Rework how hostname/SNI info is saved (#1330)

Looking at `struct ndpi_flow_struct` the two bigger fields are
`host_server_name[240]` (mainly for HTTP hostnames and DNS domains) and
`protos.tls_quic.client_requested_server_name[256]`
(for TLS/QUIC SNIs).

This commit aims to reduce `struct ndpi_flow_struct` size, according to
two simple observations:
 1) maximum one of these two fields is used for each flow. So it seems safe
to merge them;
 2) even if hostnames/SNIs might be very long, in practice they are rarely
longer than a fews tens of bytes. So, using a (single) large buffer is a
waste of memory for all kinds of flows. If we need to truncate the name,
we keep the *last* characters, easing domain matching.

Analyzing some real traffic, it seems safe to assume that the vast
majority of hostnames/SNIs is shorter than 80 bytes.

Hostnames/SNIs are always converted to lowercase.

Attention was given so as to be sure that unit-tests outputs are not
affected by this change.

Because of a bug, TLS/QUIC SNI were always truncated to 64 bytes (the
*first* 64 ones): as a consequence, there were some "Suspicious DGA
domain name" and "TLS Certificate Mismatch" false positives.

1 files changed, 5 insertions, 9 deletions

diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index f0884fae3..1ffa8afef 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -349,25 +349,21 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
 	    u_int16_t realm_len = ntohs(*((u_int16_t*)&payload[offset+2]));
 
 	    if(flow->host_server_name[0] == '\0') {
-	      u_int i;
 	      u_int k = offset+4;
 
-	      i = ndpi_min(realm_len, sizeof(flow->host_server_name) - 1);
-	      i = ndpi_min(i, payload_length - k);
-	      memcpy(flow->host_server_name, payload + k, i);
-	      flow->host_server_name[i] = '\0';
-	    
+	      ndpi_hostname_sni_set(flow, payload + k, ndpi_min(realm_len, payload_length - k));
+
 #ifdef DEBUG_STUN
 	      printf("==> [%s]\n", flow->host_server_name);
 #endif
 
-	      if(strstr((char*) flow->host_server_name, "google.com") != NULL) {
+	      if(strstr(flow->host_server_name, "google.com") != NULL) {
                 flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO;
                 return(NDPI_IS_STUN);
-	      } else if(strstr((char*) flow->host_server_name, "whispersystems.org") != NULL) {
+	      } else if(strstr(flow->host_server_name, "whispersystems.org") != NULL) {
 		flow->guessed_host_protocol_id = NDPI_PROTOCOL_SIGNAL;
 		return(NDPI_IS_STUN);
-	      } else if(strstr((char*) flow->host_server_name, "facebook") != NULL) {
+	      } else if(strstr(flow->host_server_name, "facebook") != NULL) {
 		flow->guessed_host_protocol_id = NDPI_PROTOCOL_MESSENGER;
 		return(NDPI_IS_STUN);
 	      }