Merge branch 'dev' into config2

Author: IvanNardi

example/ndpiReader.c

@@ -1867,6 +1867,9 @@ static void printFlow(u_int32_t id, struct ndpi_flow_info *flow, u_int16_t threa
     if(flow->ssh_tls.ja3_client[0] != '\0') fprintf(out, "[JA3C: %s%s]", flow->ssh_tls.ja3_client,
 						    print_cipher(flow->ssh_tls.client_unsafe_cipher));
 
+    if(flow->ssh_tls.ja4_client[0] != '\0') fprintf(out, "[JA4: %s%s]", flow->ssh_tls.ja4_client,
+						    print_cipher(flow->ssh_tls.client_unsafe_cipher));
+    
     if(flow->ssh_tls.server_info[0] != '\0') fprintf(out, "[Server: %s]", flow->ssh_tls.server_info);
 
     if(flow->ssh_tls.server_names) fprintf(out, "[ServerNames: %s]", flow->ssh_tls.server_names);
@@ -2919,7 +2922,7 @@ static void printFlowsStats() {
     ndpi_ja3_info *info_of_element = NULL;
     ndpi_host_ja3_fingerprints *tmp = NULL;
     ndpi_ja3_info *tmp2 = NULL;
-    unsigned int num_ja3_client;
+    unsigned int num_ja3_ja4_client;
     unsigned int num_ja3_server;
 
     fprintf(out, "\n");
@@ -3085,14 +3088,14 @@ static void printFlowsStats() {
 
           for(ja3ByHost_element = ja3ByHostsHashT; ja3ByHost_element != NULL;
               ja3ByHost_element = ja3ByHost_element->hh.next) {
-            num_ja3_client = HASH_COUNT(ja3ByHost_element->host_client_info_hasht);
+            num_ja3_ja4_client = HASH_COUNT(ja3ByHost_element->host_client_info_hasht);
             num_ja3_server = HASH_COUNT(ja3ByHost_element->host_server_info_hasht);
 
-            if(num_ja3_client > 0) {
+            if(num_ja3_ja4_client > 0) {
               fprintf(out, "\t%d\t %-24s \t %-7u\n",
                       i,
                       ja3ByHost_element->ip_string,
-                      num_ja3_client
+                      num_ja3_ja4_client
                       );
               i++;
             }
@@ -3117,10 +3120,10 @@ static void printFlowsStats() {
           //ja3ByHost_element: element of ja3ByHostsHashT
           //info_of_element: element of the inner hash table of ja3ByHost_element
           HASH_ITER(hh, ja3ByHostsHashT, ja3ByHost_element, tmp) {
-            num_ja3_client = HASH_COUNT(ja3ByHost_element->host_client_info_hasht);
+            num_ja3_ja4_client = HASH_COUNT(ja3ByHost_element->host_client_info_hasht);
             num_ja3_server = HASH_COUNT(ja3ByHost_element->host_server_info_hasht);
             againstRepeat = 0;
-            if(num_ja3_client > 0) {
+            if(num_ja3_ja4_client > 0) {
               HASH_ITER(hh, ja3ByHost_element->host_client_info_hasht, info_of_element, tmp2) {
                 fprintf(out, "\t%-7d %-24s %s %s\n",
                         i,

example/reader_util.c

@@ -1322,6 +1322,8 @@ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_fl
     flow->ssh_tls.notAfter = flow->ndpi_flow->protos.tls_quic.notAfter;
     ndpi_snprintf(flow->ssh_tls.ja3_client, sizeof(flow->ssh_tls.ja3_client), "%s",
 	     flow->ndpi_flow->protos.tls_quic.ja3_client);
+    ndpi_snprintf(flow->ssh_tls.ja4_client, sizeof(flow->ssh_tls.ja4_client), "%s",
+	     flow->ndpi_flow->protos.tls_quic.ja4_client);
     ndpi_snprintf(flow->ssh_tls.ja3_server, sizeof(flow->ssh_tls.ja3_server), "%s",
 	     flow->ndpi_flow->protos.tls_quic.ja3_server);
     flow->ssh_tls.server_unsafe_cipher = flow->ndpi_flow->protos.tls_quic.server_unsafe_cipher;

example/reader_util.h

@@ -273,7 +273,7 @@ typedef struct ndpi_flow_info {
       client_hassh[33], server_hassh[33], *server_names,
       *advertised_alpns, *negotiated_alpn, *tls_supported_versions,
       *tls_issuerDN, *tls_subjectDN,
-      ja3_client[33], ja3_server[33],
+      ja3_client[33], ja3_server[33], ja4_client[37],
       sha1_cert_fingerprint[20];
     u_int8_t sha1_cert_fingerprint_set;
     struct tls_heuristics browser_heuristics;

src/include/ndpi_api.h

@@ -1654,6 +1654,8 @@ extern "C" {
   /* ******************************* */
 
   void ndpi_md5(const u_char *data, size_t data_len, u_char hash[16]);
+  void ndpi_sha256(const u_char *data, size_t data_len, u_int8_t sha_hash[32]);
+  
   u_int16_t ndpi_crc16_ccit(const void* data, size_t n_bytes);
   u_int16_t ndpi_crc16_ccit_false(const void *data, size_t n_bytes);
   u_int16_t ndpi_crc16_xmodem(const void *data, size_t n_bytes);

src/include/ndpi_typedefs.h

@@ -1386,7 +1386,7 @@ struct ndpi_flow_struct {
     struct {
       char *server_names, *advertised_alpns, *negotiated_alpn, *tls_supported_versions, *issuerDN, *subjectDN;
       u_int32_t notBefore, notAfter;
-      char ja3_client[33], ja3_server[33];
+      char ja3_client[33], ja3_server[33], ja4_client[37];
       u_int16_t server_cipher;
       u_int8_t sha1_certificate_fingerprint[20];
       u_int8_t hello_processed:1, ch_direction:1, subprotocol_detected:1, fingerprint_set:1, _pad:4;
@@ -1570,11 +1570,11 @@ struct ndpi_flow_struct {
 
 #if !defined(NDPI_CFFI_PREPROCESSING) && defined(__linux__)
 #if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 201112L
-_Static_assert(sizeof(((struct ndpi_flow_struct *)0)->protos) <= 216,
-               "Size of the struct member protocols increased to more than 216 bytes, "
+_Static_assert(sizeof(((struct ndpi_flow_struct *)0)->protos) <= 256,
+               "Size of the struct member protocols increased to more than 256 bytes, "
                "please check if this change is necessary.");
-_Static_assert(sizeof(struct ndpi_flow_struct) <= 968,
-               "Size of the flow struct increased to more than 968 bytes, "
+_Static_assert(sizeof(struct ndpi_flow_struct) <= 1008,
+               "Size of the flow struct increased to more than 1008 bytes, "
                "please check if this change is necessary.");
 #endif
 #endif

src/lib/ndpi_main.c

@@ -125,6 +125,7 @@
 /* Third party libraries */
 #include "third_party/include/ndpi_patricia.h"
 #include "third_party/include/ndpi_md5.h"
+#include "third_party/include/ndpi_sha256.h"
 
 #ifdef HAVE_NBPF
 #include "nbpf.h"
@@ -9926,6 +9927,16 @@ void ndpi_md5(const u_char *data, size_t data_len, u_char hash[16]) {
 
 /* ******************************************************************** */
 
+void ndpi_sha256(const u_char *data, size_t data_len, u_int8_t sha_hash[32]) {
+  ndpi_SHA256_CTX sha_ctx;
+
+  ndpi_sha256_init(&sha_ctx);
+  ndpi_sha256_update(&sha_ctx, data, data_len);
+  ndpi_sha256_final(&sha_ctx, sha_hash);
+}
+
+/* ******************************************************************** */
+
 static int enough(int a, int b) {
   u_int8_t percentage = 20;