diff --git a/include/Host.h b/include/Host.h index e973f6195c..463c0fde64 100644 --- a/include/Host.h +++ b/include/Host.h @@ -54,6 +54,7 @@ class Host : public GenericHashEntry, public HostAlertableEntity, public Score, char *resolved; /* The name as resolved by ntopng DNS requests */ char *netbios; /* The NetBIOS name */ char *tls; /* The TLS SNI or the name as dissected from other TLS-transported protocols */ + char *http; /* The HTTP Host: name */ } names; char *ssdpLocation; @@ -237,6 +238,7 @@ class Host : public GenericHashEntry, public HostAlertableEntity, public Score, char * getMDNSInfo(char * const buf, ssize_t buf_len); char * getNetbiosName(char * const buf, ssize_t buf_len); char * getTLSName(char * const buf, ssize_t buf_len); + char * getHTTPName(char * const buf, ssize_t buf_len); #ifdef NTOPNG_PRO inline TrafficShaper *get_ingress_shaper(ndpi_protocol ndpiProtocol) { return(get_shaper(ndpiProtocol, true)); } inline TrafficShaper *get_egress_shaper(ndpi_protocol ndpiProtocol) { return(get_shaper(ndpiProtocol, false)); } @@ -419,6 +421,7 @@ class Host : public GenericHashEntry, public HostAlertableEntity, public Score, virtual void inlineSetOSDetail(const char *detail) { } virtual const char* getOSDetail(char * const buf, ssize_t buf_len); void offlineSetTLSName(const char * const n); + void offlineSetHTTPName(const char * const n); void offlineSetNetbiosName(const char * const n); void offlineSetSSDPLocation(const char * const url); void offlineSetMDNSInfo(char * const s); diff --git a/src/Flow.cpp b/src/Flow.cpp index b3e35c6822..fa85a035a9 100644 --- a/src/Flow.cpp +++ b/src/Flow.cpp @@ -1524,17 +1524,19 @@ void Flow::hosts_periodic_stats_update(NetworkInterface *iface, Host *cli_host, } /* Don't break, let's process also HTTP_PROXY */ case NDPI_PROTOCOL_HTTP_PROXY: - if(srv_host - && srv_host->getHTTPstats() - && host_server_name - && isThreeWayHandshakeOK()) { - srv_host->getHTTPstats()->updateHTTPHostRequest(tv->tv_sec, host_server_name, + if(srv_host) { + srv_host->offlineSetHTTPName(host_server_name); + + if(srv_host->getHTTPstats() + && host_server_name + && isThreeWayHandshakeOK()) { + srv_host->getHTTPstats()->updateHTTPHostRequest(tv->tv_sec, host_server_name, partial->get_num_http_requests(), partial->get_cli2srv_bytes(), partial->get_srv2cli_bytes()); + } } break; - case NDPI_PROTOCOL_DNS: if(cli_host && cli_host->getDNSstats()) cli_host->getDNSstats()->incStats(true /* Client */, partial->get_flow_dns_stats()); diff --git a/src/Host.cpp b/src/Host.cpp index e05c381e93..60ddac67ad 100644 --- a/src/Host.cpp +++ b/src/Host.cpp @@ -396,6 +396,9 @@ void Host::lua_get_names(lua_State * const vm, char * const buf, ssize_t buf_siz getTLSName(buf, buf_size); if(buf[0]) lua_push_str_table_entry(vm, "tls", buf); + getHTTPName(buf, buf_size); + if(buf[0]) lua_push_str_table_entry(vm, "http", buf); + if(isBroadcastDomainHost() && cur_mac) { cur_mac->getDHCPName(buf, buf_size); if(buf[0]) lua_push_str_table_entry(vm, "dhcp", buf); @@ -821,6 +824,10 @@ char* Host::get_name(char *buf, u_int buf_len, bool force_resolution_if_not_foun if(name_buf[0]) goto out; + getHTTPName(name_buf, sizeof(name_buf)); + if(name_buf[0]) + goto out; + if(!skip_resolution) { addr = ip.print(buf, buf_len); rc = ntop->getRedis()->getAddress(addr, name_buf, sizeof(name_buf), @@ -931,6 +938,18 @@ char * Host::getTLSName(char * const buf, ssize_t buf_len) { /* ***************************************** */ +char * Host::getHTTPName(char * const buf, ssize_t buf_len) { + if(buf && buf_len) { + m.lock(__FILE__, __LINE__); + snprintf(buf, buf_len, "%s", names.http ? names.http : ""); + m.unlock(__FILE__, __LINE__); + } + + return Utils::stringtolower(buf); +} + +/* ***************************************** */ + const char * Host::getOSDetail(char * const buf, ssize_t buf_len) { if(buf && buf_len) buf[0] = '\0'; @@ -1366,6 +1385,13 @@ void Host::offlineSetTLSName(const char * const tls_n) { /* *************************************** */ +void Host::offlineSetHTTPName(const char * const http_n) { + if(!names.http && http_n && (names.http = Utils::toLowerResolvedNames(http_n))) + ; +} + +/* *************************************** */ + void Host::setResolvedName(const char * const resolved_name) { /* Multiple threads can set this so we must lock */ if(resolved_name && resolved_name[0] != '\0') { @@ -1544,6 +1570,7 @@ void Host::freeHostNames() { if(names.resolved) { free(names.resolved); names.resolved = NULL; } if(names.netbios) { free(names.netbios); names.netbios = NULL; } if(names.tls) { free(names.tls); names.tls = NULL; } + if(names.http) { free(names.http); names.http = NULL; } } /* *************************************** */