From a8ffcd8bb0273d59600c6310a80b81206096c113 Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Wed, 24 Nov 2021 10:46:48 +0100 Subject: Rework how hostname/SNI info is saved (#1330) Looking at `struct ndpi_flow_struct` the two bigger fields are `host_server_name[240]` (mainly for HTTP hostnames and DNS domains) and `protos.tls_quic.client_requested_server_name[256]` (for TLS/QUIC SNIs). This commit aims to reduce `struct ndpi_flow_struct` size, according to two simple observations: 1) maximum one of these two fields is used for each flow. So it seems safe to merge them; 2) even if hostnames/SNIs might be very long, in practice they are rarely longer than a fews tens of bytes. So, using a (single) large buffer is a waste of memory for all kinds of flows. If we need to truncate the name, we keep the *last* characters, easing domain matching. Analyzing some real traffic, it seems safe to assume that the vast majority of hostnames/SNIs is shorter than 80 bytes. Hostnames/SNIs are always converted to lowercase. Attention was given so as to be sure that unit-tests outputs are not affected by this change. Because of a bug, TLS/QUIC SNI were always truncated to 64 bytes (the *first* 64 ones): as a consequence, there were some "Suspicious DGA domain name" and "TLS Certificate Mismatch" false positives. --- example/ndpiSimpleIntegration.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'example/ndpiSimpleIntegration.c') diff --git a/example/ndpiSimpleIntegration.c b/example/ndpiSimpleIntegration.c index d5cc728ad..3a63f7ba4 100644 --- a/example/ndpiSimpleIntegration.c +++ b/example/ndpiSimpleIntegration.c @@ -924,7 +924,7 @@ static void ndpi_process_packet(uint8_t * const args, ndpi_ssl_version2str(flow_to_process->ndpi_flow, flow_to_process->ndpi_flow->protos.tls_quic.ssl_version, &unknown_tls_version), - flow_to_process->ndpi_flow->protos.tls_quic.client_requested_server_name, + flow_to_process->ndpi_flow->host_server_name, (flow_to_process->ndpi_flow->protos.tls_quic.alpn != NULL ? flow_to_process->ndpi_flow->protos.tls_quic.alpn : "-")); flow_to_process->tls_client_hello_seen = 1; -- cgit v1.2.3