Tiny changes for TLS block lenght dissection

4 files changed, 37 insertions, 29 deletions

diff --git a/src/include/ndpi_define.h.in b/src/include/ndpi_define.h.in
index 9c1c0c169..990f84bf4 100644
--- a/src/include/ndpi_define.h.in
+++ b/src/include/ndpi_define.h.in
@@ -353,7 +353,7 @@
 
 #define NDPI_OPTIMAL_HLL_NUM_BUCKETS           16
 
-#define NDPI_MAX_NUM_DISSECTED_TLS_BLOCKS      32
+#define NDPI_MAX_NUM_TLS_APPL_BLOCKS            8
 
 #ifdef __APPLE__
 
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 58d7b4885..55fa370c9 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -670,7 +670,7 @@ struct ndpi_flow_tcp_struct {
     u_int8_t hello_processed:1, certificate_processed:1, subprotocol_detected:1,
 	fingerprint_set:1, _pad:4;
     u_int8_t sha1_certificate_fingerprint[20], num_tls_blocks;
-    u_int16_t tls_blocks_len[NDPI_MAX_NUM_DISSECTED_TLS_BLOCKS];
+    int16_t tls_application_blocks_len[NDPI_MAX_NUM_TLS_APPL_BLOCKS]; /* + = src->dst, - = dst->src */
   } tls;
   
   /* NDPI_PROTOCOL_POSTGRES */
@@ -947,6 +947,7 @@ typedef enum {
 
 typedef enum {
    ndpi_pref_direction_detect_disable = 0,
+   ndpi_pref_enable_tls_block_dissection
 } ndpi_detection_preference;
 
 /* ntop extensions */
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 3ca766772..db84efa00 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -596,6 +596,10 @@ int ndpi_set_detection_preferences(struct ndpi_detection_module_struct *ndpi_str
     ndpi_str->direction_detect_disable = (u_int8_t) value;
     break;
 
+  case ndpi_pref_enable_tls_block_dissection:
+    ndpi_str->num_tls_blocks_to_follow = NDPI_MAX_NUM_TLS_APPL_BLOCKS;
+    break;
+
   default:
     return(-1);
   }
@@ -6370,6 +6374,7 @@ u_int8_t ndpi_extra_dissection_possible(struct ndpi_detection_module_struct *ndp
   case NDPI_PROTOCOL_TLS:
     if((!flow->l4.tcp.tls.certificate_processed)
        || (flow->l4.tcp.tls.num_tls_blocks <= ndpi_str->num_tls_blocks_to_follow)) {
+      // printf("*** %u/%u\n", flow->l4.tcp.tls.num_tls_blocks, ndpi_str->num_tls_blocks_to_follow);
       return(1); /* TODO: add check for TLS 1.3 */
     }
     break;
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 20ac8c542..9085774f4 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -593,9 +593,13 @@ int processCertificate(struct ndpi_detection_module_struct *ndpi_struct,
   }
 
   if(flow->l4.tcp.tls.num_tls_blocks >= ndpi_struct->num_tls_blocks_to_follow) {
-    flow->extra_packets_func = NULL; /* We're good now */
+#ifdef DEBUG_TLS_BLOCKS
+    printf("*** [TLS Block] Enough blocks dissected\n");
+#endif
+    
+    flow->extra_packets_func = NULL; /* We're good now */  
   }
-
+  
   return(1);
 }
 
@@ -649,10 +653,11 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
   while(!something_went_wrong) {
     u_int16_t len, p_len;
     const u_int8_t *p;
-
+    u_int8_t content_type;
+      
     if(flow->l4.tcp.tls.message.buffer_used < 5)
       return(1); /* Keep working */
-
+    
     len = (flow->l4.tcp.tls.message.buffer[3] << 8) + flow->l4.tcp.tls.message.buffer[4] + 5;
 
     if(len > flow->l4.tcp.tls.message.buffer_used) {
@@ -677,10 +682,14 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
     printf("[TLS Mem] Processing %u bytes message\n", len);
 #endif
 
+    content_type = flow->l4.tcp.tls.message.buffer[0];
+    
     /* Overwriting packet payload */
     p = packet->payload, p_len = packet->payload_packet_len; /* Backup */
 
-    if((len > 9) && (!flow->l4.tcp.tls.certificate_processed)) {
+    if((len > 9)
+       && (content_type != 0x17 /* Application Data */)
+       && (!flow->l4.tcp.tls.certificate_processed)) {
       /* Split the element in blocks */
       u_int16_t processed = 5;
 
@@ -701,32 +710,20 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
 	  break;
 	}
 
-#ifdef DEBUG_TLS_MEMORY
-	printf("*** [TLS Mem] Processing %u bytes block [%02X %02X %02X %02X %02X]\n",
-	       packet->payload_packet_len,
-	       packet->payload[0], packet->payload[1], packet->payload[2], packet->payload[3], packet->payload[4]);
-#endif
-
-	processTLSBlock(ndpi_struct, flow);
-	if(flow->l4.tcp.tls.num_tls_blocks < ndpi_struct->num_tls_blocks_to_follow)
-	  flow->l4.tcp.tls.tls_blocks_len[flow->l4.tcp.tls.num_tls_blocks++] = packet->payload_packet_len;
-
-#ifdef DEBUG_TLS_BLOCKS
-	printf("*** [TLS Block] [len: %u][num_tls_blocks: %u]\n",
-	       packet->payload_packet_len, flow->l4.tcp.tls.num_tls_blocks);
-#endif
-
 	processed += packet->payload_packet_len;
       }
     } else {
       /* Process element as a whole */
-      if(flow->l4.tcp.tls.num_tls_blocks < ndpi_struct->num_tls_blocks_to_follow)
-	flow->l4.tcp.tls.tls_blocks_len[flow->l4.tcp.tls.num_tls_blocks++] = len-5;
-      
+      if(content_type == 0x17 /* Application Data */) {
+	if(flow->l4.tcp.tls.num_tls_blocks < ndpi_struct->num_tls_blocks_to_follow)
+	  flow->l4.tcp.tls.tls_application_blocks_len[flow->l4.tcp.tls.num_tls_blocks++] =
+	    (packet->packet_direction == 0) ? (len-5) : -(len-5);
+	
 #ifdef DEBUG_TLS_BLOCKS
-      printf("*** [TLS Block] [len: %u][num_tls_blocks: %u]\n",
-	     len-5, flow->l4.tcp.tls.num_tls_blocks);
+	printf("*** [TLS Block] [len: %u][num_tls_blocks: %u/%u]\n",
+	       len-5, flow->l4.tcp.tls.num_tls_blocks, ndpi_struct->num_tls_blocks_to_follow);
 #endif
+      }
     }
 
     packet->payload = p, packet->payload_packet_len = p_len; /* Restore */
@@ -744,7 +741,12 @@ static int ndpi_search_tls_tcp(struct ndpi_detection_module_struct *ndpi_struct,
 #endif
   }
 
-  if(something_went_wrong) {
+  if(something_went_wrong
+     || (flow->l4.tcp.tls.num_tls_blocks == ndpi_struct->num_tls_blocks_to_follow)
+     ) {
+#ifdef DEBUG_TLS_BLOCKS
+    printf("*** [TLS Block] No more blocks\n");
+#endif
     flow->check_extra_packets = 0;
     flow->extra_packets_func = NULL;
     return(0); /* That's all */
@@ -809,7 +811,7 @@ static void tlsInitExtraPacketProcessing(struct ndpi_detection_module_struct *nd
   flow->check_extra_packets = 1;
 
   /* At most 12 packets should almost always be enough to find the server certificate if it's there */
-  flow->max_extra_packets_to_check = 12 + (ndpi_struct->num_tls_blocks_to_follow*2);
+  flow->max_extra_packets_to_check = 12 + (ndpi_struct->num_tls_blocks_to_follow*4);
   flow->extra_packets_func = (flow->packet.udp != NULL) ? ndpi_search_tls_udp : ndpi_search_tls_tcp;
 }