diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2025-03-25 16:59:32 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-03-25 16:59:32 +0100 |
| commit | a8ddc4d368a17eeb4d466dbcb6996d1630aee50d (patch) | |
| tree | cc5aa13aec5a93bb0e9abde3467ba69f4f574850 /src/lib/protocols/tls.c | |
| parent | f2be78561b3382b0be4b79dd55bbde6d5047ba1d (diff) | |
Remove `NDPI_TLS_SUSPICIOUS_ESNI_USAGE` flow risk (#2778)
That flow risk was introduced in 79b89d286605635f15edfe3c21297aaa3b5f3acf
but we can now use the generic `NDPI_TLS_SUSPICIOUS_EXTENSION` instead:
ESNI is quite suspicious nowadays in itself (i.e. even without SNI).
Note that ESNI support has been removed in cae9fb9989838f213eeb857b8fc4bbeac6940049
Diffstat (limited to 'src/lib/protocols/tls.c')
| -rw-r--r-- | src/lib/protocols/tls.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index c45d42de1..6e010ef62 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -2007,7 +2007,7 @@ static void checkExtensions(struct ndpi_detection_module_struct *ndpi_struct, /* see: https://www.wireshark.org/docs/wsar_html/packet-tls-utils_8h_source.html */ static u_int16_t const allowed_non_iana_extensions[] = { - 65486 /* ESNI */, 13172 /* NPN - Next Proto Neg */, 17513 /* ALPS */, + /* 65486 ESNI is suspicious nowadays */ 13172 /* NPN - Next Proto Neg */, 17513 /* ALPS */, 30032 /* Channel ID */, 65445 /* QUIC transport params */, /* GREASE extensions */ 2570, 6682, 10794, 14906, 19018, 23130, 27242, @@ -3220,9 +3220,6 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, ndpi_struct->cfg.tls_versions_supported_enabled) flow->protos.tls_quic.tls_supported_versions = ndpi_strdup(version_str); } - } else if(extension_id == 65486 /* encrypted server name */) { - /* ESNI has been superseded by ECH */ - ndpi_set_risk(ndpi_struct, flow, NDPI_TLS_SUSPICIOUS_ESNI_USAGE, NULL); } else if(extension_id == 65037 /* ECH: latest drafts */) { #ifdef DEBUG_TLS printf("Client TLS: ECH version 0x%x\n", extension_id); |