From 0c703ef8ebe7e56178e0641d8a390c2607207256 Mon Sep 17 00:00:00 2001
From: Luca Deri <deri@ntop.org>
Date: Tue, 24 May 2022 19:51:49 +0200
Subject: Added invalid SNI check in QUIC

---
 src/lib/protocols/quic.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index df32926db..32347b9c1 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1389,6 +1389,14 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
       ndpi_check_dga_name(ndpi_struct, flow,
                           flow->host_server_name, 1);
 
+      if(ndpi_is_valid_hostname(flow->host_server_name,
+				strlen(flow->host_server_name)) == 0) {
+	ndpi_set_risk(ndpi_struct, flow, NDPI_INVALID_CHARACTERS);
+	
+	/* This looks like an attack */
+	ndpi_set_risk(ndpi_struct, flow, NDPI_POSSIBLE_EXPLOIT);
+      }
+      
       sni_found = 1;
       if (ua_found)
         return;
-- 
cgit v1.2.3