diff --git a/src/tsg_entry.cpp b/src/tsg_entry.cpp index 06cdf0e..51c79e4 100644 --- a/src/tsg_entry.cpp +++ b/src/tsg_entry.cpp @@ -1514,15 +1514,27 @@ int session_l7_protocol_identify(const struct streaminfo *a_stream, struct sessi if(g_tsg_para.proto_flag&(1<quic_version=quic_protocol_identify((struct streaminfo *)a_stream, a_packet, sni_buff, &sni_len, ua_buff, &ua_len); - if(srt_process_context->quic_version > 0) + struct quic_info *q_info=quic_protocol_identify(a_stream); + if(q_info!=NULL) { srt_process_context->proto=PROTO_QUIC; - srt_process_context->quic_sni=malloc_copy_string(sni_buff, sni_len, a_stream->threadnum); - srt_process_context->quic_ua=malloc_copy_string(ua_buff, ua_len, a_stream->threadnum); + srt_process_context->quic_version=q_info->quic_version; + + if(q_info->client_hello==NULL) + { + return 1; + } + + if(q_info->client_hello->sni!=NULL) + { + srt_process_context->quic_sni=malloc_copy_string(q_info->client_hello->sni, strlen(q_info->client_hello->sni), a_stream->threadnum); + } + + if(q_info->client_hello->user_agent!=NULL) + { + srt_process_context->quic_ua=malloc_copy_string(q_info->client_hello->user_agent, strlen(q_info->client_hello->user_agent), a_stream->threadnum); + } + return 1; } } @@ -1537,7 +1549,7 @@ int session_l7_protocol_identify(const struct streaminfo *a_stream, struct sessi { srt_process_context->proto=PROTO_SIP; return 1; - } + } } if(g_tsg_para.proto_flag&(1< #include +#include + #include "gtest_common.h" #include "tsg_entry.h" #include "tsg_sync_state.h" @@ -1104,6 +1106,63 @@ TEST(TSGMaster, SessionApplicationFullPath) EXPECT_STREQ("ssl.https.built_in_youtube", out_full_path); } +extern struct quic_info *g_test_quic_info; +extern int session_l7_protocol_identify(const struct streaminfo * a_stream, struct session_runtime_process_context * srt_process_context, void * a_packet); + +TEST(TSGMaster, SessionQuicIdentify) +{ + struct streaminfo a_stream={0}; + struct tcpdetail pdetail={0}; + a_stream.type=STREAM_TYPE_UDP; + a_stream.ptcpdetail=&pdetail; + struct session_runtime_process_context srt_process_context={0}; + + int ret=session_l7_protocol_identify((const struct streaminfo *)&a_stream, &srt_process_context, NULL); + EXPECT_EQ(0, ret); + + struct quic_info quic_info_1; + quic_info_1.client_hello=NULL; + quic_info_1.quic_version=0x00000001; + g_test_quic_info=&quic_info_1; + ret=session_l7_protocol_identify((const struct streaminfo *)&a_stream, &srt_process_context, NULL); + EXPECT_EQ(1, ret); + EXPECT_EQ(0x00000001, srt_process_context.quic_version); + g_test_quic_info=NULL; + + struct quic_info quic_info_2; + struct quic_client_hello chello_2={(char *)"google.com", NULL}; + quic_info_2.client_hello=&chello_2; + quic_info_2.quic_version=0x00000001; + g_test_quic_info=&quic_info_2; + ret=session_l7_protocol_identify((const struct streaminfo *)&a_stream, &srt_process_context, NULL); + EXPECT_EQ(1, ret); + EXPECT_EQ(0x00000001, srt_process_context.quic_version); + EXPECT_STREQ("google.com", srt_process_context.quic_sni); + dictator_free(0, (void *)srt_process_context.quic_sni); + srt_process_context.quic_sni=NULL; + EXPECT_EQ(nullptr, srt_process_context.quic_ua); + g_test_quic_info=NULL; + + + struct quic_info quic_info_3; + struct quic_client_hello chello_3={(char *)"google.com", (char *)"Android"}; + quic_info_3.client_hello=&chello_3; + quic_info_3.quic_version=0x00000001; + g_test_quic_info=&quic_info_3; + ret=session_l7_protocol_identify((const struct streaminfo *)&a_stream, &srt_process_context, NULL); + EXPECT_EQ(1, ret); + EXPECT_EQ(0x00000001, srt_process_context.quic_version); + EXPECT_STREQ("google.com", srt_process_context.quic_sni); + dictator_free(0, (void *)srt_process_context.quic_sni); + srt_process_context.quic_sni=NULL; + + EXPECT_STREQ("Android", srt_process_context.quic_ua); + dictator_free(0, (void *)srt_process_context.quic_ua); + srt_process_context.quic_ua=NULL; + + g_test_quic_info=NULL; +} + int main(int argc, char *argv[]) { TSG_MASTER_INIT(); diff --git a/test/src/gtest_protocol.cpp b/test/src/gtest_protocol.cpp deleted file mode 100644 index 14a2266..0000000 --- a/test/src/gtest_protocol.cpp +++ /dev/null @@ -1,86 +0,0 @@ -#include - -extern "C" void *http_field_parser(const char* buf, unsigned int buflen, int http_dir) -{ - return NULL; -} - -extern "C" int http_get_filed_result(void *result, long long field_flag, char **field_value) -{ - return 0; -} - -extern "C" void http_free_filed_result(void *result) -{ -} - -extern "C" int ftp_control_identify(struct streaminfo *a_tcp) -{ - return 0; -} - -int g_gtest_ftp_data_flag=0; -void gtest_set_ftp_data_flag(void) -{ - g_gtest_ftp_data_flag=1; -} - -void gtest_clean_ftp_data_flag(void) -{ - g_gtest_ftp_data_flag=0; -} - -extern "C" int ftp_data_identify(struct streaminfo *a_tcp) -{ - return g_gtest_ftp_data_flag; -} - -extern "C" int mail_protocol_identify_by_first_payload(struct streaminfo *a_tcp, char *payload, int payload_len, int thread_seq) -{ - return 0; -} - -extern "C" char stratum_identify(struct streaminfo* pstream,void** pme,int thread_seq,const void* a_packet) -{ - return 0; -} - -extern "C" int rdp_protocol_identify(const char *payload, unsigned int payload_len, int thread_seq) -{ - return 0; -} - -extern "C" int rdpudp_protocol_identify(const char *payload, unsigned int payload_len, int thread_seq) -{ - return 0; -} - -int quic_version_int2string(unsigned int version, char *buff, int buff_len) -{ - return 0; -} - -unsigned int quic_protocol_identify(struct streaminfo *a_stream, void *a_packet, char *out_sni, int *out_sni_len, char *out_ua, int *out_ua_len) -{ - return 0; -} - -extern "C" unsigned char sip_identify_from_to(char* buff,UINT32 buflen,char** from,UINT32* from_len,char** to,UINT32* to_len) -{ - return 0; -} - -extern "C" int dtls_parse_sni(const char *udp_payload, int udp_payload_len, char *servername, int servername_len) -{ - return 0; -} - -extern "C" bool dtls_identifyStream(struct streaminfo *a_udp) -{ - return 0; -} - -extern "C" struct _ssl_ja3_info_t *ssl_get_ja3_fingerprint(struct streaminfo *stream, unsigned char *payload, int payload_len, int thread_seq) -{ - return NULL; -}