vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-05-02 00:40:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 5

Reworked SSL/TLS field naming

Browse source
This commit is contained in:
Luca 2019-08-08 15:20:05 +02:00
parent 419160f351
commit cce8a6026f
13 changed files with 192 additions and 191 deletions
Download patch file Download diff file Expand all files Collapse all files

2
example/ndpiReader.c
View file

@ -944,7 +944,7 @@ static void printFlow(u_int16_t id, struct ndpi_flow_info *flow, u_int16_t threa
if(flow->info[0] != '\0') fprintf(out, "[%s]", flow->info);
if(flow->ssh_tls.tls_version != 0) fprintf(out, "[%s]", ndpi_tls_version2str(flow->ssh_tls.tls_version));
if(flow->ssh_tls.ssl_version != 0) fprintf(out, "[%s]", ndpi_ssl_version2str(flow->ssh_tls.ssl_version));
if(flow->ssh_tls.client_info[0] != '\0') fprintf(out, "[client: %s]", flow->ssh_tls.client_info);
if(flow->ssh_tls.ja3_client[0] != '\0') fprintf(out, "[JA3C: %s%s]", flow->ssh_tls.ja3_client,
print_cipher(flow->ssh_tls.client_unsafe_cipher));

18
example/reader_util.c
View file

@ -715,19 +715,19 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
/* TLS */
else if((flow->detected_protocol.app_protocol == NDPI_PROTOCOL_TLS)
|| (flow->detected_protocol.master_protocol == NDPI_PROTOCOL_TLS)) {
flow->ssh_tls.tls_version = flow->ndpi_flow->protos.stun_tls.tls.tls_version;
flow->ssh_tls.ssl_version = flow->ndpi_flow->protos.stun_ssl.ssl.ssl_version;
snprintf(flow->ssh_tls.client_info, sizeof(flow->ssh_tls.client_info), "%s",
flow->ndpi_flow->protos.stun_tls.tls.client_certificate);
flow->ndpi_flow->protos.stun_ssl.ssl.client_certificate);
snprintf(flow->ssh_tls.server_info, sizeof(flow->ssh_tls.server_info), "%s",
flow->ndpi_flow->protos.stun_tls.tls.server_certificate);
flow->ndpi_flow->protos.stun_ssl.ssl.server_certificate);
snprintf(flow->ssh_tls.server_organization, sizeof(flow->ssh_tls.server_organization), "%s",
flow->ndpi_flow->protos.stun_tls.tls.server_organization);
flow->ndpi_flow->protos.stun_ssl.ssl.server_organization);
snprintf(flow->ssh_tls.ja3_client, sizeof(flow->ssh_tls.ja3_client), "%s",
flow->ndpi_flow->protos.stun_tls.tls.ja3_client);
flow->ndpi_flow->protos.stun_ssl.ssl.ja3_client);
snprintf(flow->ssh_tls.ja3_server, sizeof(flow->ssh_tls.ja3_server), "%s",
flow->ndpi_flow->protos.stun_tls.tls.ja3_server);
flow->ssh_tls.server_unsafe_cipher = flow->ndpi_flow->protos.stun_tls.tls.server_unsafe_cipher;
flow->ssh_tls.server_cipher = flow->ndpi_flow->protos.stun_tls.tls.server_cipher;
flow->ndpi_flow->protos.stun_ssl.ssl.ja3_server);
flow->ssh_tls.server_unsafe_cipher = flow->ndpi_flow->protos.stun_ssl.ssl.server_unsafe_cipher;
flow->ssh_tls.server_cipher = flow->ndpi_flow->protos.stun_ssl.ssl.server_cipher;
}
}
@ -859,7 +859,7 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow,
if(enough_packets || (flow->detected_protocol.app_protocol != NDPI_PROTOCOL_UNKNOWN)) {
if((!enough_packets)
&& (flow->detected_protocol.master_protocol == NDPI_PROTOCOL_TLS)
&& (flow->ndpi_flow->protos.stun_tls.tls.ja3_server[0] == '\0'))
&& (flow->ndpi_flow->protos.stun_ssl.ssl.ja3_server[0] == '\0'))
; /* Wait for JA3S certificate */
else {
/* New protocol detected or give up */

2
example/reader_util.h
View file

@ -150,7 +150,7 @@ typedef struct ndpi_flow_info {
char dhcp_fingerprint[48];
struct {
u_int16_t tls_version;
u_int16_t ssl_version;
char client_info[64], server_info[64], server_organization[64],
ja3_client[33], ja3_server[33];
u_int16_t server_cipher;