      (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK].n_search,
 	      (long long unsigned int)cumulative_stats.patricia_stats[NDPI_PTREE_RISK].n_found);

diff --git a/example/protos.txt b/example/protos.txt
@@ -67,6 +67,8 @@ ip:3.3.3.3:446@CustomProtocolC=400
 #ip_risk_mask:192.168.1.0/24=0
 ip_risk_mask:10.10.120.0/24=0
 ip_risk_mask:10.196.157.228=0
+ipv6_risk_mask:[fe80::356b:e047:3695:0]/112=0
+ipv6_risk_mask:[fe80::7c0:e74e:87c3:5d93]=0
 host_risk_mask:".home"=0
 
 

diff --git a/fuzz/corpus/fuzz_filecfg_protocols/masks_ipv6_1.txt b/fuzz/corpus/fuzz_filecfg_protocols/masks_ipv6_1.txt
@@ -0,0 +1 @@
+ipv6_risk_mask:[fe80::356b:e047:3695:0]/112=0
diff --git a/fuzz/corpus/fuzz_filecfg_protocols/masks_ipv6_2.txt b/fuzz/corpus/fuzz_filecfg_protocols/masks_ipv6_2.txt
@@ -0,0 +1 @@
+ipv6_risk_mask:[fe80::7c0:e74e:87c3:5d93]=0
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
@@ -692,6 +692,7 @@ typedef enum {
 
 typedef enum {
   NDPI_PTREE_RISK_MASK = 0,
+  NDPI_PTREE_RISK_MASK6,
   NDPI_PTREE_RISK,
   NDPI_PTREE_RISK6,
   NDPI_PTREE_PROTOCOLS,
@@ -1311,6 +1312,7 @@ struct ndpi_detection_module_struct {
 
   /* Patricia trees */
   ndpi_patricia_tree_t *ip_risk_mask_ptree;
+  ndpi_patricia_tree_t *ip_risk_mask_ptree6;
   ndpi_patricia_tree_t *ip_risk_ptree; 
   ndpi_patricia_tree_t *ip_risk_ptree6;
   ndpi_patricia_tree_t *protocols_ptree;  /* IP-based protocol detection */

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
@@ -2285,6 +2285,10 @@ int ndpi_get_patricia_stats(struct ndpi_detection_module_struct *ndpi_struct,
     ndpi_patricia_get_stats(ndpi_struct->ip_risk_mask_ptree, stats);
     return 0;
 
+  case NDPI_PTREE_RISK_MASK6:
+    ndpi_patricia_get_stats(ndpi_struct->ip_risk_mask_ptree6, stats);
+    return 0;
+
   case NDPI_PTREE_RISK:
     ndpi_patricia_get_stats(ndpi_struct->ip_risk_ptree, stats);
     return 0;
@@ -3124,6 +3128,7 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs
     ndpi_str->max_payload_track_len = 1024; /* track up to X payload bytes */
 
   ndpi_str->ip_risk_mask_ptree = ndpi_patricia_new(32 /* IPv4 */);
+  ndpi_str->ip_risk_mask_ptree6 = ndpi_patricia_new(128 /* IPv6 */);
 
   if(!(prefs & ndpi_dont_init_risk_ptree)) {
 
@@ -3740,6 +3745,9 @@ void ndpi_exit_detection_module(struct ndpi_detection_module_struct *ndpi_str) {
     if(ndpi_str->ip_risk_mask_ptree)
       ndpi_patricia_destroy((ndpi_patricia_tree_t *) ndpi_str->ip_risk_mask_ptree, NULL);
 
+    if(ndpi_str->ip_risk_mask_ptree6)
+      ndpi_patricia_destroy((ndpi_patricia_tree_t *) ndpi_str->ip_risk_mask_ptree6, NULL);
+
     if(ndpi_str->ip_risk_ptree)
       ndpi_patricia_destroy((ndpi_patricia_tree_t *) ndpi_str->ip_risk_ptree, NULL);
 
@@ -3996,26 +4004,42 @@ char *strsep(char **sp, char *sep) {
 
 int ndpi_add_ip_risk_mask(struct ndpi_detection_module_struct *ndpi_str,
 			  char *ip, ndpi_risk mask) {
-  char *saveptr, *addr = strtok_r(ip, "/", &saveptr);
+  char *cidr, *saveptr, *addr = strtok_r(ip, "/", &saveptr);
+  int is_ipv6 = 0;
+  ndpi_patricia_node_t *node = NULL;
 
-  if(!ndpi_str->ip_risk_mask_ptree)
-    return(-3);
+  if(!addr || strlen(addr) == 0)
+    return(-2);
 
-  if(addr) {
-    char *cidr = strtok_r(NULL, "\n", &saveptr);
+  if(ip[0] == '[') {
+    is_ipv6 = 1;
+    addr += 1;
+    addr[strlen(addr) - 1] = '\0'; /* strip ']' */
+  }
+
+  cidr = strtok_r(NULL, "\n", &saveptr);
+
+  if(!is_ipv6 && ndpi_str->ip_risk_mask_ptree) {
     struct in_addr pin;
-    ndpi_patricia_node_t *node;
 
     pin.s_addr = inet_addr(addr);
-    /* FIX: Add IPv6 support */
-    if((node = add_to_ptree(ndpi_str->ip_risk_mask_ptree, AF_INET,
-			    &pin, cidr ? atoi(cidr) : 32 /* bits */)) != NULL) {
-      node->value.u.uv64 = (u_int64_t)mask;
-      return(0);
-    } else
-      return(-1);
-  } else
+    node = add_to_ptree(ndpi_str->ip_risk_mask_ptree, AF_INET,
+			&pin, cidr ? atoi(cidr) : 32 /* bits */);
+  } else if(is_ipv6 && ndpi_str->ip_risk_mask_ptree6) {
+    struct in6_addr pin6;
+
+    inet_pton(AF_INET6, addr, &pin6);
+    node = add_to_ptree(ndpi_str->ip_risk_mask_ptree6, AF_INET6,
+			&pin6, cidr ? atoi(cidr) : 128 /* bits */);
+  } else {
     return(-2);
+  }
+
+  if(node) {
+    node->value.u.uv64 = (u_int64_t)mask;
+    return(0);
+  }
+  return(-1);
 }
 
 /* ******************************************************************** */
@@ -4139,7 +4163,8 @@ int ndpi_handle_rule(struct ndpi_detection_module_struct *ndpi_str,
       if(value) {
 	ndpi_risk risk_mask = (ndpi_risk)atoll(value);
 
-	if(!strcmp(rule_type, "ip_risk_mask")) {
+	if(!strcmp(rule_type, "ip_risk_mask") ||
+	   !strcmp(rule_type, "ipv6_risk_mask")) {
 	  return(ndpi_add_ip_risk_mask(ndpi_str, key, risk_mask));
 	} else if(!strcmp(rule_type, "host_risk_mask")) {
 	  return(ndpi_add_host_risk_mask(ndpi_str, key, risk_mask));

diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
@@ -2336,7 +2336,7 @@ static u_int64_t ndpi_host_ip_risk_ptree_match(struct ndpi_detection_module_stru
     return((u_int64_t)-1);
 
   /* Make sure all in network byte order otherwise compares wont work */
-  ndpi_fill_prefix_v4(&prefix, pin, 32, ((ndpi_patricia_tree_t *) ndpi_str->protocols_ptree)->maxbits);
+  ndpi_fill_prefix_v4(&prefix, pin, 32, ((ndpi_patricia_tree_t *) ndpi_str->ip_risk_mask_ptree)->maxbits);
   node = ndpi_patricia_search_best(ndpi_str->ip_risk_mask_ptree, &prefix);
 
   if(node)
@@ -2347,6 +2347,26 @@ static u_int64_t ndpi_host_ip_risk_ptree_match(struct ndpi_detection_module_stru
 
 /* ********************************************************************************* */
 
+static u_int64_t ndpi_host_ip_risk_ptree_match6(struct ndpi_detection_module_struct *ndpi_str,
+					        struct in6_addr *pin6) {
+  ndpi_prefix_t prefix;
+  ndpi_patricia_node_t *node;
+
+  if(!ndpi_str->protocols_ptree6)
+    return((u_int64_t)-1);
+
+  /* Make sure all in network byte order otherwise compares wont work */
+  ndpi_fill_prefix_v6(&prefix, pin6, 128, ((ndpi_patricia_tree_t *) ndpi_str->ip_risk_mask_ptree6)->maxbits);
+  node = ndpi_patricia_search_best(ndpi_str->ip_risk_mask_ptree6, &prefix);
+
+  if(node)
+    return(node->value.u.uv64);
+  else
+    return((u_int64_t)-1);
+}
+
+/* ********************************************************************************* */
+
 /* Check isuerDN exception */
 u_int8_t ndpi_check_issuerdn_risk_exception(struct ndpi_detection_module_struct *ndpi_str,
 					    char *issuerDN) {
@@ -2413,6 +2433,20 @@ static u_int8_t ndpi_check_ipv4_exception(struct ndpi_detection_module_struct *n
 
 /* ********************************************************************************* */
 
+static u_int8_t ndpi_check_ipv6_exception(struct ndpi_detection_module_struct *ndpi_str,
+					  struct ndpi_flow_struct *flow,
+					  struct in6_addr *addr) {
+  u_int64_t r;
+
+  r = ndpi_host_ip_risk_ptree_match6(ndpi_str, addr);
+
+  if(flow) flow->risk_mask &= r;
+
+  return((r != (u_int64_t)-1) ? 1 : 0);
+}
+
+/* ********************************************************************************* */
+
 void ndpi_handle_risk_exceptions(struct ndpi_detection_module_struct *ndpi_str,
 				 struct ndpi_flow_struct *flow) {
   if(flow->risk == 0) return; /* Nothing to do */
@@ -2449,11 +2483,13 @@ void ndpi_handle_risk_exceptions(struct ndpi_detection_module_struct *ndpi_str,
     }
   }
 
-  /* TODO: add IPv6 support */
   if(!flow->ip_risk_mask_evaluated) {
     if(flow->is_ipv6 == 0) {
       ndpi_check_ipv4_exception(ndpi_str, flow, flow->c_address.v4 /* Client */);
       ndpi_check_ipv4_exception(ndpi_str, flow, flow->s_address.v4 /* Server */);
+    } else {
+      ndpi_check_ipv6_exception(ndpi_str, flow, (struct in6_addr *)&flow->c_address.v6 /* Client */);
+      ndpi_check_ipv6_exception(ndpi_str, flow, (struct in6_addr *)&flow->s_address.v6 /* Server */);
     }
 
     flow->ip_risk_mask_evaluated = 1;

diff --git a/tests/cfgs/caches_cfg/result/ookla.pcap.out b/tests/cfgs/caches_cfg/result/ookla.pcap.out
@@ -18,6 +18,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  4/4 (search/found)
 Patricia risk mask:   2/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   11/1 (search/found)

diff --git a/tests/cfgs/caches_cfg/result/teams.pcap.out b/tests/cfgs/caches_cfg/result/teams.pcap.out
@@ -22,6 +22,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     24/1 (search/found)
 Automa common alpns:  67/67 (search/found)
 Patricia risk mask:   80/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        1/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   121/47 (search/found)

diff --git a/tests/cfgs/default/pcap/custom_risk_mask.pcapng b/tests/cfgs/default/pcap/custom_risk_mask.pcapng
diff --git a/tests/cfgs/default/result/1kxun.pcap.out b/tests/cfgs/default/result/1kxun.pcap.out
@@ -20,6 +20,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     16/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   174/0 (search/found)
+Patricia risk mask IPv6: 6/0 (search/found)
 Patricia risk:        3/0 (search/found)
 Patricia risk IPv6:   25/0 (search/found)
 Patricia protocols:   315/59 (search/found)

diff --git a/tests/cfgs/default/result/443-chrome.pcap.out b/tests/cfgs/default/result/443-chrome.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   2/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/443-curl.pcap.out b/tests/cfgs/default/result/443-curl.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  2/2 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/443-firefox.pcap.out b/tests/cfgs/default/result/443-firefox.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  2/2 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/443-git.pcap.out b/tests/cfgs/default/result/443-git.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  1/1 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   1/1 (search/found)

diff --git a/tests/cfgs/default/result/443-opvn.pcap.out b/tests/cfgs/default/result/443-opvn.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/443-safari.pcap.out b/tests/cfgs/default/result/443-safari.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  7/7 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/4in4tunnel.pcap.out b/tests/cfgs/default/result/4in4tunnel.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/4in6tunnel.pcap.out b/tests/cfgs/default/result/4in6tunnel.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  2/2 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/6in4tunnel.pcap.out b/tests/cfgs/default/result/6in4tunnel.pcap.out
@@ -19,6 +19,7 @@ Automa tls cert:      1/0 (search/found)
 Automa risk mask:     3/0 (search/found)
 Automa common alpns:  4/4 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 16/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   10/1 (search/found)
 Patricia protocols:   0/0 (search/found)

diff --git a/tests/cfgs/default/result/6in6tunnel.pcap.out b/tests/cfgs/default/result/6in6tunnel.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   1/0 (search/found)
 Patricia protocols:   0/0 (search/found)

diff --git a/tests/cfgs/default/result/BGP_Cisco_hdlc_slarp.pcap.out b/tests/cfgs/default/result/BGP_Cisco_hdlc_slarp.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   0/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        1/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/BGP_redist.pcap.out b/tests/cfgs/default/result/BGP_redist.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   4/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        2/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   4/0 (search/found)

diff --git a/tests/cfgs/default/result/EAQ.pcap.out b/tests/cfgs/default/result/EAQ.pcap.out
@@ -18,6 +18,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     2/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   46/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   60/2 (search/found)

diff --git a/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out b/tests/cfgs/default/result/FAX-Call-t38-CA-TDM-SIP-FB-1.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   10/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   10/0 (search/found)

diff --git a/tests/cfgs/default/result/IEC104.pcap.out b/tests/cfgs/default/result/IEC104.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   4/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   4/0 (search/found)

diff --git a/tests/cfgs/default/result/KakaoTalk_chat.pcap.out b/tests/cfgs/default/result/KakaoTalk_chat.pcap.out
@@ -20,6 +20,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     18/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   60/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   63/15 (search/found)

diff --git a/tests/cfgs/default/result/KakaoTalk_talk.pcap.out b/tests/cfgs/default/result/KakaoTalk_talk.pcap.out
@@ -20,6 +20,7 @@ Automa tls cert:      2/2 (search/found)
 Automa risk mask:     1/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   30/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   33/11 (search/found)

diff --git a/tests/cfgs/default/result/NTPv2.pcap.out b/tests/cfgs/default/result/NTPv2.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   2/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        1/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)

diff --git a/tests/cfgs/default/result/NTPv3.pcap.out b/tests/cfgs/default/result/NTPv3.pcap.out
@@ -17,6 +17,7 @@ Automa tls cert:      0/0 (search/found)
 Automa risk mask:     0/0 (search/found)
 Automa common alpns:  0/0 (search/found)
 Patricia risk mask:   2/0 (search/found)
+Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        1/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
 Patricia protocols:   2/0 (search/found)