From a8ffcd8bb0273d59600c6310a80b81206096c113 Mon Sep 17 00:00:00 2001 From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> Date: Wed, 24 Nov 2021 10:46:48 +0100 Subject: Rework how hostname/SNI info is saved (#1330) Looking at `struct ndpi_flow_struct` the two bigger fields are `host_server_name[240]` (mainly for HTTP hostnames and DNS domains) and `protos.tls_quic.client_requested_server_name[256]` (for TLS/QUIC SNIs). This commit aims to reduce `struct ndpi_flow_struct` size, according to two simple observations: 1) maximum one of these two fields is used for each flow. So it seems safe to merge them; 2) even if hostnames/SNIs might be very long, in practice they are rarely longer than a fews tens of bytes. So, using a (single) large buffer is a waste of memory for all kinds of flows. If we need to truncate the name, we keep the *last* characters, easing domain matching. Analyzing some real traffic, it seems safe to assume that the vast majority of hostnames/SNIs is shorter than 80 bytes. Hostnames/SNIs are always converted to lowercase. Attention was given so as to be sure that unit-tests outputs are not affected by this change. Because of a bug, TLS/QUIC SNI were always truncated to 64 bytes (the *first* 64 ones): as a consequence, there were some "Suspicious DGA domain name" and "TLS Certificate Mismatch" false positives. --- src/lib/protocols/stun.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) (limited to 'src/lib/protocols/stun.c') diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index f0884fae3..1ffa8afef 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -349,25 +349,21 @@ static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct * u_int16_t realm_len = ntohs(*((u_int16_t*)&payload[offset+2])); if(flow->host_server_name[0] == '\0') { - u_int i; u_int k = offset+4; - i = ndpi_min(realm_len, sizeof(flow->host_server_name) - 1); - i = ndpi_min(i, payload_length - k); - memcpy(flow->host_server_name, payload + k, i); - flow->host_server_name[i] = '\0'; - + ndpi_hostname_sni_set(flow, payload + k, ndpi_min(realm_len, payload_length - k)); + #ifdef DEBUG_STUN printf("==> [%s]\n", flow->host_server_name); #endif - if(strstr((char*) flow->host_server_name, "google.com") != NULL) { + if(strstr(flow->host_server_name, "google.com") != NULL) { flow->guessed_host_protocol_id = NDPI_PROTOCOL_HANGOUT_DUO; return(NDPI_IS_STUN); - } else if(strstr((char*) flow->host_server_name, "whispersystems.org") != NULL) { + } else if(strstr(flow->host_server_name, "whispersystems.org") != NULL) { flow->guessed_host_protocol_id = NDPI_PROTOCOL_SIGNAL; return(NDPI_IS_STUN); - } else if(strstr((char*) flow->host_server_name, "facebook") != NULL) { + } else if(strstr(flow->host_server_name, "facebook") != NULL) { flow->guessed_host_protocol_id = NDPI_PROTOCOL_MESSENGER; return(NDPI_IS_STUN); } -- cgit v1.2.3