STUN: improve extraction of Mapped-Address metadata (#2370)

Enable parsing of Mapped-Address attribute for all STUN flows: that
means that STUN classification might require more packets.

Add a configuration knob to enable/disable this feature.

Note that we can have (any) STUN metadata also for flows *not*
classified as STUN (because of DTLS).

Add support for ipv6.

Restore the correct extra dissection logic for Telegram flows.
This commit is contained in:
Ivan Nardi 2024-04-08 10:24:51 +02:00 committed by GitHub
parent f5905a62c7
commit 1b3ef7d7b2
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
35 changed files with 409 additions and 248 deletions

View file

@ -178,6 +178,11 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
sprintf(cfg_value, "%d", value);
ndpi_set_config(ndpi_info_mod, "stun", "max_packets_extra_dissection", cfg_value);
}
if(fuzzed_data.ConsumeBool()) {
value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1);
sprintf(cfg_value, "%d", value);
ndpi_set_config(ndpi_info_mod, "stun", "metadata.attribute.mapped_address", cfg_value);
}
if(fuzzed_data.ConsumeBool()) {
value = fuzzed_data.ConsumeIntegralInRange(0, 1 + 1);
sprintf(cfg_value, "%d", value);