Skip to content

Commit 78ca74c

Browse files
IvanNardiIvanNardi
authored
TLS: avoid exporting TLS heuristic fingerprint as metadata (#2783)
1 parent 37a0613 commit 78ca74c

File tree

7 files changed

+0
-65
lines changed

7 files changed

+0
-65
lines changed

‎example/ndpiReader.c

-17
Original file line numberDiff line numberDiff line change
@@ -239,7 +239,6 @@ struct receiver *receivers = NULL, *topReceivers = NULL;
239239

240240
#define WIRESHARK_METADATA_SERVERNAME 0x01
241241
#define WIRESHARK_METADATA_JA4C 0x02
242-
#define WIRESHARK_METADATA_TLS_HEURISTICS_MATCHING_FINGERPRINT 0x03
243242

244243
struct ndpi_packet_tlv {
245244
u_int16_t type;
@@ -4790,22 +4789,6 @@ static void ndpi_process_packet(u_char *args,
47904789
tot_len += 4 + htons(tlv->length);
47914790
tlv = (struct ndpi_packet_tlv *)&trailer->metadata[tot_len];
47924791
}
4793-
if(flow->ssh_tls.obfuscated_heur_matching_set.pkts[0] != 0) {
4794-
tlv->type = ntohs(WIRESHARK_METADATA_TLS_HEURISTICS_MATCHING_FINGERPRINT);
4795-
tlv->length = ntohs(sizeof(struct ndpi_tls_obfuscated_heuristic_matching_set));
4796-
struct ndpi_tls_obfuscated_heuristic_matching_set *s = (struct ndpi_tls_obfuscated_heuristic_matching_set *)tlv->data;
4797-
s->bytes[0] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.bytes[0]);
4798-
s->bytes[1] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.bytes[1]);
4799-
s->bytes[2] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.bytes[2]);
4800-
s->bytes[3] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.bytes[3]);
4801-
s->pkts[0] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.pkts[0]);
4802-
s->pkts[1] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.pkts[1]);
4803-
s->pkts[2] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.pkts[2]);
4804-
s->pkts[3] = ntohl(flow->ssh_tls.obfuscated_heur_matching_set.pkts[3]);
4805-
/* TODO: boundary check */
4806-
tot_len += 4 + htons(tlv->length);
4807-
tlv = (struct ndpi_packet_tlv *)&trailer->metadata[tot_len];
4808-
}
48094792

48104793
flow->detection_completed = 2; /* Avoid exporting metadata again.
48114794
If we really want to have the metadata on Wireshark for *all*

‎example/reader_util.c

-4
Original file line numberDiff line numberDiff line change
@@ -1602,10 +1602,6 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
16021602
ndpi_snprintf(flow->fast_cgi.url, sizeof(flow->fast_cgi.url), "%s", flow->ndpi_flow->protos.fast_cgi.url);
16031603
}
16041604

1605-
if(flow->ndpi_flow->tls_quic.obfuscated_heur_state && flow->ndpi_flow->tls_quic.obfuscated_heur_matching_set)
1606-
memcpy(&flow->ssh_tls.obfuscated_heur_matching_set, flow->ndpi_flow->tls_quic.obfuscated_heur_matching_set,
1607-
sizeof(struct ndpi_tls_obfuscated_heuristic_matching_set));
1608-
16091605
if(!monitoring_enabled) {
16101606
add_to_address_port_list(&flow->stun.mapped_address, &flow->ndpi_flow->stun.mapped_address);
16111607
add_to_address_port_list(&flow->stun.peer_address, &flow->ndpi_flow->stun.peer_address);

‎example/reader_util.h

-1
Original file line numberDiff line numberDiff line change
@@ -314,7 +314,6 @@ typedef struct ndpi_flow_info {
314314

315315
u_int32_t quic_version;
316316

317-
struct ndpi_tls_obfuscated_heuristic_matching_set obfuscated_heur_matching_set;
318317
} ssh_tls;
319318

320319
struct {

‎src/include/ndpi_typedefs.h

-6
Original file line numberDiff line numberDiff line change
@@ -1299,11 +1299,6 @@ struct os_fingerprint {
12991299
enum operating_system_hint os;
13001300
};
13011301

1302-
struct ndpi_tls_obfuscated_heuristic_matching_set {
1303-
u_int32_t bytes[4];
1304-
u_int32_t pkts[4];
1305-
};
1306-
13071302
struct rtp_info {
13081303
u_int8_t payload_type;
13091304
bool payload_detected;
@@ -1431,7 +1426,6 @@ struct ndpi_flow_struct {
14311426
message_t message[2]; /* Directions */
14321427
u_int8_t certificate_processed:1, change_cipher_from_client:1, change_cipher_from_server:1, from_opportunistic_tls:1, from_rdp:1, pad:3;
14331428
struct tls_obfuscated_heuristic_state *obfuscated_heur_state;
1434-
struct ndpi_tls_obfuscated_heuristic_matching_set *obfuscated_heur_matching_set;
14351429
} tls_quic; /* Used also by DTLS and POPS/IMAPS/SMTPS/FTPS */
14361430

14371431
struct rtp_info rtp[2 /* directions */];

‎src/lib/ndpi_main.c

-2
Original file line numberDiff line numberDiff line change
@@ -6999,8 +6999,6 @@ void ndpi_free_flow_data(struct ndpi_flow_struct* flow) {
69996999

70007000
if(flow->tls_quic.obfuscated_heur_state)
70017001
ndpi_free(flow->tls_quic.obfuscated_heur_state);
7002-
if(flow->tls_quic.obfuscated_heur_matching_set)
7003-
ndpi_free(flow->tls_quic.obfuscated_heur_matching_set);
70047002
}
70057003
}
70067004

‎src/lib/protocols/tls.c

-13
Original file line numberDiff line numberDiff line change
@@ -438,19 +438,6 @@ static int tls_obfuscated_heur_search(struct ndpi_detection_module_struct* ndpi_
438438
if(check_set(ndpi_struct, set)) {
439439
/* Heuristic match */
440440

441-
/* Export the matching set as metadata */
442-
flow->tls_quic.obfuscated_heur_matching_set = ndpi_calloc(1, sizeof(struct ndpi_tls_obfuscated_heuristic_matching_set));
443-
if(flow->tls_quic.obfuscated_heur_matching_set) {
444-
flow->tls_quic.obfuscated_heur_matching_set->bytes[0] = set->bytes[0];
445-
flow->tls_quic.obfuscated_heur_matching_set->bytes[1] = set->bytes[1];
446-
flow->tls_quic.obfuscated_heur_matching_set->bytes[2] = set->bytes[2];
447-
flow->tls_quic.obfuscated_heur_matching_set->bytes[3] = set->bytes[3];
448-
flow->tls_quic.obfuscated_heur_matching_set->pkts[0] = set->pkts[0];
449-
flow->tls_quic.obfuscated_heur_matching_set->pkts[1] = set->pkts[1];
450-
flow->tls_quic.obfuscated_heur_matching_set->pkts[2] = set->pkts[2];
451-
flow->tls_quic.obfuscated_heur_matching_set->pkts[3] = set->pkts[3];
452-
}
453-
454441
return 2; /* Found */
455442
} else {
456443
/* Close this set and open a new one... */

‎wireshark/ndpi.lua

-22
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,6 @@ local mtd_types = {
7070
[0] = "Padding",
7171
[1] = "Server Name",
7272
[2] = "JA4C",
73-
[3] = "TLS Heuristic Fingerprint",
7473
}
7574
ndpi_fds.metadata_type = ProtoField.new("nDPI Metadata Type", "ndpi.metadata.type", ftypes.UINT16, mtd_types)
7675
ndpi_fds.metadata_length = ProtoField.new("nDPI Metadata Length", "ndpi.metadata.length", ftypes.UINT16)
@@ -79,16 +78,6 @@ ndpi_fds.metadata_value = ProtoField.new("nDPI Metadata Value", "ndpi.meta
7978
-- Specific fields
8079
ndpi_fds.metadata_server_name = ProtoField.new("nDPI Server Name", "ndpi.metadata.server_name", ftypes.STRING)
8180
ndpi_fds.metadata_ja4c = ProtoField.new("nDPI JA4C", "ndpi.metadata.ja4c", ftypes.STRING)
82-
ndpi_fds.metadata = ProtoField.new("nDPI Metadata", "ndpi.metadata", ftypes.NONE)
83-
ndpi_fds.metadata_tls_heuristic_fingerprint = ProtoField.new("nDPI TLS Heuristic Fingerprint", "ndpi.metadata.tls_heuristic_fingerprint", ftypes.NONE)
84-
ndpi_fds.metadata_tls_heuristic_fingerprint_bytes0 = ProtoField.new("Bytes[0]", "ndpi.metadata.tls_heuristic_fingerprint.bytes0", ftypes.UINT32)
85-
ndpi_fds.metadata_tls_heuristic_fingerprint_bytes1 = ProtoField.new("Bytes[1]", "ndpi.metadata.tls_heuristic_fingerprint.bytes1", ftypes.UINT32)
86-
ndpi_fds.metadata_tls_heuristic_fingerprint_bytes2 = ProtoField.new("Bytes[2]", "ndpi.metadata.tls_heuristic_fingerprint.bytes2", ftypes.UINT32)
87-
ndpi_fds.metadata_tls_heuristic_fingerprint_bytes3 = ProtoField.new("Bytes[3]", "ndpi.metadata.tls_heuristic_fingerprint.bytes3", ftypes.UINT32)
88-
ndpi_fds.metadata_tls_heuristic_fingerprint_pkts0 = ProtoField.new("Pkts[0]", "ndpi.metadata.tls_heuristic_fingerprint.pkts0", ftypes.UINT32)
89-
ndpi_fds.metadata_tls_heuristic_fingerprint_pkts1 = ProtoField.new("Pkts[1]", "ndpi.metadata.tls_heuristic_fingerprint.pkts1", ftypes.UINT32)
90-
ndpi_fds.metadata_tls_heuristic_fingerprint_pkts2 = ProtoField.new("Pkts[2]", "ndpi.metadata.tls_heuristic_fingerprint.pkts2", ftypes.UINT32)
91-
ndpi_fds.metadata_tls_heuristic_fingerprint_pkts3 = ProtoField.new("Pkts[3]", "ndpi.metadata.tls_heuristic_fingerprint.pkts3", ftypes.UINT32)
9281

9382

9483
local flow_risks = {}
@@ -1976,17 +1965,6 @@ function ndpi_proto.dissector(tvb, pinfo, tree)
19761965
elseif mtd_type == 2 then
19771966
metadata_tree:append_text(" JA4C: " .. trailer_tvb(offset + 4, mtd_length):string())
19781967
metadata_tree:add(ndpi_fds.metadata_ja4c, trailer_tvb(offset + 4, mtd_length))
1979-
elseif mtd_type == 3 then
1980-
metadata_tree:append_text(" TLS Heuristic Fingerprint")
1981-
tls_tree = metadata_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint, trailer_tvb(offset + 4, mtd_length))
1982-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_bytes0, trailer_tvb(offset + 4, 4))
1983-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_bytes1, trailer_tvb(offset + 8, 4))
1984-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_bytes2, trailer_tvb(offset + 12, 4))
1985-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_bytes3, trailer_tvb(offset + 16, 4))
1986-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_pkts0, trailer_tvb(offset + 20, 4))
1987-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_pkts1, trailer_tvb(offset + 24, 4))
1988-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_pkts2, trailer_tvb(offset + 28, 4))
1989-
tls_tree:add(ndpi_fds.metadata_tls_heuristic_fingerprint_pkts3, trailer_tvb(offset + 32, 4))
19901968
else
19911969
-- Generic field
19921970
metadata_tree:add(ndpi_fds.metadata_value, trailer_tvb(offset + 4, mtd_length))

0 commit comments

Comments
 (0)