Use Aho-Corasick algorithm in tls parsing

This commit is contained in:
Vadim Vetrov
2025-02-02 23:34:10 +03:00
parent d225e673c7
commit f7d0bed7aa
7 changed files with 117 additions and 137 deletions

View File

@@ -36,22 +36,21 @@ TEST(TLSTest, Test_CHLO_message_detect)
TEST(TLSTest, Test_Bruteforce_detects)
{
struct tls_verdict tlsv;
struct domains_list dmns = {
.domain_name = "youtube.com",
.domain_len = 11,
.next = NULL
};
sconf.sni_domains = &dmns;
struct trie_container trie;
int ret;
ret = trie_init(&trie);
ret = trie_add_string(&trie, (uint8_t *)"youtube.com", 11);
sconf.sni_domains = trie;
int ret = bruteforce_analyze_sni_str(&sconf, (const uint8_t *)tls_bruteforce_message, sizeof(tls_bruteforce_message) - 1, &tlsv);
ret = bruteforce_analyze_sni_str(&sconf, (const uint8_t *)tls_bruteforce_message, sizeof(tls_bruteforce_message) - 1, &tlsv);
TEST_ASSERT_EQUAL(0, ret);
TEST_ASSERT_EQUAL(11, tlsv.sni_len);
TEST_ASSERT_EQUAL_STRING_LEN("youtube.com", tlsv.sni_ptr, 11);
TEST_ASSERT_EQUAL_PTR(tls_bruteforce_message +
sizeof(tls_bruteforce_message) - 12, tlsv.sni_ptr);
trie_destroy(&trie);
}
TEST_GROUP_RUNNER(TLSTest)
{
RUN_TEST_CASE(TLSTest, Test_CHLO_message_detect);

View File

@@ -95,10 +95,53 @@ TEST(TrieTest, Trie_string_finds_opt_end)
trie_destroy(&trie);
}
TEST(TrieTest, Trie_single_vertex)
{
int ret;
size_t offset;
size_t offlen;
struct trie_container trie;
ret = trie_init(&trie);
ret = trie_process_str(&trie,
(uint8_t *)tstr, sizeof(tstr) - 1,
0,
&offset, &offlen
);
TEST_ASSERT_EQUAL(0, ret);
trie_destroy(&trie);
}
TEST(TrieTest, Trie_uninitialized)
{
int ret;
size_t offset;
size_t offlen;
struct trie_container trie = {0};
// ret = trie_init(&trie);
ret = trie_add_string(&trie, (uint8_t *)ASTR, sizeof(ASTR) - 1);
TEST_ASSERT_EQUAL(-EINVAL, ret);
ret = trie_process_str(&trie,
(uint8_t *)tstr, sizeof(tstr) - 1,
0,
&offset, &offlen
);
TEST_ASSERT_EQUAL(0, ret);
}
TEST_GROUP_RUNNER(TrieTest)
{
RUN_TEST_CASE(TrieTest, Trie_string_adds);
RUN_TEST_CASE(TrieTest, Trie_string_finds);
RUN_TEST_CASE(TrieTest, Trie_string_finds_opt_end);
RUN_TEST_CASE(TrieTest, Trie_single_vertex);
RUN_TEST_CASE(TrieTest, Trie_uninitialized);
}