diff options
| author | Luca Deri <lucaderi@users.noreply.github.com> | 2020-08-06 10:18:27 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-08-06 10:18:27 +0200 |
| commit | 95dfbdc64a48c3f8e57189499d5bb82b1b41ab09 (patch) | |
| tree | 4a1c4691805eb789b9284ca574f9bd3f6cfc7262 /src/lib | |
| parent | c2156a516193ada6fee37ab6b7a26f712ee02e14 (diff) | |
| parent | 79b89d286605635f15edfe3c21297aaa3b5f3acf (diff) | |
Merge pull request #973 from IvanNardi/esni3
Add risk flag about suspicious ESNI usage
Diffstat (limited to 'src/lib')
| -rw-r--r-- | src/lib/ndpi_utils.c | 5 | ||||
| -rw-r--r-- | src/lib/protocols/tls.c | 5 |
2 files changed, 9 insertions, 1 deletions
diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c index 00583dd26..0d2f5cf3c 100644 --- a/src/lib/ndpi_utils.c +++ b/src/lib/ndpi_utils.c @@ -1533,7 +1533,10 @@ const char* ndpi_risk2str(ndpi_risk_enum risk) { case NDPI_SMB_INSECURE_VERSION: return("SMB Insecure Version"); - + + case NDPI_TLS_SUSPICIOUS_ESNI_USAGE: + return("TLS Suspicious ESNI Usage"); + default: snprintf(buf, sizeof(buf), "%d", (int)risk); return(buf); diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c index 5642ebdf0..f96745dc6 100644 --- a/src/lib/protocols/tls.c +++ b/src/lib/protocols/tls.c @@ -1434,6 +1434,11 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct, NDPI_SET_BIT(flow->risk, NDPI_TLS_NOT_CARRYING_HTTPS); } + if(flow->protos.stun_ssl.ssl.encrypted_sni.esni && + flow->protos.stun_ssl.ssl.client_requested_server_name[0] != '\0') { + NDPI_SET_BIT(flow->risk, NDPI_TLS_SUSPICIOUS_ESNI_USAGE); + } + return(2 /* Client Certificate */); } else { #ifdef DEBUG_TLS |