From afc2b641eb9cf5035b5147e78030bafe0b40dd87 Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Mon, 15 Nov 2021 16:20:57 +0100
Subject: Fix writes to `flow->protos` union fields (#1354)

We can write to `flow->protos` only after a proper classification.

This issue has been found in Kerberos, DHCP, HTTP, STUN, IMO, FTP,
SMTP, IMAP and POP code.
There are two kinds of fixes:
 * write to `flow->protos` only if a final protocol has been detected
 * move protocol state out of `flow->protos`
The hard part is to find, for each protocol, the right tradeoff between
memory usage and code complexity.

Handle Kerberos like DNS: if we find a request, we set the protocol
and an extra callback to further parsing the reply.

For all the other protocols, move the state out of `flow->protos`. This
is an issue only for the FTP/MAIL stuff.

Add DHCP Class Identification value to the output of ndpiReader and to
the Jason serialization.

Extend code coverage of fuzz tests.

Close #1343
Close #1342
---
 example/ndpiReader.c | 2 ++
 1 file changed, 2 insertions(+)

(limited to 'example/ndpiReader.c')

diff --git a/example/ndpiReader.c b/example/ndpiReader.c
index e646cc33d..ecbcafd1f 100644
--- a/example/ndpiReader.c
+++ b/example/ndpiReader.c
@@ -1539,6 +1539,8 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
 					      flow->bittorent_hash);
   if(flow->dhcp_fingerprint) fprintf(out, "[DHCP Fingerprint: %s]",
 						flow->dhcp_fingerprint);
+  if(flow->dhcp_class_ident) fprintf(out, "[DHCP Class Ident: %s]",
+						flow->dhcp_class_ident);
 
   if(flow->has_human_readeable_strings) fprintf(out, "[PLAIN TEXT (%s)]",
 						flow->human_readeable_string_buffer);
-- 
cgit v1.2.3