Implemented nDPI server fingerprint (#3139)

Author: lucaderi

example/ndpiReader.c

@@ -2569,9 +2569,12 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
 	fprintf(out, "[Risk Info: %s]", flow->risk_str);
     }
 
-    if(flow->ndpi_fingerprint)
-      fprintf(out, "[nDPI Fingerprint: %s]", flow->ndpi_fingerprint);
-
+    if(flow->ndpi_client_fingerprint)
+      fprintf(out, "[nDPI Cli Fingerprint: %s]", flow->ndpi_client_fingerprint);
+  
+    if(flow->ndpi_server_fingerprint)
+      fprintf(out, "[nDPI Srv Fingerprint: %s]", flow->ndpi_server_fingerprint);
+    
     if(flow->tcp_fingerprint)
       fprintf(out, "[TCP Fingerprint: %s]", flow->tcp_fingerprint);
 

example/reader_util.c

@@ -529,9 +529,14 @@ static void ndpi_free_flow_tls_data(struct ndpi_flow_info *flow) {
     flow->ssh_tls.ja4_client_raw = NULL;
   }
 
-  if(flow->ndpi_fingerprint) {
-    ndpi_free(flow->ndpi_fingerprint);
-    flow->ndpi_fingerprint = NULL;
+  if(flow->ndpi_client_fingerprint) {
+    ndpi_free(flow->ndpi_client_fingerprint);
+    flow->ndpi_client_fingerprint = NULL;
+  }
+
+  if(flow->ndpi_server_fingerprint) {
+    ndpi_free(flow->ndpi_server_fingerprint);
+    flow->ndpi_server_fingerprint = NULL;
   }
 
   if(flow->stun.mapped_address.aps) {
@@ -1550,8 +1555,11 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
     ndpi_snprintf(flow->ssh_tls.ja4_client, sizeof(flow->ssh_tls.ja4_client), "%s",
 	     flow->ndpi_flow->protos.tls_quic.ja4_client);
 
-    if(flow->ndpi_flow->ndpi.fingerprint)
-      flow->ndpi_fingerprint = ndpi_strdup(flow->ndpi_flow->ndpi.fingerprint);
+    if(flow->ndpi_flow->ndpi.client_fingerprint)
+      flow->ndpi_client_fingerprint = ndpi_strdup(flow->ndpi_flow->ndpi.client_fingerprint);
+
+    if(flow->ndpi_flow->ndpi.server_fingerprint)
+      flow->ndpi_server_fingerprint = ndpi_strdup(flow->ndpi_flow->ndpi.server_fingerprint);
 
     if(flow->ndpi_flow->protos.tls_quic.ja4_client_raw)
       flow->ssh_tls.ja4_client_raw = ndpi_strdup(flow->ndpi_flow->protos.tls_quic.ja4_client_raw);

example/reader_util.h

@@ -352,7 +352,7 @@ typedef struct ndpi_flow_info {
   u_int8_t multimedia_flow_types;
 
   void *src_id, *dst_id;
-  char *tcp_fingerprint, *ndpi_fingerprint;
+  char *tcp_fingerprint, *ndpi_client_fingerprint, *ndpi_server_fingerprint;
   struct ndpi_entropy *entropy;
   struct ndpi_entropy *last_entropy;
 

src/include/ndpi_typedefs.h

@@ -1661,7 +1661,7 @@ struct ndpi_flow_struct {
   } tcp;
 
   struct {
-    char *fingerprint;
+    char *client_fingerprint, *server_fingerprint;
   } ndpi;
 
   /*

src/lib/ndpi_fingerprint.c

@@ -241,7 +241,7 @@ u_int64_t ndpi_compare_flow_tls_blocks(struct ndpi_detection_module_struct *ndpi
 char* ndpi_compute_ndpi_flow_fingerprint(struct ndpi_detection_module_struct *ndpi_str,
 					 struct ndpi_flow_struct *flow) {
   if(ndpi_str->cfg.ndpi_fingerprint_enabled &&
-     (flow->ndpi.fingerprint == NULL) &&
+     (flow->ndpi.client_fingerprint == NULL) &&
      ndpi_stack_is_tls_like(&flow->protocol_stack) &&
      /*
        We need TCP & TLS handshake. What should we do if we don't have them?
@@ -304,16 +304,16 @@ char* ndpi_compute_ndpi_flow_fingerprint(struct ndpi_detection_module_struct *nd
 		    sha_hash[12], sha_hash[13], sha_hash[14], sha_hash[15]
 		    );
 
-      flow->ndpi.fingerprint = ndpi_strdup((char*)fp_buf);
+      flow->ndpi.client_fingerprint = ndpi_strdup((char*)fp_buf);
 
-      if((flow->ndpi.fingerprint != NULL)
+      if((flow->ndpi.client_fingerprint != NULL)
 	 && (ndpi_str->ndpifp_custom_protos != NULL)) {
 	u_int64_t proto_id;
 	ndpi_list *extra_data = NULL;
 
 	/* This protocol has been defined in protos.txt-like files */
 	if(ndpi_hash_find_entry_extra(ndpi_str->ndpifp_custom_protos,
-				      flow->ndpi.fingerprint, strlen(flow->ndpi.fingerprint),
+				      flow->ndpi.client_fingerprint, strlen(flow->ndpi.client_fingerprint),
 				      &proto_id, &extra_data) == 0) {
 
 	  proto_id = ndpi_compare_flow_tls_blocks(ndpi_str, flow, extra_data, proto_id);
@@ -331,5 +331,5 @@ char* ndpi_compute_ndpi_flow_fingerprint(struct ndpi_detection_module_struct *nd
     }
   }
 
-  return(flow->ndpi.fingerprint);
+  return(flow->ndpi.client_fingerprint);
 }

src/lib/ndpi_main.c

@@ -8035,8 +8035,11 @@ void ndpi_free_flow_data(struct ndpi_flow_struct* flow) {
     if(flow->tcp.fingerprint_raw)
       ndpi_free(flow->tcp.fingerprint_raw);
 
-    if(flow->ndpi.fingerprint)
-      ndpi_free(flow->ndpi.fingerprint);
+    if(flow->ndpi.client_fingerprint)
+      ndpi_free(flow->ndpi.client_fingerprint);
+
+    if(flow->ndpi.server_fingerprint)
+      ndpi_free(flow->ndpi.server_fingerprint);
 
     if(flow->http.url)
       ndpi_free(flow->http.url);

src/lib/ndpi_utils.c

@@ -2154,9 +2154,18 @@ int ndpi_flow2json(struct ndpi_detection_module_struct *ndpi_struct,
   if(flow->tcp.fingerprint_raw)
     ndpi_serialize_string_string(serializer, "tcp_fingerprint_raw", flow->tcp.fingerprint_raw);
 
-  if(flow->ndpi.fingerprint)
-    ndpi_serialize_string_string(serializer, "ndpi_fingerprint", flow->ndpi.fingerprint);
+  if(flow->ndpi.client_fingerprint || flow->ndpi.server_fingerprint) {
+    ndpi_serialize_start_of_block(serializer, "ndpi_fingerprint");
 
+    if(flow->ndpi.client_fingerprint)
+      ndpi_serialize_string_string(serializer, "client", flow->ndpi.client_fingerprint);
+
+    if(flow->ndpi.server_fingerprint)
+      ndpi_serialize_string_string(serializer, "server", flow->ndpi.server_fingerprint);
+
+    ndpi_serialize_end_of_block(serializer);
+  }
+  
   ndpi_serialize_string_string(serializer, "proto",
 			       ndpi_get_ip_proto_name(l4_protocol,
 						      l4_proto_name, sizeof(l4_proto_name)));
@@ -4004,10 +4013,20 @@ int ndpi_snprintf(char * str, size_t size, char const * format, ...) {
   va_list va_args;
 
   va_start(va_args, format);
-  int ret = ndpi_vsnprintf(str, size, format, va_args);
+  int rc = ndpi_vsnprintf(str, size, format, va_args);
   va_end(va_args);
 
-  return ret;
+  /*
+    ndpi_snprintf wraps standard snprintf, which returns the number of characters that would
+    have been written (not the number actually written) when the output is truncated.
+    So if rc >= size, only size - 1 characters were actually written, but tls_s_len is
+    advanced by rc. This has two consequences:
+  */
+
+  if(rc >= (int)size)
+    rc = size - 1;
+  
+  return(rc);
 }
 
 /* ******************************************* */