diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2021-08-20 18:11:37 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-08-20 18:11:37 +0200 |
| commit | 9e0f0ce3df69023bc2acca5536efca134363380e (patch) | |
| tree | 4a5ac39d201e66ed35c4317b2a27e329299d9c76 /python | |
| parent | 8fdffbf3a17ebfc8e7043264cce516d23e9f5345 (diff) | |
Fix access to some TLS fields in flow structure (#1277)
Fields 'tls.hello_processed` and `tls.subprotocol_detected` are used by
QUIC (i.e UDP...), too.
Diffstat (limited to 'python')
| -rw-r--r-- | python/ndpi.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/python/ndpi.py b/python/ndpi.py index 3a4ba0f13..8746e4f71 100644 --- a/python/ndpi.py +++ b/python/ndpi.py @@ -597,7 +597,7 @@ struct ndpi_flow_tcp_struct { void* srv_cert_fingerprint_ctx; /* SHA-1 */ /* NDPI_PROTOCOL_TLS */ - uint8_t hello_processed:1, certificate_processed:1, subprotocol_detected:1, fingerprint_set:1, _pad:4; + uint8_t certificate_processed:1, fingerprint_set:1, _pad:6; uint8_t sha1_certificate_fingerprint[20], num_tls_blocks; int16_t tls_application_blocks_len[NDPI_MAX_NUM_TLS_APPL_BLOCKS]; } tls; @@ -1117,6 +1117,8 @@ struct ndpi_flow_struct { uint32_t notBefore, notAfter; char ja3_client[33], ja3_server[33]; uint16_t server_cipher; + u_int8_t sha1_certificate_fingerprint[20]; + u_int8_t hello_processed:1, subprotocol_detected:1, _pad:6; struct { uint16_t cipher_suite; char *esni; |