aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIvan Nardi <12729895+IvanNardi@users.noreply.github.com>2022-07-22 12:19:21 +0200
committerGitHub <noreply@github.com>2022-07-22 12:19:21 +0200
commit52005e88ed9730c605db23573f63ba6a17cd45e5 (patch)
treeb170a3955ccc6cac9d25e4011d6ec49c25133222
parentce6f11840d1ae7a9f1e1537d004c4814842fa305 (diff)
TLS: improve reassembler (#1669)
* TLS: cosmetic changes * TLS: improve reassembler We might need to contemporary re-order messages from both directions: use one buffer per direction.
Diffstat
12 files changed, 102 insertions, 58 deletions
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 8fdf8f18a..da2be39a3 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -550,7 +550,7 @@ typedef union
typedef struct message {
u_int8_t *buffer;
u_int buffer_len, buffer_used;
- u_int32_t next_seq[2]; /* Directions */
+ u_int32_t next_seq;
} message_t;
/* NDPI_PROTOCOL_TINC */
@@ -643,7 +643,7 @@ struct ndpi_flow_tcp_struct {
u_int32_t telnet_stage:2; // 0 - 2
struct {
- message_t message;
+ message_t message[2]; /* Directions */
/* NDPI_PROTOCOL_TLS */
u_int8_t certificate_processed:1, fingerprint_set:1, _pad:6;
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 172149824..e98577406 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -4813,8 +4813,10 @@ void ndpi_free_flow_data(struct ndpi_flow_struct* flow) {
}
if(flow->l4_proto == IPPROTO_TCP) {
- if(flow->l4.tcp.tls.message.buffer)
- ndpi_free(flow->l4.tcp.tls.message.buffer);
+ if(flow->l4.tcp.tls.message[0].buffer)
+ ndpi_free(flow->l4.tcp.tls.message[0].buffer);
+ if(flow->l4.tcp.tls.message[1].buffer)
+ ndpi_free(flow->l4.tcp.tls.message[1].buffer);
}
if(flow->l4_proto == IPPROTO_UDP) {
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index e827e97d1..25b765f9e 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -141,73 +141,74 @@ static u_int32_t ndpi_tls_refine_master_protocol(struct ndpi_detection_module_st
void ndpi_search_tls_tcp_memory(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
+ message_t *message = &flow->l4.tcp.tls.message[packet->packet_direction];
u_int avail_bytes;
/* TCP */
#ifdef DEBUG_TLS_MEMORY
printf("[TLS Mem] Handling TCP/TLS flow [payload_len: %u][buffer_len: %u][direction: %u]\n",
packet->payload_packet_len,
- flow->l4.tcp.tls.message.buffer_len,
+ message->buffer_len,
packet->packet_direction);
#endif
- if(flow->l4.tcp.tls.message.buffer == NULL) {
+ if(message->buffer == NULL) {
/* Allocate buffer */
- flow->l4.tcp.tls.message.buffer_len = 2048, flow->l4.tcp.tls.message.buffer_used = 0;
- flow->l4.tcp.tls.message.buffer = (u_int8_t*)ndpi_malloc(flow->l4.tcp.tls.message.buffer_len);
+ message->buffer_len = 2048, message->buffer_used = 0;
+ message->buffer = (u_int8_t*)ndpi_malloc(message->buffer_len);
- if(flow->l4.tcp.tls.message.buffer == NULL)
+ if(message->buffer == NULL)
return;
#ifdef DEBUG_TLS_MEMORY
- printf("[TLS Mem] Allocating %u buffer\n", flow->l4.tcp.tls.message.buffer_len);
+ printf("[TLS Mem] Allocating %u buffer\n", message->buffer_len);
#endif
}
- avail_bytes = flow->l4.tcp.tls.message.buffer_len - flow->l4.tcp.tls.message.buffer_used;
+ avail_bytes = message->buffer_len - message->buffer_used;
if(avail_bytes < packet->payload_packet_len) {
- u_int new_len = flow->l4.tcp.tls.message.buffer_len + packet->payload_packet_len - avail_bytes + 1;
- void *newbuf = ndpi_realloc(flow->l4.tcp.tls.message.buffer,
- flow->l4.tcp.tls.message.buffer_len, new_len);
+ u_int new_len = message->buffer_len + packet->payload_packet_len - avail_bytes + 1;
+ void *newbuf = ndpi_realloc(message->buffer,
+ message->buffer_len, new_len);
if(!newbuf) return;
#ifdef DEBUG_TLS_MEMORY
- printf("[TLS Mem] Enlarging %u -> %u buffer\n", flow->l4.tcp.tls.message.buffer_len, new_len);
+ printf("[TLS Mem] Enlarging %u -> %u buffer\n", message->buffer_len, new_len);
#endif
- flow->l4.tcp.tls.message.buffer = (u_int8_t*)newbuf;
- flow->l4.tcp.tls.message.buffer_len = new_len;
- avail_bytes = flow->l4.tcp.tls.message.buffer_len - flow->l4.tcp.tls.message.buffer_used;
+ message->buffer = (u_int8_t*)newbuf;
+ message->buffer_len = new_len;
+ avail_bytes = message->buffer_len - message->buffer_used;
}
if(packet->payload_packet_len > 0 && avail_bytes >= packet->payload_packet_len) {
u_int8_t ok = 0;
- if(flow->l4.tcp.tls.message.next_seq[packet->packet_direction] != 0) {
- if(ntohl(packet->tcp->seq) == flow->l4.tcp.tls.message.next_seq[packet->packet_direction])
+ if(message->next_seq != 0) {
+ if(ntohl(packet->tcp->seq) == message->next_seq)
ok = 1;
} else
ok = 1;
if(ok) {
- memcpy(&flow->l4.tcp.tls.message.buffer[flow->l4.tcp.tls.message.buffer_used],
+ memcpy(&message->buffer[message->buffer_used],
packet->payload, packet->payload_packet_len);
- flow->l4.tcp.tls.message.buffer_used += packet->payload_packet_len;
+ message->buffer_used += packet->payload_packet_len;
#ifdef DEBUG_TLS_MEMORY
printf("[TLS Mem] Copied data to buffer [%u/%u bytes][direction: %u][tcp_seq: %u][next: %u]\n",
- flow->l4.tcp.tls.message.buffer_used, flow->l4.tcp.tls.message.buffer_len,
+ message->buffer_used, message->buffer_len,
packet->packet_direction,
ntohl(packet->tcp->seq),
ntohl(packet->tcp->seq)+packet->payload_packet_len);
#endif
- flow->l4.tcp.tls.message.next_seq[packet->packet_direction] = ntohl(packet->tcp->seq)+packet->payload_packet_len;
+ message->next_seq = ntohl(packet->tcp->seq)+packet->payload_packet_len;
} else {
#ifdef DEBUG_TLS_MEMORY
printf("[TLS Mem] Skipping packet [%u bytes][direction: %u][tcp_seq: %u][expected next: %u]\n",
- flow->l4.tcp.tls.message.buffer_len,
+ message->buffer_len,
packet->packet_direction,
ntohl(packet->tcp->seq),
ntohl(packet->tcp->seq)+packet->payload_packet_len);
@@ -908,6 +909,7 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &ndpi_struct->packet;
u_int8_t something_went_wrong = 0;
+ message_t *message;
#ifdef DEBUG_TLS_MEMORY
printf("[TLS Mem] ndpi_search_tls_tcp() Processing new packet [payload_packet_len: %u]\n",
@@ -918,11 +920,12 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
return(1); /* Keep working */
ndpi_search_tls_tcp_memory(ndpi_struct, flow);
+ message = &flow->l4.tcp.tls.message[packet->packet_direction];
/* Valid TLS Content Types:
https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-5 */
- if(!(flow->l4.tcp.tls.message.buffer[0] >= 20 &&
- flow->l4.tcp.tls.message.buffer[0] <= 26)) {
+ if(!(message->buffer[0] >= 20 &&
+ message->buffer[0] <= 26)) {
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
something_went_wrong = 1;
}
@@ -932,20 +935,20 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
const u_int8_t *p;
u_int8_t content_type;
- if(flow->l4.tcp.tls.message.buffer_used < 5)
+ if(message->buffer_used < 5)
return(1); /* Keep working */
- len = (flow->l4.tcp.tls.message.buffer[3] << 8) + flow->l4.tcp.tls.message.buffer[4] + 5;
+ len = (message->buffer[3] << 8) + message->buffer[4] + 5;
- if(len > flow->l4.tcp.tls.message.buffer_used) {
+ if(len > message->buffer_used) {
#ifdef DEBUG_TLS_MEMORY
printf("[TLS Mem] Not enough TLS data [%u < %u][%02X %02X %02X %02X %02X]\n",
- len, flow->l4.tcp.tls.message.buffer_used,
- flow->l4.tcp.tls.message.buffer[0],
- flow->l4.tcp.tls.message.buffer[1],
- flow->l4.tcp.tls.message.buffer[2],
- flow->l4.tcp.tls.message.buffer[3],
- flow->l4.tcp.tls.message.buffer[4]);
+ len, message->buffer_used,
+ message->buffer[0],
+ message->buffer[1],
+ message->buffer[2],
+ message->buffer[3],
+ message->buffer[4]);
#endif
break;
}
@@ -959,7 +962,7 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
printf("[TLS Mem] Processing %u bytes message\n", len);
#endif
- content_type = flow->l4.tcp.tls.message.buffer[0];
+ content_type = message->buffer[0];
/* Overwriting packet payload */
p = packet->payload;
@@ -981,16 +984,16 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
#endif
if(len >= 7) {
- u_int8_t alert_level = flow->l4.tcp.tls.message.buffer[5];
+ u_int8_t alert_level = message->buffer[5];
if(alert_level == 2 /* Warning (1), Fatal (2) */)
ndpi_set_risk(ndpi_struct, flow, NDPI_TLS_FATAL_ALERT, NULL);
}
- u_int16_t const alert_len = ntohs(*(u_int16_t const *)&flow->l4.tcp.tls.message.buffer[3]);
- if (flow->l4.tcp.tls.message.buffer[1] == 0x03 &&
- flow->l4.tcp.tls.message.buffer[2] <= 0x04 &&
- alert_len == (u_int32_t)flow->l4.tcp.tls.message.buffer_used - 5)
+ u_int16_t const alert_len = ntohs(*(u_int16_t const *)&message->buffer[3]);
+ if (message->buffer[1] == 0x03 &&
+ message->buffer[2] <= 0x04 &&
+ alert_len == (u_int32_t)message->buffer_used - 5)
{
ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS);
}
@@ -1003,7 +1006,7 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
u_int16_t processed = 5;
while((processed+4) <= len) {
- const u_int8_t *block = (const u_int8_t *)&flow->l4.tcp.tls.message.buffer[processed];
+ const u_int8_t *block = (const u_int8_t *)&message->buffer[processed];
u_int32_t block_len = (block[1] << 16) + (block[2] << 8) + block[3];
if(/* (block_len == 0) || */ /* Note blocks can have zero lenght */
@@ -1013,7 +1016,7 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
}
packet->payload = block;
- packet->payload_packet_len = ndpi_min(block_len+4, flow->l4.tcp.tls.message.buffer_used);
+ packet->payload_packet_len = ndpi_min(block_len+4, message->buffer_used);
if((processed+packet->payload_packet_len) > len) {
something_went_wrong = 1;
@@ -1028,15 +1031,15 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
} else if(len > 5 /* Minimum block size */) {
/* Process element as a whole */
if(content_type == 0x17 /* Application Data */) {
- u_int32_t block_len = (flow->l4.tcp.tls.message.buffer[3] << 8) + (flow->l4.tcp.tls.message.buffer[4]);
+ u_int32_t block_len = (message->buffer[3] << 8) + (message->buffer[4]);
/* Let's do a quick check to make sure this really looks like TLS */
if(block_len < 16384 /* Max TLS block size */)
ndpi_looks_like_tls(ndpi_struct, flow);
- if (flow->l4.tcp.tls.message.buffer[1] == 0x03 &&
- flow->l4.tcp.tls.message.buffer[2] <= 0x04 &&
- block_len == (u_int32_t)flow->l4.tcp.tls.message.buffer_used - 5)
+ if (message->buffer[1] == 0x03 &&
+ message->buffer[2] <= 0x04 &&
+ block_len == (u_int32_t)message->buffer_used - 5)
{
ndpi_int_tls_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TLS);
}
@@ -1056,17 +1059,15 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
packet->payload = p;
packet->payload_packet_len = p_len; /* Restore */
- flow->l4.tcp.tls.message.buffer_used -= len;
+ message->buffer_used -= len;
- if(flow->l4.tcp.tls.message.buffer_used > 0)
- memmove(flow->l4.tcp.tls.message.buffer,
- &flow->l4.tcp.tls.message.buffer[len],
- flow->l4.tcp.tls.message.buffer_used);
+ if(message->buffer_used > 0)
+ memmove(message->buffer, &message->buffer[len], message->buffer_used);
else
break;
#ifdef DEBUG_TLS_MEMORY
- printf("[TLS Mem] Left memory buffer %u bytes\n", flow->l4.tcp.tls.message.buffer_used);
+ printf("[TLS Mem] Left memory buffer %u bytes\n", message->buffer_used);
#endif
}
diff --git a/tests/pcap/tls_2_reasms.pcapng b/tests/pcap/tls_2_reasms.pcapng
new file mode 100644
index 000000000..3275191b2
--- /dev/null
+++ b/tests/pcap/tls_2_reasms.pcapng
Binary files differ
diff --git a/tests/pcap/tls_2_reasms_b.pcapng b/tests/pcap/tls_2_reasms_b.pcapng
new file mode 100644
index 000000000..f50024974
--- /dev/null
+++ b/tests/pcap/tls_2_reasms_b.pcapng
Binary files differ
diff --git a/tests/pcap/tls_missing_ch_frag.pcap b/tests/pcap/tls_missing_ch_frag.pcap
new file mode 100644
index 000000000..edd0529ca
--- /dev/null
+++ b/tests/pcap/tls_missing_ch_frag.pcap
Binary files differ
diff --git a/tests/result/skype.pcap.out b/tests/result/skype.pcap.out
index 8ddb2020a..eae5ec38f 100644
--- a/tests/result/skype.pcap.out
+++ b/tests/result/skype.pcap.out
@@ -7,7 +7,7 @@ Confidence Unknown : 61 (flows)
Confidence Match by port : 27 (flows)
Confidence Match by IP : 1 (flows)
Confidence DPI : 204 (flows)
-Num dissector calls: 31670 (108.09 diss/flow)
+Num dissector calls: 31667 (108.08 diss/flow)
Unknown 1575 272476 61
DNS 2 267 1
diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out
index 32ad91911..7f8e32dce 100644
--- a/tests/result/skype_no_unknown.pcap.out
+++ b/tests/result/skype_no_unknown.pcap.out
@@ -1,6 +1,6 @@
Guessed flow protos: 72
-DPI Packets (TCP): 1111 (14.62 pkts/flow)
+DPI Packets (TCP): 1120 (14.74 pkts/flow)
DPI Packets (UDP): 288 (1.55 pkts/flow)
DPI Packets (other): 5 (1.00 pkts/flow)
Confidence Unknown : 45 (flows)
diff --git a/tests/result/teams.pcap.out b/tests/result/teams.pcap.out
index 8e52e12bf..7f733e28e 100644
--- a/tests/result/teams.pcap.out
+++ b/tests/result/teams.pcap.out
@@ -1,6 +1,6 @@
Guessed flow protos: 4
-DPI Packets (TCP): 356 (8.48 pkts/flow)
+DPI Packets (TCP): 347 (8.26 pkts/flow)
DPI Packets (UDP): 87 (2.17 pkts/flow)
DPI Packets (other): 1 (1.00 pkts/flow)
Confidence Unknown : 1 (flows)
@@ -35,7 +35,7 @@ JA3 Host Stats:
3 TCP 192.168.1.6:60532 <-> 52.114.77.33:443 [proto: 91.212/TLS.Microsoft][Encrypted][Confidence: DPI][cat: Cloud/13][49 pkts/58592 bytes <-> 28 pkts/6555 bytes][Goodput ratio: 94/72][0.71 sec][Hostname/SNI: mobile.pipe.aria.microsoft.com][bytes ratio: 0.799 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 13/29 177/221 32/57][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1196/234 1494/1506 564/435][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: a1674500365bdd882188db63730e69a2][ServerNames: *.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com][JA3S: ae4edc6faf64d08308082ad26be60767][Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4][Subject: CN=*.events.data.microsoft.com][Certificate SHA-1: 33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB][Safari][Validity: 2019-10-10 21:55:38 - 2021-10-10 21:55:38][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][Plen Bins: 2,2,2,0,0,2,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,2,0,0,81,4,0,0]
4 TCP 192.168.1.6:60554 <-> 52.113.194.132:443 [proto: 91.250/TLS.Teams][Encrypted][Confidence: DPI][cat: Collaborative/15][24 pkts/2746 bytes <-> 28 pkts/30546 bytes][Goodput ratio: 52/95][0.23 sec][Hostname/SNI: config.teams.microsoft.com][bytes ratio: -0.835 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 4/9 21/140 7/29][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 114/1091 1136/1506 217/607][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: e4d448cdfe06dc1243c1eb026c74ac9a][ServerNames: *.config.teams.microsoft.com,config.teams.microsoft.com][JA3S: 7d8fd34fdb13a7fff30d5a52846b6c4c][Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 1][Subject: CN=config.teams.microsoft.com][Certificate SHA-1: B9:54:54:12:C9:E9:43:65:10:70:04:7B:AD:B6:0C:46:06:38:A5:FA][Firefox][Validity: 2019-12-11 02:04:20 - 2021-12-11 02:04:20][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][Plen Bins: 0,7,0,3,3,3,0,0,0,0,0,0,0,0,0,0,0,0,0,3,0,0,0,0,0,0,0,0,0,0,3,0,0,3,0,0,0,0,0,7,0,0,0,0,0,65,0,0]
5 TCP 192.168.1.6:60561 <-> 52.114.77.33:443 [proto: 91.212/TLS.Microsoft][Encrypted][Confidence: DPI][cat: Cloud/13][23 pkts/19184 bytes <-> 14 pkts/5643 bytes][Goodput ratio: 92/83][0.82 sec][Hostname/SNI: mobile.pipe.aria.microsoft.com][bytes ratio: 0.545 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 25/44 161/136 43/48][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 834/403 1494/1506 690/567][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: a1674500365bdd882188db63730e69a2][ServerNames: *.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com][JA3S: ae4edc6faf64d08308082ad26be60767][Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4][Subject: CN=*.events.data.microsoft.com][Certificate SHA-1: 33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB][Safari][Validity: 2019-10-10 21:55:38 - 2021-10-10 21:55:38][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][Plen Bins: 4,4,4,0,0,0,9,0,0,0,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,4,0,0,60,9,0,0]
- 6 TCP 192.168.1.6:60535 <-> 52.114.77.33:443 [proto: 91.212/TLS.Microsoft][Encrypted][Confidence: DPI][cat: Cloud/13][21 pkts/16793 bytes <-> 13 pkts/5565 bytes][Goodput ratio: 92/84][0.33 sec][Hostname/SNI: mobile.pipe.aria.microsoft.com][bytes ratio: 0.502 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/18 48/49 17/20][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 800/428 1494/1506 681/581][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: a1674500365bdd882188db63730e69a2][ServerNames: *.events.data.microsoft.com,events.data.microsoft.com,*.pipe.aria.microsoft.com,pipe.skype.com,*.pipe.skype.com,*.mobile.events.data.microsoft.com,mobile.events.data.microsoft.com,*.events.data.msn.com,events.data.msn.com][JA3S: ae4edc6faf64d08308082ad26be60767][Issuer: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft IT, CN=Microsoft IT TLS CA 4][Subject: CN=*.events.data.microsoft.com][Certificate SHA-1: 33:B3:B7:E9:DA:25:F5:A0:04:E9:63:87:B6:FB:54:77:DB:ED:27:EB][Safari][Validity: 2019-10-10 21:55:38 - 2021-10-10 21:55:38][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][Plen Bins: 5,5,5,0,0,0,5,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,53,10,0,0]
+ 6 TCP 192.168.1.6:60535 <-> 52.114.77.33:443 [proto: 91.212/TLS.Microsoft][Encrypted][Confidence: DPI][cat: Cloud/13][21 pkts/16793 bytes <-> 13 pkts/5565 bytes][Goodput ratio: 92/84][0.33 sec][Hostname/SNI: mobile.pipe.aria.microsoft.com][bytes ratio: 0.502 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 9/18 48/49 17/20][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 800/428 1494/1506 681/581][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: a1674500365bdd882188db63730e69a2][Safari][Plen Bins: 5,5,5,0,0,0,5,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,53,10,0,0]
7 TCP 192.168.1.6:60559 <-> 52.114.77.33:443 [proto: 91.212/TLS.Microsoft][Encrypted][Confidence: DPI][cat: Cloud/13][21 pkts/15525 bytes <-> 12 pkts/5499 bytes][Goodput ratio: 91/85][0.35 sec][Hostname/SNI: mobile.pipe.aria.microsoft.com][bytes ratio: 0.477 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 17/21 52/51 22/22][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 739/458 1494/1506 682/595][Risk: ** TLS (probably) Not Carrying HTTPS **][Risk Score: 10][Risk Info: No ALPN][TLSv1.2][JA3C: a1674500365bdd882188db63730e69a2][Safari][Plen Bins: 5,5,5,0,0,0,5,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,5,0,0,0,0,0,0,0,0,0,0,0,5,0,0,52,11,0,0]
8 TCP 192.168.1.6:60545 <-> 52.114.77.58:443 [proto: 91.250/TLS.Teams][Encrypted][Confidence: DPI][cat: Collaborative/15][49 pkts/7568 bytes <-> 34 pkts/11426 bytes][Goodput ratio: 65/83][9.23 sec][Hostname/SNI: presence.teams.microsoft.com][ALPN: h2;http/1.1][bytes ratio: -0.203 (Download)][IAT c2s/s2c min/avg/max/stddev: 0/0 226/294 4927/4971 803/983][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 154/336 1494/1506 217/458][TLSv1.2][JA3C: ebf5e0e525258d7a8dcb54aa1564ecbd][Plen Bins: 0,21,17,10,8,6,4,0,6,2,0,0,2,6,2,0,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0]
9 TCP 192.168.1.6:60549 <-> 13.107.18.11:443 [proto: 91.219/TLS.Microsoft365][Encrypted][Confidence: DPI][cat: Collaborative/15][28 pkts/7696 bytes <-> 26 pkts/9797 bytes][Goodput ratio: 80/85][1.16 sec][Hostname/SNI: substrate.office.com][ALPN: h2;http/1.1][bytes ratio: -0.120 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/0 47/23 539/167 115/43][Pkt Len c2s/s2c min/avg/max/stddev: 54/60 275/377 1494/1506 397/471][TLSv1.2][JA3C: ebf5e0e525258d7a8dcb54aa1564ecbd][ServerNames: outlook.office.com,attachment.outlook.office.net,attachment.outlook.officeppe.net,bookings.office.com,delve.office.com,edge.outlook.office365.com,edgesdf.outlook.com,img.delve.office.com,outlook.live.com,outlook-sdf.live.com,outlook-sdf.office.com,sdfedge-pilot.outlook.com,substrate.office.com,substrate-sdf.office.com,afd-k-acdc-direct.office.com,beta-sdf.yammer.com,teams-sdf.yammer.com,beta.yammer.com,teams.yammer.com,attachments.office.net,attachments-sdf.office.net,afd-k.office.com,afd-k-sdf.office.com][JA3S: a66ea560599a2f5c89eec8c3a0d69cee][Issuer: C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1][Subject: C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Outlook.office.com][Certificate SHA-1: AA:D3:F5:66:06:48:AA:F8:8E:9B:79:D6:7F:1D:53:EA:3F:97:03:A2][Validity: 2019-07-12 00:00:00 - 2021-07-12 12:00:00][Cipher: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384][Plen Bins: 0,22,7,0,7,0,7,0,0,3,3,0,0,0,3,0,7,0,3,0,10,3,3,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,18,0,0]
diff --git a/tests/result/tls_2_reasms.pcapng.out b/tests/result/tls_2_reasms.pcapng.out
new file mode 100644
index 000000000..ef5621be8
--- /dev/null
+++ b/tests/result/tls_2_reasms.pcapng.out
@@ -0,0 +1,14 @@
+Guessed flow protos: 0
+
+DPI Packets (TCP): 4 (4.00 pkts/flow)
+Confidence DPI : 1 (flows)
+Num dissector calls: 7 (7.00 diss/flow)
+
+Instagram 14 6907 1
+
+JA3 Host Stats:
+ IP Address # JA3C
+ 1 192.91.186.174 1
+
+
+ 1 TCP 192.91.186.174:443 <-> 25.137.80.32:38134 [proto: 91.211/TLS.Instagram][Encrypted][Confidence: DPI][cat: SocialNetwork/6][11 pkts/4419 bytes <-> 3 pkts/2488 bytes][Goodput ratio: 83/92][0.95 sec][Hostname/SNI: i.instagram.com][ALPN: h2;h2-fb;http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.3 (Fizz)][bytes ratio: 0.280 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/15 105/232 465/449 152/217][Pkt Len c2s/s2c min/avg/max/stddev: 74/470 402/829 1414/1414 483/417][TLSv1.3 (Fizz)][JA3C: 44dab16d680ef93487bc16ad23b3ffb1][JA3S: fcb2d4d0991292272fcb1e464eedfd43][Firefox][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 7,0,24,7,0,7,7,7,0,0,0,0,7,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,24,0,0,0,0,0]
diff --git a/tests/result/tls_2_reasms_b.pcapng.out b/tests/result/tls_2_reasms_b.pcapng.out
new file mode 100644
index 000000000..5e96556c8
--- /dev/null
+++ b/tests/result/tls_2_reasms_b.pcapng.out
@@ -0,0 +1,14 @@
+Guessed flow protos: 0
+
+DPI Packets (TCP): 5 (5.00 pkts/flow)
+Confidence DPI : 1 (flows)
+Num dissector calls: 11 (11.00 diss/flow)
+
+Facebook 15 13455 1
+
+JA3 Host Stats:
+ IP Address # JA3C
+ 1 88.14.137.195 1
+
+
+ 1 TCP 88.14.137.195:443 <-> 196.234.165.216:37658 [proto: 91.119/TLS.Facebook][Encrypted][Confidence: DPI][cat: SocialNetwork/6][12 pkts/11078 bytes <-> 3 pkts/2377 bytes][Goodput ratio: 93/92][1.05 sec][Hostname/SNI: video.fmct2-3.fna.fbcdn.net][ALPN: http/1.1][TLS Supported Versions: TLSv1.3;TLSv1.3 (Fizz)][bytes ratio: 0.647 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/4 105/8 1002/12 299/4][Pkt Len c2s/s2c min/avg/max/stddev: 74/478 923/792 1414/1414 599/440][TLSv1.3 (Fizz)][JA3C: 44dab16d680ef93487bc16ad23b3ffb1][JA3S: fcb2d4d0991292272fcb1e464eedfd43][Firefox][Cipher: TLS_AES_128_GCM_SHA256][Plen Bins: 7,0,0,0,0,0,7,0,0,0,0,0,7,7,0,0,0,0,7,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,63,0,0,0,0,0]
diff --git a/tests/result/tls_missing_ch_frag.pcap.out b/tests/result/tls_missing_ch_frag.pcap.out
new file mode 100644
index 000000000..f6d4181e8
--- /dev/null
+++ b/tests/result/tls_missing_ch_frag.pcap.out
@@ -0,0 +1,13 @@
+Guessed flow protos: 0
+
+DPI Packets (TCP): 3 (3.00 pkts/flow)
+Confidence DPI : 1 (flows)
+Num dissector calls: 125 (125.00 diss/flow)
+
+TLS 14 10082 1
+
+JA3 Host Stats:
+ IP Address # JA3C
+
+
+ 1 TCP 10.10.10.1:443 <-> 192.168.0.1:33063 [proto: 91/TLS][Encrypted][Confidence: DPI][cat: Web/5][6 pkts/6525 bytes <-> 8 pkts/3557 bytes][Goodput ratio: 94/85][0.38 sec][bytes ratio: 0.294 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 40/13 161/59 70/23][Pkt Len c2s/s2c min/avg/max/stddev: 66/66 1088/445 2023/1090 747/434][TLSv1.3][JA3S: 907bf3ecef1c987c889946b737b43de8][Cipher: TLS_AES_256_GCM_SHA384][Plen Bins: 0,0,11,0,0,11,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,11,0,0,0,0,0,0,0,0,0,22,0,0,0,0,0,0,0,0,0,0,33,0,0,0,11]
Powered by cgit, Themed by Ted Yin.