aboutsummaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
Diffstat (limited to 'src')
-rw-r--r--src/include/ndpi_main.h3
-rw-r--r--src/include/ndpi_typedefs.h11
-rw-r--r--src/lib/ndpi_main.c55
-rw-r--r--src/lib/ndpi_utils.c21
-rw-r--r--src/lib/protocols/dhcp.c11
-rw-r--r--src/lib/protocols/dns.c54
-rw-r--r--src/lib/protocols/http.c10
-rw-r--r--src/lib/protocols/mail_smtp.c11
-rw-r--r--src/lib/protocols/netbios.c4
-rw-r--r--src/lib/protocols/quic.c20
-rw-r--r--src/lib/protocols/stun.c14
-rw-r--r--src/lib/protocols/tls.c71
-rw-r--r--src/lib/protocols/whoisdas.c5
13 files changed, 129 insertions, 161 deletions
diff --git a/src/include/ndpi_main.h b/src/include/ndpi_main.h
index 66fb5ea1b..190bdc45a 100644
--- a/src/include/ndpi_main.h
+++ b/src/include/ndpi_main.h
@@ -155,6 +155,9 @@ extern "C" {
void load_common_alpns(struct ndpi_detection_module_struct *ndpi_str);
u_int8_t is_a_common_alpn(struct ndpi_detection_module_struct *ndpi_str,
const char *alpn_to_check, u_int alpn_to_check_len);
+
+ char *ndpi_hostname_sni_set(struct ndpi_flow_struct *flow, const u_int8_t *value, size_t value_len);
+
#ifdef __cplusplus
}
#endif
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 3d6e0dd65..c6e79a951 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -1193,8 +1193,14 @@ struct ndpi_flow_struct {
/* Place textual flow info here */
char flow_extra_info[16];
- /* HTTP host or DNS query */
- u_char host_server_name[240];
+ /* General purpose field used to save mainly hostname/SNI information.
+ * In details it used for: DNS and NETBIOS name, HTTP and DHCP hostname,
+ * WHOIS request, TLS/QUIC server name and STUN realm.
+ *
+ * Please, think *very* hard before increasing its size!
+ */
+ char host_server_name[80];
+
u_int8_t initial_binary_bytes[8], initial_binary_bytes_len;
u_int8_t risk_checked:1, ip_risk_mask_evaluated:1, host_risk_mask_evaluated:1, _notused:5;
ndpi_risk risk_mask; /* Stores the flow risk mask for flow peers */
@@ -1262,7 +1268,6 @@ struct ndpi_flow_struct {
struct {
char ssl_version_str[12];
u_int16_t ssl_version, server_names_len;
- char client_requested_server_name[256]; /* SNI hostname length: RFC 4366 */
char *server_names, *alpn, *tls_supported_versions, *issuerDN, *subjectDN;
u_int32_t notBefore, notAfter;
char ja3_client[33], ja3_server[33];
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 993aac969..d417d247e 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -4916,7 +4916,7 @@ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_st
ndpi_set_detected_protocol(ndpi_str, flow, flow->guessed_protocol_id, NDPI_PROTOCOL_UNKNOWN);
}
else if((flow->protos.tls_quic.hello_processed == 1) &&
- (flow->protos.tls_quic.client_requested_server_name[0] != '\0')) {
+ (flow->host_server_name[0] != '\0')) {
*protocol_was_guessed = 1;
ndpi_set_detected_protocol(ndpi_str, flow, NDPI_PROTOCOL_TLS, NDPI_PROTOCOL_UNKNOWN);
} else if(enable_guess) {
@@ -5198,21 +5198,8 @@ void ndpi_fill_protocol_category(struct ndpi_detection_module_struct *ndpi_str,
if(flow->host_server_name[0] != '\0') {
u_int32_t id;
- int rc = ndpi_match_custom_category(ndpi_str, (char *) flow->host_server_name,
- strlen((char *) flow->host_server_name), &id);
-
- if(rc == 0) {
- flow->category = ret->category = (ndpi_protocol_category_t) id;
- return;
- }
- }
-
- if(flow->protos.tls_quic.hello_processed == 1 &&
- flow->protos.tls_quic.client_requested_server_name[0] != '\0') {
- u_int32_t id;
- int rc = ndpi_match_custom_category(ndpi_str, (char *) flow->protos.tls_quic.client_requested_server_name,
- strlen(flow->protos.tls_quic.client_requested_server_name), &id);
-
+ int rc = ndpi_match_custom_category(ndpi_str, flow->host_server_name,
+ strlen(flow->host_server_name), &id);
if(rc == 0) {
flow->category = ret->category = (ndpi_protocol_category_t) id;
return;
@@ -5389,7 +5376,7 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
struct ndpi_id_struct *src, struct ndpi_id_struct *dst) {
struct ndpi_packet_struct *packet = &ndpi_str->packet;
NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_packet;
- u_int32_t a, num_calls = 0;
+ u_int32_t num_calls = 0;
ndpi_protocol ret = { flow->detected_protocol_stack[1], flow->detected_protocol_stack[0], flow->category };
if(ndpi_str->ndpi_log_level >= NDPI_LOG_TRACE)
@@ -5467,23 +5454,6 @@ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct
num_calls = ndpi_check_flow_func(ndpi_str, flow, &ndpi_selection_packet);
- a = flow->detected_protocol_stack[0];
- if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_str->detection_bitmask, a) == 0)
- a = NDPI_PROTOCOL_UNKNOWN;
-
- if(a != NDPI_PROTOCOL_UNKNOWN) {
- unsigned int i;
-
- for(i = 0; i < sizeof(flow->host_server_name); i++) {
- if(flow->host_server_name[i] != '\0')
- flow->host_server_name[i] = tolower(flow->host_server_name[i]);
- else {
- flow->host_server_name[i] = '\0';
- break;
- }
- }
- }
-
ret_protocols:
if(flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN) {
ret.master_protocol = flow->detected_protocol_stack[1], ret.app_protocol = flow->detected_protocol_stack[0];
@@ -7783,3 +7753,20 @@ int ndpi_check_dga_name(struct ndpi_detection_module_struct *ndpi_str,
ndpi_risk_info* ndpi_risk2severity(ndpi_risk_enum risk) {
return(&ndpi_known_risks[risk]);
}
+
+/* ******************************************************************** */
+
+char *ndpi_hostname_sni_set(struct ndpi_flow_struct *flow, const u_int8_t *value, size_t value_len)
+{
+ char *dst;
+ size_t len, i;
+
+ len = ndpi_min(value_len, sizeof(flow->host_server_name) - 1);
+ dst = flow->host_server_name;
+
+ for(i = 0; i < len; i++)
+ dst[i] = tolower(value[value_len - len + i]);
+ dst[i] = '\0';
+
+ return dst;
+}
diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c
index 626f5ade3..14be40d86 100644
--- a/src/lib/ndpi_utils.c
+++ b/src/lib/ndpi_utils.c
@@ -862,12 +862,12 @@ static const char* ndpi_get_flow_info_by_proto_id(struct ndpi_flow_struct const
{
case NDPI_PROTOCOL_DNS:
case NDPI_PROTOCOL_HTTP:
- return (char const *)flow->host_server_name;
+ return flow->host_server_name;
case NDPI_PROTOCOL_QUIC:
case NDPI_PROTOCOL_TLS:
if (flow->protos.tls_quic.hello_processed != 0)
{
- return flow->protos.tls_quic.client_requested_server_name;
+ return flow->host_server_name;
}
break;
}
@@ -1150,7 +1150,7 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
switch(l7_protocol.master_protocol ? l7_protocol.master_protocol : l7_protocol.app_protocol) {
case NDPI_PROTOCOL_DHCP:
ndpi_serialize_start_of_block(serializer, "dhcp");
- ndpi_serialize_string_string(serializer, "hostname", (const char*)flow->host_server_name);
+ ndpi_serialize_string_string(serializer, "hostname", flow->host_server_name);
ndpi_serialize_string_string(serializer, "fingerprint", flow->protos.dhcp.fingerprint);
ndpi_serialize_string_string(serializer, "class_ident", flow->protos.dhcp.class_ident);
ndpi_serialize_end_of_block(serializer);
@@ -1179,7 +1179,7 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
case NDPI_PROTOCOL_DNS:
ndpi_serialize_start_of_block(serializer, "dns");
if(flow->host_server_name[0] != '\0')
- ndpi_serialize_string_string(serializer, "query", (const char*)flow->host_server_name);
+ ndpi_serialize_string_string(serializer, "query", flow->host_server_name);
ndpi_serialize_string_uint32(serializer, "num_queries", flow->protos.dns.num_queries);
ndpi_serialize_string_uint32(serializer, "num_answers", flow->protos.dns.num_answers);
ndpi_serialize_string_uint32(serializer, "reply_code", flow->protos.dns.reply_code);
@@ -1200,7 +1200,7 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
case NDPI_PROTOCOL_MDNS:
ndpi_serialize_start_of_block(serializer, "mdns");
- ndpi_serialize_string_string(serializer, "answer", (const char*)flow->host_server_name);
+ ndpi_serialize_string_string(serializer, "answer", flow->host_server_name);
ndpi_serialize_end_of_block(serializer);
break;
@@ -1228,7 +1228,7 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
case NDPI_PROTOCOL_HTTP:
ndpi_serialize_start_of_block(serializer, "http");
if(flow->host_server_name[0] != '\0')
- ndpi_serialize_string_string(serializer, "hostname", (const char*)flow->host_server_name);
+ ndpi_serialize_string_string(serializer, "hostname", flow->host_server_name);
if(flow->http.url != NULL){
ndpi_serialize_string_string(serializer, "url", flow->http.url);
ndpi_serialize_string_uint32(serializer, "code", flow->http.response_status_code);
@@ -1240,9 +1240,9 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
case NDPI_PROTOCOL_QUIC:
ndpi_serialize_start_of_block(serializer, "quic");
- if(flow->protos.tls_quic.client_requested_server_name[0] != '\0')
+ if(flow->host_server_name[0] != '\0')
ndpi_serialize_string_string(serializer, "client_requested_server_name",
- flow->protos.tls_quic.client_requested_server_name);
+ flow->host_server_name);
if(flow->protos.tls_quic.server_names)
ndpi_serialize_string_string(serializer, "server_names", flow->protos.tls_quic.server_names);
if(flow->http.user_agent)
@@ -1318,7 +1318,7 @@ int ndpi_dpi2json(struct ndpi_detection_module_struct *ndpi_struct,
ndpi_serialize_start_of_block(serializer, "tls");
ndpi_serialize_string_string(serializer, "version", version);
ndpi_serialize_string_string(serializer, "client_requested_server_name",
- flow->protos.tls_quic.client_requested_server_name);
+ flow->host_server_name);
if(flow->protos.tls_quic.server_names)
ndpi_serialize_string_string(serializer, "server_names", flow->protos.tls_quic.server_names);
@@ -2199,9 +2199,6 @@ char* ndpi_get_flow_name(struct ndpi_flow_struct *flow) {
if(flow->host_server_name[0] != '\0')
return((char*)flow->host_server_name);
- if(flow->protos.tls_quic.client_requested_server_name[0] != '\0')
- return(flow->protos.tls_quic.client_requested_server_name);
-
no_flow_info:
return((char*)"");
}
diff --git a/src/lib/protocols/dhcp.c b/src/lib/protocols/dhcp.c
index d40bb5c35..23d358b74 100644
--- a/src/lib/protocols/dhcp.c
+++ b/src/lib/protocols/dhcp.c
@@ -159,17 +159,14 @@ void ndpi_search_dhcp_udp(struct ndpi_detection_module_struct *ndpi_struct, stru
strncpy((char*)flow->protos.dhcp.class_ident, name, j);
flow->protos.dhcp.class_ident[j] = '\0';
} else if(id == 12 /* Host Name */) {
- char *name = (char*)&dhcp->options[i+2];
- int j = 0;
-
+ u_int8_t *name = &dhcp->options[i+2];
+
#ifdef DHCP_DEBUG
NDPI_LOG_DBG2(ndpi_struct, "[DHCP] '%.*s'\n",name,len);
// while(j < len) { printf( "%c", name[j]); j++; }; printf("\n");
#endif
- j = ndpi_min(len, sizeof(flow->host_server_name)-1);
- strncpy((char*)flow->host_server_name, name, j);
- flow->host_server_name[j] = '\0';
- }
+ ndpi_hostname_sni_set(flow, name, len);
+ }
i += len + 2;
}
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index 98c6bf142..eb5af5a34 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -368,6 +368,7 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
int invalid = search_valid_dns(ndpi_struct, flow, &dns_header, payload_offset, &is_query);
ndpi_protocol ret;
u_int num_queries, idx;
+ char _hostname[256];
ret.master_protocol = NDPI_PROTOCOL_UNKNOWN;
ret.app_protocol = (d_port == LLMNR_PORT) ? NDPI_PROTOCOL_LLMNR : ((d_port == MDNS_PORT) ? NDPI_PROTOCOL_MDNS : NDPI_PROTOCOL_DNS);
@@ -378,7 +379,6 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
}
/* extract host name server */
- max_len = sizeof(flow->host_server_name)-1;
off = sizeof(struct ndpi_dns_packet_header) + payload_offset;
/* Before continuing let's dissect the following queries to see if they are valid */
@@ -434,6 +434,7 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
} /* for */
u_int8_t hostname_is_valid = 1;
+ max_len = sizeof(_hostname)-1;
while((j < max_len) && (off < packet->payload_packet_len) && (packet->payload[off] != '\0')) {
uint8_t c, cl = packet->payload[off++];
@@ -443,40 +444,43 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
break;
}
- if(j && (j < max_len)) flow->host_server_name[j++] = '.';
-
- while((j < max_len) && (cl != 0)) {
- u_int32_t shift;
-
- c = packet->payload[off++];
- shift = ((u_int32_t) 1) << (c & 0x1f);
- if ((dns_validchar[c >> 5] & shift)) {
- flow->host_server_name[j++] = tolower(c);
- } else {
- if (isprint(c) == 0) {
- hostname_is_valid = 0;
- flow->host_server_name[j++] = '?';
- } else {
- flow->host_server_name[j++] = '_';
- }
- }
- cl--;
- }
+ if(j && (j < max_len)) _hostname[j++] = '.';
+
+ while((j < max_len) && (cl != 0)) {
+ u_int32_t shift;
+
+ c = packet->payload[off++];
+ shift = ((u_int32_t) 1) << (c & 0x1f);
+ if((dns_validchar[c >> 5] & shift)) {
+ _hostname[j++] = tolower(c);
+ } else {
+ if (isprint(c) == 0) {
+ hostname_is_valid = 0;
+ _hostname[j++] = '?';
+ } else {
+ _hostname[j++] = '_';
+ }
+ }
+ cl--;
+ }
}
+
+ _hostname[j] = '\0';
+
+ ndpi_hostname_sni_set(flow, (const u_int8_t *)_hostname, j);
+
if (hostname_is_valid == 0) {
ndpi_set_risk(ndpi_struct, flow, NDPI_INVALID_CHARACTERS);
}
- flow->host_server_name[j] = '\0';
-
if(j > 0) {
ndpi_protocol_match_result ret_match;
- ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name, 1);
+ ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
ret.app_protocol = ndpi_match_host_subprotocol(ndpi_struct, flow,
- (char *)flow->host_server_name,
- strlen((const char*)flow->host_server_name),
+ flow->host_server_name,
+ strlen(flow->host_server_name),
&ret_match,
NDPI_PROTOCOL_DNS);
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index cef8b3cfc..bc0ca1fc2 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -371,8 +371,8 @@ static void ndpi_http_parse_subprotocol(struct ndpi_detection_module_struct *ndp
if(double_col) double_col[0] = '\0';
if(ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HTTP,
- (char *)flow->host_server_name,
- strlen((const char *)flow->host_server_name)) == 0) {
+ flow->host_server_name,
+ strlen(flow->host_server_name)) == 0) {
if(flow->http.url &&
((strstr(flow->http.url, ":8080/downloading?n=0.") != NULL)
|| (strstr(flow->http.url, ":8080/upload?n=0.") != NULL))) {
@@ -566,12 +566,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
packet->host_line.len, packet->host_line.ptr);
/* Copy result for nDPI apps */
- len = ndpi_min(packet->host_line.len, sizeof(flow->host_server_name)-1);
- strncpy((char*)flow->host_server_name, (char*)packet->host_line.ptr, len);
- flow->host_server_name[len] = '\0';
+ ndpi_hostname_sni_set(flow, packet->host_line.ptr, packet->host_line.len);
flow->extra_packets_func = NULL; /* We're good now */
- if(len > 0) ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name, 1);
+ if(strlen(flow->host_server_name) > 0) ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
if(packet->forwarded_line.ptr) {
len = ndpi_min(packet->forwarded_line.len, sizeof(flow->http.nat_ip)-1);
diff --git a/src/lib/protocols/mail_smtp.c b/src/lib/protocols/mail_smtp.c
index 31310202b..e1d98dd35 100644
--- a/src/lib/protocols/mail_smtp.c
+++ b/src/lib/protocols/mail_smtp.c
@@ -147,12 +147,11 @@ void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct,
&& (packet->line[a].ptr[i+1] != '\n')) {
len = i-4;
/* Copy result for nDPI apps */
- len = ndpi_min(len, sizeof(flow->host_server_name)-1);
- strncpy((char*)flow->host_server_name, (char*)&packet->line[a].ptr[4], len);
- flow->host_server_name[len] = '\0';
- if(ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAIL_SMTP,
- (char *)flow->host_server_name,
- strlen((const char *)flow->host_server_name))) {
+ ndpi_hostname_sni_set(flow, &packet->line[a].ptr[4], len);
+
+ if (ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAIL_SMTP,
+ flow->host_server_name,
+ strlen(flow->host_server_name))) {
/* We set the protocols; we need to initialize extra dissection
to search for credentials */
NDPI_LOG_DBG(ndpi_struct, "SMTP: hostname matched\n");
diff --git a/src/lib/protocols/netbios.c b/src/lib/protocols/netbios.c
index ccf910489..88c211551 100644
--- a/src/lib/protocols/netbios.c
+++ b/src/lib/protocols/netbios.c
@@ -102,9 +102,9 @@ static void ndpi_int_netbios_add_connection(struct ndpi_detection_module_struct
if((off < packet->payload_packet_len)
&& ndpi_netbios_name_interpret((unsigned char*)&packet->payload[off],
(u_int)(packet->payload_packet_len - off), name, sizeof(name)-1) > 0) {
- snprintf((char*)flow->host_server_name, sizeof(flow->host_server_name)-1, "%s", name);
+ ndpi_hostname_sni_set(flow, (const u_int8_t *)name, strlen((char *)name));
- ndpi_check_dga_name(ndpi_struct, flow, (char*)flow->host_server_name, 1);
+ ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
}
if(sub_protocol == NDPI_PROTOCOL_UNKNOWN)
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index 358edb064..6bae70524 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1324,7 +1324,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
uint32_t i;
uint16_t num_tags;
uint32_t prev_offset;
- uint32_t tag_offset_start, offset, len, sni_len;
+ uint32_t tag_offset_start, offset, len;
ndpi_protocol_match_result ret_match;
int sni_found = 0, ua_found = 0;
@@ -1356,22 +1356,20 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
crypto_data_len, tag_offset_start, prev_offset, offset, len);
#endif
if(memcmp(tag, "SNI\0", 4) == 0) {
- sni_len = MIN(len, sizeof(flow->protos.tls_quic.client_requested_server_name) - 1);
- memcpy(flow->protos.tls_quic.client_requested_server_name,
- &crypto_data[tag_offset_start + prev_offset], sni_len);
- flow->protos.tls_quic.client_requested_server_name[sni_len] = '\0';
+
+ ndpi_hostname_sni_set(flow, &crypto_data[tag_offset_start + prev_offset], len);
NDPI_LOG_DBG2(ndpi_struct, "SNI: [%s]\n",
- flow->protos.tls_quic.client_requested_server_name);
+ flow->host_server_name);
ndpi_match_host_subprotocol(ndpi_struct, flow,
- (char *)flow->protos.tls_quic.client_requested_server_name,
- strlen((const char*)flow->protos.tls_quic.client_requested_server_name),
+ flow->host_server_name,
+ strlen(flow->host_server_name),
&ret_match, NDPI_PROTOCOL_QUIC);
flow->protos.tls_quic.hello_processed = 1; /* Allow matching of custom categories */
ndpi_check_dga_name(ndpi_struct, flow,
- flow->protos.tls_quic.client_requested_server_name, 1);
+ flow->host_server_name, 1);
sni_found = 1;
if (ua_found)
@@ -1396,7 +1394,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
NDPI_LOG_DBG(ndpi_struct, "Something went wrong in tags iteration\n");
/* Add check for missing SNI */
- if(flow->protos.tls_quic.client_requested_server_name[0] == '\0') {
+ if(flow->host_server_name[0] == '\0') {
/* This is a bit suspicious */
ndpi_set_risk(ndpi_struct, flow, NDPI_TLS_MISSING_SNI);
}
@@ -1508,7 +1506,7 @@ static int eval_extra_processing(struct ndpi_detection_module_struct *ndpi_struc
*/
if((version == V_Q046 &&
- flow->protos.tls_quic.client_requested_server_name[0] == '\0') ||
+ flow->host_server_name[0] == '\0') ||
is_ch_reassembler_pending(flow)) {
NDPI_LOG_DBG2(ndpi_struct, "We have further work to do\n");
return 1;
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c
index f0884fae3..1ffa8afef 100644
--- a/src/lib/protocols/stun.c
+++ b/src/lib/protocols/stun.c
@@ -349,25 +349,21 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *
u_int16_t realm_len = ntohs(*((u_int16_t*)&payload[offset+2]));
if(flow->host_server_name[0] == '\0') {
- u_int i;
u_int k = offset+4;
- i = ndpi_min(realm_len, sizeof(flow->host_server_name) - 1);
- i = ndpi_min(i, payload_length - k);
- memcpy(flow->host_server_name, payload + k, i);
- flow->host_server_name[i] = '\0';
-
+ ndpi_hostname_sni_set(flow, payload + k, ndpi_min(realm_len, payload_length - k));
+
#ifdef DEBUG_STUN
printf("==> [%s]\n", flow->host_server_name);
#endif
- if(strstr((char*) flow->host_server_name, "google.com") != NULL) {
+ if(strstr(flow->host_server_name, "google.com") != NULL) {
flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO;
return(NDPI_IS_STUN);
- } else if(strstr((char*) flow->host_server_name, "whispersystems.org") != NULL) {
+ } else if(strstr(flow->host_server_name, "whispersystems.org") != NULL) {
flow->guessed_host_protocol_id = NDPI_PROTOCOL_SIGNAL;
return(NDPI_IS_STUN);
- } else if(strstr((char*) flow->host_server_name, "facebook") != NULL) {
+ } else if(strstr(flow->host_server_name, "facebook") != NULL) {
flow->guessed_host_protocol_id = NDPI_PROTOCOL_MESSENGER;
return(NDPI_IS_STUN);
}
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index d912ae947..a75e26eb2 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -478,7 +478,7 @@ static void processCertificateElements(struct ndpi_detection_module_struct *ndpi
u_int8_t matched_name = 0;
/* If the client hello was not observed or the requested name was missing, there is no need to trigger an alert */
- if(flow->protos.tls_quic.client_requested_server_name[0] == '\0')
+ if(flow->host_server_name[0] == '\0')
matched_name = 1;
#ifdef DEBUG_TLS
@@ -520,7 +520,7 @@ static void processCertificateElements(struct ndpi_detection_module_struct *ndpi
#if DEBUG_TLS
printf("[TLS] dNSName %s [%s][len: %u][leftover: %d]\n", dNSName,
- flow->protos.tls_quic.client_requested_server_name, len,
+ flow->host_server_name, len,
packet->payload_packet_len-i-len);
#endif
if (ndpi_is_printable_string(dNSName, len) == 0) {
@@ -530,27 +530,24 @@ static void processCertificateElements(struct ndpi_detection_module_struct *ndpi
if(matched_name == 0) {
#if DEBUG_TLS
printf("[TLS] Trying to match '%s' with '%s'\n",
- flow->protos.tls_quic.client_requested_server_name,
+ flow->host_server_name,
dNSName);
#endif
- if(flow->protos.tls_quic.client_requested_server_name[0] == '\0')
+ if(flow->host_server_name[0] == '\0') {
matched_name = 1; /* No SNI */
- else if (dNSName[0] == '*')
- {
- char * label = strstr(flow->protos.tls_quic.client_requested_server_name, &dNSName[1]);
-
- if (label != NULL)
- {
- char * first_dot = strchr(flow->protos.tls_quic.client_requested_server_name, '.');
-
- if (first_dot == NULL || first_dot >= label)
- {
- matched_name = 1;
- }
- }
- }
- else if(strcmp(flow->protos.tls_quic.client_requested_server_name, dNSName) == 0) {
+ } else if (dNSName[0] == '*') {
+ char * label = strstr(flow->host_server_name, &dNSName[1]);
+
+ if (label != NULL) {
+ char * first_dot = strchr(flow->host_server_name, '.');
+
+ if (first_dot == NULL || first_dot >= label) {
+ matched_name = 1;
+ }
+ }
+ }
+ else if(strcmp(flow->host_server_name, dNSName) == 0) {
matched_name = 1;
}
}
@@ -1244,7 +1241,6 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
u_int32_t i, j;
u_int16_t total_len;
u_int8_t handshake_type;
- char buffer[64] = { '\0' };
int is_quic = (quic_version != 0);
int is_dtls = packet->udp && (!is_quic);
@@ -1721,50 +1717,41 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
if((offset+extension_offset+4) < packet->payload_packet_len) {
len = (packet->payload[offset+extension_offset+3] << 8) + packet->payload[offset+extension_offset+4];
- len = (u_int)ndpi_min(len, sizeof(buffer)-1);
if((offset+extension_offset+5+len) <= packet->payload_packet_len) {
- strncpy(buffer, (char*)&packet->payload[offset+extension_offset+5], len);
- buffer[len] = '\0';
- cleanupServerName(buffer, sizeof(buffer));
-
- snprintf(flow->protos.tls_quic.client_requested_server_name,
- sizeof(flow->protos.tls_quic.client_requested_server_name),
- "%s", buffer);
+ char *sni = ndpi_hostname_sni_set(flow, &packet->payload[offset+extension_offset+5], len);
+ int sni_len = strlen(sni);
#ifdef DEBUG_TLS
- printf("[TLS] SNI: [%s]\n", buffer);
+ printf("[TLS] SNI: [%s]\n", sni);
#endif
- if (ndpi_is_printable_string(buffer, len) == 0)
+ if (ndpi_is_printable_string(sni, sni_len) == 0)
{
ndpi_set_risk(ndpi_struct, flow, NDPI_INVALID_CHARACTERS);
}
if(!is_quic) {
- if(ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TLS, buffer, strlen(buffer)))
+ if(ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TLS, sni, sni_len))
flow->protos.tls_quic.subprotocol_detected = 1;
} else {
- if(ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, buffer, strlen(buffer)))
+ if(ndpi_match_hostname_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, sni, sni_len))
flow->protos.tls_quic.subprotocol_detected = 1;
}
if(ndpi_check_dga_name(ndpi_struct, flow,
- flow->protos.tls_quic.client_requested_server_name, 1)) {
- char *sni = flow->protos.tls_quic.client_requested_server_name;
- int len = strlen(sni);
-
+ sni, 1)) {
#ifdef DEBUG_TLS
- printf("[TLS] SNI: (DGA) [%s]\n", flow->protos.tls_quic.client_requested_server_name);
+ printf("[TLS] SNI: (DGA) [%s]\n", sni);
#endif
- if((len >= 4)
+ if((sni_len >= 4)
/* Check if it ends in .com or .net */
- && ((strcmp(&sni[len-4], ".com") == 0) || (strcmp(&sni[len-4], ".net") == 0))
+ && ((strcmp(&sni[sni_len-4], ".com") == 0) || (strcmp(&sni[sni_len-4], ".net") == 0))
&& (strncmp(sni, "www.", 4) == 0)) /* Not starting with www.... */
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TOR, NDPI_PROTOCOL_TLS);
} else {
#ifdef DEBUG_TLS
- printf("[TLS] SNI: (NO DGA) [%s]\n", flow->protos.tls_quic.client_requested_server_name);
+ printf("[TLS] SNI: (NO DGA) [%s]\n", sni);
#endif
}
} else {
@@ -2268,12 +2255,12 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
/* Suspicious Domain Fronting:
https://github.com/SixGenInc/Noctilucent/blob/master/docs/ */
if(flow->protos.tls_quic.encrypted_sni.esni &&
- flow->protos.tls_quic.client_requested_server_name[0] != '\0') {
+ flow->host_server_name[0] != '\0') {
ndpi_set_risk(ndpi_struct, flow, NDPI_TLS_SUSPICIOUS_ESNI_USAGE);
}
/* Add check for missing SNI */
- if((flow->protos.tls_quic.client_requested_server_name[0] == 0)
+ if(flow->host_server_name[0] == '\0'
&& (flow->protos.tls_quic.ssl_version >= 0x0302) /* TLSv1.1 */
&& (flow->protos.tls_quic.encrypted_sni.esni == NULL) /* No ESNI */
) {
diff --git a/src/lib/protocols/whoisdas.c b/src/lib/protocols/whoisdas.c
index 7321626d2..6f6f2a06b 100644
--- a/src/lib/protocols/whoisdas.c
+++ b/src/lib/protocols/whoisdas.c
@@ -41,10 +41,7 @@ void ndpi_search_whois_das(struct ndpi_detection_module_struct *ndpi_struct, str
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHOIS_DAS, NDPI_PROTOCOL_UNKNOWN);
if((dport == 43) || (dport == 4343)) { /* Request */
- u_int hostname_len = ndpi_min(sizeof(flow->host_server_name) - 1, (long unsigned int)packet->payload_packet_len - 2); /* Skip \r\n */
-
- memcpy(flow->host_server_name, &packet->payload[0], hostname_len);
- flow->host_server_name[hostname_len] = '\0';
+ ndpi_hostname_sni_set(flow, &packet->payload[0], packet->payload_packet_len - 2); /* Skip \r\n */
NDPI_LOG_INFO(ndpi_struct, "[WHOIS/DAS] %s\n", flow->host_server_name);
}
return;
Powered by cgit, Themed by Ted Yin.