From afc2b641eb9cf5035b5147e78030bafe0b40dd87 Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Mon, 15 Nov 2021 16:20:57 +0100 Subject: Fix writes to `flow->protos` union fields (#1354) We can write to `flow->protos` only after a proper classification. This issue has been found in Kerberos, DHCP, HTTP, STUN, IMO, FTP, SMTP, IMAP and POP code. There are two kinds of fixes: * write to `flow->protos` only if a final protocol has been detected * move protocol state out of `flow->protos` The hard part is to find, for each protocol, the right tradeoff between memory usage and code complexity. Handle Kerberos like DNS: if we find a request, we set the protocol and an extra callback to further parsing the reply. For all the other protocols, move the state out of `flow->protos`. This is an issue only for the FTP/MAIL stuff. Add DHCP Class Identification value to the output of ndpiReader and to the Jason serialization. Extend code coverage of fuzz tests. Close #1343 Close #1342 --- example/ndpiSimpleIntegration.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) (limited to 'example/ndpiSimpleIntegration.c') diff --git a/example/ndpiSimpleIntegration.c b/example/ndpiSimpleIntegration.c index 2383279e4..d5cc728ad 100644 --- a/example/ndpiSimpleIntegration.c +++ b/example/ndpiSimpleIntegration.c @@ -914,7 +914,7 @@ static void ndpi_process_packet(uint8_t * const args, flow_to_process->detected_l7_protocol.app_protocol == NDPI_PROTOCOL_TLS) { if (flow_to_process->tls_client_hello_seen == 0 && - flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.hello_processed != 0) + flow_to_process->ndpi_flow->protos.tls_quic.hello_processed != 0) { uint8_t unknown_tls_version = 0; printf("[%8llu, %d, %4d][TLS-CLIENT-HELLO] version: %s | sni: %s | alpn: %s\n", @@ -922,11 +922,11 @@ static void ndpi_process_packet(uint8_t * const args, reader_thread->array_index, flow_to_process->flow_id, ndpi_ssl_version2str(flow_to_process->ndpi_flow, - flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.ssl_version, + flow_to_process->ndpi_flow->protos.tls_quic.ssl_version, &unknown_tls_version), - flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.client_requested_server_name, - (flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.alpn != NULL ? - flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.alpn : "-")); + flow_to_process->ndpi_flow->protos.tls_quic.client_requested_server_name, + (flow_to_process->ndpi_flow->protos.tls_quic.alpn != NULL ? + flow_to_process->ndpi_flow->protos.tls_quic.alpn : "-")); flow_to_process->tls_client_hello_seen = 1; } if (flow_to_process->tls_server_hello_seen == 0 && @@ -939,16 +939,16 @@ static void ndpi_process_packet(uint8_t * const args, reader_thread->array_index, flow_to_process->flow_id, ndpi_ssl_version2str(flow_to_process->ndpi_flow, - flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.ssl_version, + flow_to_process->ndpi_flow->protos.tls_quic.ssl_version, &unknown_tls_version), - (flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.server_names_len == 0 ? - 1 : flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.server_names_len), - (flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.server_names == NULL ? - "-" : flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.server_names), - (flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.issuerDN != NULL ? - flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.issuerDN : "-"), - (flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.subjectDN != NULL ? - flow_to_process->ndpi_flow->protos.tls_quic_stun.tls_quic.subjectDN : "-")); + (flow_to_process->ndpi_flow->protos.tls_quic.server_names_len == 0 ? + 1 : flow_to_process->ndpi_flow->protos.tls_quic.server_names_len), + (flow_to_process->ndpi_flow->protos.tls_quic.server_names == NULL ? + "-" : flow_to_process->ndpi_flow->protos.tls_quic.server_names), + (flow_to_process->ndpi_flow->protos.tls_quic.issuerDN != NULL ? + flow_to_process->ndpi_flow->protos.tls_quic.issuerDN : "-"), + (flow_to_process->ndpi_flow->protos.tls_quic.subjectDN != NULL ? + flow_to_process->ndpi_flow->protos.tls_quic.subjectDN : "-")); flow_to_process->tls_server_hello_seen = 1; } } -- cgit v1.2.3