Skip to content

Commit 33f58d2

Browse files
ZadamsaZadamsa
committed
++
1 parent 3711775 commit 33f58d2

File tree

12 files changed

+92
-82
lines changed

12 files changed

+92
-82
lines changed

‎process-plugin-api/process/common/tlsParser/tlsParser.hpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ class TLSParser {
121121
std::optional<TLSParser::SignatureAlgorithms>
122122
parseSignatureAlgorithms(std::span<const std::byte> extension) noexcept;
123123

124-
constexpr
124+
constexpr static
125125
std::optional<TLSParser::SupportedVersions>
126126
parseSupportedVersions(
127127
std::span<const std::byte> extension, const TLSHandshake& handshake) noexcept;
@@ -130,9 +130,9 @@ class TLSParser {
130130

131131
constexpr bool isServerHello() const noexcept;
132132

133-
constexpr const TLSHandshake& getHandshake() const noexcept;
133+
//constexpr const TLSHandshake& getHandshake() const noexcept;
134134

135-
constexpr const CipherSuites& getCipherSuites() const noexcept;
135+
// constexpr const CipherSuites& getCipherSuites() const noexcept;
136136

137137
constexpr bool parse(
138138
std::span<const std::byte> payload, const bool isQUIC) noexcept;

‎process-plugin-api/process/common/utils/stringUtils.hpp‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@ auto integerToCharPtrView = std::views::transform(
1010
[](const auto& value) mutable {
1111
static std::array<char, 100> buffer;
1212
auto [end, _] = std::to_chars(buffer.data(), buffer.end(), value);
13-
*end = 0;
14-
return buffer.data();
13+
return std::string_view(buffer.data(), end);
1514
});
1615

1716
constexpr static inline

‎process-plugin-api/process/tls/src/ja4.hpp‎

Lines changed: 19 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
#include <tlsParser/tlsParser.hpp>
99
#include <utils/stringUtils.hpp>
10+
#include <utils/stringViewUtils.hpp>
1011

1112
#include "sha256.hpp"
1213
#include "tlsExport.hpp"
@@ -67,7 +68,7 @@ char alpnByteToLabel(char byte, bool isHighNibble)
6768
}
6869

6970
static
70-
std::string_view getALPNLabel(std::span<std::string_view> alpns)
71+
std::string_view getALPNLabel(std::span<const std::string_view> alpns)
7172
{
7273
std::string alpn_label;
7374
if (alpns.empty() || alpns[0].empty()) {
@@ -151,46 +152,49 @@ std::string_view getTruncatedExtensionsHash(
151152
constexpr std::size_t MAX_STRING_LENGTH
152153
= 2 * MAX_EXTENSIONS * sizeof(uint16_t) + 1;
153154
boost::static_string<MAX_STRING_LENGTH> finalString;
154-
concatenateRangeTo(finalString, sortedExtensions |
155-
rangeToHexString, '-', '_');
155+
concatenateRangeTo(sortedExtensions |
156+
rangeToHexString, finalString, '-', '_');
156157
concatenateRangeTo(signatureAlgorithms |
157158
std::views::drop(1) |
158-
rangeToHexString,
159-
'-');
159+
rangeToHexString, finalString, '-');
160160

161-
return getTruncatedHashHex(finalString);
161+
return getTruncatedHashHex(toStringView(finalString));
162162
}
163163

164164
class JA4 {
165165
public:
166166
constexpr
167167
JA4(const uint8_t l4Protocol,
168-
const HandshakeHeader& handshake,
169-
std::span<std::string_view> serverNames,
170-
std::span<std::string_view> alpns,
168+
const TLSHandshake& handshake,
169+
std::span<const std::string_view> serverNames,
170+
std::span<const std::string_view> alpns,
171171
std::span<const uint16_t> cipherSuites,
172172
std::span<const uint16_t> extensionTypes,
173-
std::span<const uint16_t> signatureAlgorithms
173+
std::span<const uint16_t> signatureAlgorithms,
174+
std::span<const uint16_t> supportedVersions
174175
) noexcept
175176
{
176177
// TODO USE VALUES FROM DISSECTOR
177178
constexpr uint8_t UDP_ID = 17;
178179
value.push_back(l4Protocol == UDP_ID ? 'q' : 't');
179180

180-
value.push_back(getVersionLabel(supportedVersions, handshake));
181+
std::string_view versionLabel = getVersionLabel(supportedVersions, handshake);
182+
value.append(versionLabel.begin(), versionLabel.end());
181183

182184
value.push_back(serverNames.empty() ? 'i' : 'd');
183185

184186
value.push_back(std::min(cipherSuites.size(), 99UL));
185187

186188
value.push_back(std::min(extensionTypes.size(), 99UL));
187189

188-
value.push_back(getALPNLabel(alpns));
190+
std::string_view alpnLabel = getALPNLabel(alpns);
191+
value.append(alpnLabel.begin(), alpnLabel.end());
189192

190-
value.push_back(getTruncatedCipherHash(cipherSuites));
193+
std::string_view cipherHash = getTruncatedCipherHash(cipherSuites);
194+
value.append(cipherHash.begin(), cipherHash.end());
191195

192-
value.push_back(
193-
getTruncatedExtensionsHash(extensionTypes, signatureAlgorithms));
196+
std::string_view extensionsHash = getTruncatedExtensionsHash(extensionTypes, signatureAlgorithms);
197+
value.append(extensionsHash.begin(), extensionsHash.end());
194198
}
195199

196200
std::string_view getView() const noexcept

‎process-plugin-api/process/tls/src/tls.cpp‎

Lines changed: 36 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
#include <functional>
1919
#include <iostream>
2020
#include <numeric>
21+
#include <bit>
2122

2223
#include <pluginManifest.hpp>
2324
#include <pluginRegistrar.hpp>
@@ -26,6 +27,7 @@
2627
#include <fieldManager.hpp>
2728
#include <utils.hpp>
2829
#include <utils/stringUtils.hpp>
30+
#include <utils/spanUtils.hpp>
2931

3032
#include "ja3.hpp"
3133
#include "ja4.hpp"
@@ -102,12 +104,11 @@ bool TLSPlugin::parseClientHelloExtensions(TLSParser& parser) noexcept
102104
switch (extension.type)
103105
{
104106
case TLSExtensionType::SERVER_NAME: {
105-
const std::optional<TLSParser::ServerNames> serverNames
106-
= parser.parseServerNames(extension.payload);
107-
if (!serverNames.has_value()) {
107+
m_serverNames = parser.parseServerNames(extension.payload);
108+
if (!m_serverNames.has_value()) {
108109
return false;
109110
}
110-
concatenateRangeTo(*serverNames, m_exportData.serverNames, 0);
111+
concatenateRangeTo(*m_serverNames, m_exportData.serverNames, 0);
111112
break;
112113
}
113114
case TLSExtensionType::SUPPORTED_GROUPS: {
@@ -184,33 +185,42 @@ bool TLSPlugin::parseServerHelloExtensions(TLSParser& parser) noexcept
184185
});
185186
}
186187

187-
constexpr
188-
void TLSPlugin::saveJA3() noexcept
188+
void TLSPlugin::saveJA3(const TLSParser& parser) noexcept
189189
{
190-
JA3 ja3(parser.get_handshake()->version.version,
191-
toSpan(parser.get_cipher_suits()),
192-
toSpan(m_exportData.extensionTypes),
193-
toSpan(m_exportData.extensionLengths),
194-
toSpan(m_supportedGroups),
195-
toSpan(m_pointFormats)
190+
if (!parser.cipherSuites.has_value()
191+
|| !m_supportedGroups.has_value()
192+
|| !m_pointFormats.has_value()) {
193+
return;
194+
}
195+
196+
JA3 ja3(std::bit_cast<uint16_t>(parser.handshake->version),
197+
toSpan<const uint16_t>(*parser.cipherSuites),
198+
toSpan<const uint16_t>(m_exportData.extensionTypes),
199+
toSpan<const uint16_t>(*m_supportedGroups),
200+
toSpan<const uint8_t>(*m_pointFormats)
196201
);
197202

198203
std::ranges::copy(ja3.getHash(), m_exportData.ja3.begin());
199204
}
200205

201-
constexpr
202-
bool TLSPlugin::saveJA4(const uint8_t l4Protocol) noexcept
206+
void TLSPlugin::saveJA4(const TLSParser& parser, const uint8_t l4Protocol) noexcept
203207
{
204-
if (!m_alpns.has_value() || !m_signatureAlgorithms.has_value()) {
205-
return false;
208+
if (!m_alpns.has_value()
209+
|| !m_signatureAlgorithms.has_value()
210+
|| !parser.cipherSuites.has_value()
211+
|| !m_serverNames.has_value()
212+
|| !m_supportedVersions.has_value()) {
213+
return;
206214
}
207215

208-
JA4 ja4(parser.get_handshake(),
209-
toSpan(parser.getServerNames()),
210-
toSpan(*m_alpns),
211-
toSpan(parser.getCipherSuites()),
212-
toSpan(m_exportData.extensionTypes),
213-
toSpan(*m_signatureAlgorithms)
216+
JA4 ja4(l4Protocol,
217+
*parser.handshake,
218+
toSpan<const std::string_view>(*m_serverNames),
219+
toSpan<const std::string_view>(*m_alpns),
220+
toSpan<const uint16_t>(*parser.cipherSuites),
221+
toSpan<const uint16_t>(m_exportData.extensionTypes),
222+
toSpan<const uint16_t>(*m_signatureAlgorithms),
223+
toSpan<const uint16_t>(*m_supportedVersions)
214224
);
215225

216226
std::ranges::copy(ja4.getView(), m_exportData.ja4.begin());
@@ -225,7 +235,7 @@ bool TLSPlugin::parseTLS(
225235
return false;
226236
}
227237

228-
if (parser.isClienthello()) {
238+
if (parser.isClientHello()) {
229239
if (m_clientHelloParsed) {
230240
return true;
231241
}
@@ -234,10 +244,9 @@ bool TLSPlugin::parseTLS(
234244
return false;
235245
}
236246

237-
m_exportData.version = *reinterpret_cast<const uint16_t*>(
238-
parser.getHandshake()->version);
239-
saveJA3();
240-
saveJA4();
247+
m_exportData.version = std::bit_cast<uint16_t>(parser.handshake->version);
248+
saveJA3(parser);
249+
saveJA4(parser, l4Protocol);
241250

242251
m_clientHelloParsed = true;
243252

‎process-plugin-api/process/tls/src/tls.hpp‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,8 @@ class TLSPlugin : public ProcessPlugin {
5353
private:
5454
constexpr bool parseTLS(
5555
std::span<const std::byte> payload, const uint8_t l4Protocol) noexcept;
56-
constexpr void saveJA3() noexcept;
57-
constexpr void saveJA4() noexcept;
56+
void saveJA3(const TLSParser& parser) noexcept;
57+
void saveJA4(const TLSParser& parser, const uint8_t l4Protocol) noexcept;
5858
bool parseClientHelloExtensions(TLSParser& parser) noexcept;
5959
bool parseServerHelloExtensions(TLSParser& parser) noexcept;
6060

@@ -66,6 +66,7 @@ class TLSPlugin : public ProcessPlugin {
6666
std::optional<TLSParser::SupportedVersions> m_supportedVersions;
6767
std::optional<TLSParser::SupportedGroups> m_supportedGroups;
6868
std::optional<TLSParser::SignatureAlgorithms> m_signatureAlgorithms;
69+
std::optional<TLSParser::ServerNames> m_serverNames;
6970
bool m_clientHelloParsed{false};
7071
bool m_serverHelloParsed{false};
7172

‎process-plugin-api/process/tls/src/tls.o‎

7.57 MB
Binary file not shown.

‎process-plugin-api/process/vlan/src/vlan.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@ ProcessPlugin* VLANPlugin::clone(std::byte* constructAtAddress) const
7676
}
7777

7878
std::string VLANPlugin::getName() const {
79-
return packetStatsPluginManifest.name;
79+
return vlanPluginManifest.name;
8080
}
8181

8282
const void* VLANPlugin::getExportData() const noexcept {

‎process-plugin-api/process/vlan/src/vlan.o‎

3.91 MB
Binary file not shown.

0 commit comments

Comments
 (0)