if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {

ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TLS, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI_AGGRESSIVE);

} else {

flow->confidence = NDPI_CONFIDENCE_DPI_AGGRESSIVE; /* Update the value */

if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_TLS ||

flow->detected_protocol_stack[1] == NDPI_PROTOCOL_TLS)

else

}

ndpi_protocol ret = { { __get_master(ndpi_struct, flow), NDPI_PROTOCOL_UNKNOWN }, NDPI_PROTOCOL_UNKNOWN /* unused */, NDPI_PROTOCOL_CATEGORY_UNSPECIFIED, NULL};

char str[64];

snprintf(str, sizeof(str), "Invalid issuerDN %s", flow->protos.tls_quic.issuerDN);

}

}

snprintf(str, sizeof(str), "TLS Cert lasts %u days",

(flow->protos.tls_quic.notAfter-flow->protos.tls_quic.notBefore) / 86400);

}

if((time_sec < flow->protos.tls_quic.notBefore) || (time_sec > flow->protos.tls_quic.notAfter)) {

strftime(e, sizeof(e), "%d/%b/%Y %H:%M:%S", ndpi_gmtime_r(&theTime, &result));

snprintf(str, sizeof(str), "%s - %s", b, e);

} else if((time_sec > flow->protos.tls_quic.notBefore)

&& (time_sec > (flow->protos.tls_quic.notAfter - (ndpi_struct->cfg.tls_certificate_expire_in_x_days * 86400)))) {

char str[96], b[32], e[32];

strftime(e, sizeof(e), "%d/%b/%Y %H:%M:%S", ndpi_gmtime_r(&theTime, &result));

snprintf(str, sizeof(str), "%s - %s", b, e);

}

}

}

here that will create false positives

*/

if(ndpi_normalize_printable_string(dNSName, dNSName_len) == 0) {

/* This looks like an attack */

}

if(matched_name == 0) {

#if DEBUG_TLS

printf("[TLS] Leftover %u bytes", packet->payload_packet_len - i);

#endif

break;

}

} else {

char str[128];

snprintf(str, sizeof(str), "%s vs %s", flow->host_server_name, flow->protos.tls_quic.server_names);

}

}

}

return; /* This is a trusted DN */

if(!flow->protos.tls_quic.webrtc)

}

#if DEBUG_TLS

if((packet->payload_packet_len != (length + 4 + (is_dtls ? 8 : 0))) || (packet->payload[1] != 0x0) ||

certificates_offset >= packet->payload_packet_len) {

return(-1); /* Invalid length */

}

packet->payload[certificates_offset - 1];

if((packet->payload[certificates_offset - 3] != 0x0) || ((certificates_length+3) != length)) {

return(-2); /* Invalid length */

}

u_int16_t rc1 = ndpi_hash_find_entry(ndpi_struct->malicious_sha1_hashmap, sha1_str, sha1_siz * 2, NULL);

if(rc1 == 0)

}

}

u_int8_t alert_level = message->buffer[5];

if(alert_level == 2 /* Warning (1), Fatal (2) */)

}

u_int16_t const alert_len = ntohs(*(u_int16_t const *)&message->buffer[3]);

u_int8_t alert_level = block[13];

if(alert_level == 2 /* Warning (1), Fatal (2) */)

}

} else {

#ifdef DEBUG_TLS

str[str_len - 1] = '\0';

}

break;

}

printf("[TLS] extension length exceeds remaining packet length: %u > %u.\n",

extension_len, packet->payload_packet_len - extension_payload_offset);

#endif

return;

}

#ifdef DEBUG_TLS

printf("[TLS] suspicious extension id: %u\n", extension_id);

#endif

return;

}

}

#ifdef DEBUG_TLS

printf("[TLS] suspicious DTLS-only extension id: %u\n", extension_id);

#endif

return;

}

}

char unknown_cipher[8];

snprintf(str, sizeof(str), "Cipher %s", ndpi_cipher2str(ja.server.cipher[0], unknown_cipher));

}

flow->protos.tls_quic.server_cipher = ja.server.cipher[0];

s_offset += alpn_len, alpn_str_len += alpn_len;;

} else {

alpn_str[alpn_str_len] = '\0';

break;

}

} else {

alpn_str[alpn_str_len] = '\0';

break;

}

} /* while */

printf("Server TLS [ALPN: %s][len: %u]\n", alpn_str, alpn_str_len);

#endif

if(ndpi_normalize_printable_string(alpn_str, alpn_str_len) == 0)

if(flow->protos.tls_quic.negotiated_alpn == NULL)

flow->protos.tls_quic.negotiated_alpn = ndpi_strdup(alpn_str);

snprintf(str, sizeof(str), "%s", ndpi_ssl_version2str(buf, sizeof(buf),

flow->protos.tls_quic.ssl_version,

&unknown_tls_version));

}

if((session_id_len+base_offset+3) > packet->payload_packet_len)

printf("[TLS] SNI: [%s]\n", sni);

#endif

if(ndpi_is_valid_hostname((char *)&packet->payload[offset+extension_offset+5], len) == 0) {

/* This looks like an attack */

}

if(!is_quic) {

if((flow->protos.tls_quic.subprotocol_detected == 0)

&& (check_sni_is_numeric_ip(sni) == 1)) {

}

if(ndpi_check_dga_name(ndpi_struct, flow, sni, 1, 0)) {

}

} else if(extension_id == 65486 /* encrypted server name */) {

/* ESNI has been superseded by ECH */

} else if(extension_id == 65037 /* ECH: latest drafts */) {

#ifdef DEBUG_TLS

printf("Client TLS: ECH version 0x%x\n", extension_id);

#ifdef DEBUG_TLS

printf("Padding length: %d\n", extension_len);

#endif

}

}

NULL);

if(rc1 == 0)

}

}

if((flow->protos.tls_quic.ssl_version >= 0x0303) /* >= TLSv1.2 */

&& !flow->protos.tls_quic.webrtc

&& (flow->protos.tls_quic.advertised_alpns == NULL) /* No ALPN */) {

}

/* Add check for missing SNI */

&& !flow->protos.tls_quic.webrtc

) {

/* This is a bit suspicious */

if(flow->protos.tls_quic.advertised_alpns != NULL) {

char buf[256], *tmp, *item;

while(item != NULL) {

if(item[0] == 'h') {

/* Example 'h2' */

break;

} else

item = strtok_r(NULL, ",", &tmp);