fix(detection): fix SNI detection in TLS detector
This commit is contained in:
64
ts/detection/utils/fragment-manager.ts
Normal file
64
ts/detection/utils/fragment-manager.ts
Normal file
@@ -0,0 +1,64 @@
|
||||
/**
|
||||
* Fragment Manager for Detection Module
|
||||
*
|
||||
* Manages fragmented protocol data using the shared fragment handler
|
||||
*/
|
||||
|
||||
import { FragmentHandler, type IFragmentOptions } from '../../protocols/common/fragment-handler.js';
|
||||
import type { IConnectionContext } from '../../protocols/common/types.js';
|
||||
|
||||
/**
|
||||
* Detection-specific fragment manager
|
||||
*/
|
||||
export class DetectionFragmentManager {
|
||||
private tlsFragments: FragmentHandler;
|
||||
private httpFragments: FragmentHandler;
|
||||
|
||||
constructor() {
|
||||
// Configure fragment handlers with appropriate limits
|
||||
const tlsOptions: IFragmentOptions = {
|
||||
maxBufferSize: 16384, // TLS record max size
|
||||
timeout: 5000,
|
||||
cleanupInterval: 30000
|
||||
};
|
||||
|
||||
const httpOptions: IFragmentOptions = {
|
||||
maxBufferSize: 8192, // HTTP header reasonable limit
|
||||
timeout: 5000,
|
||||
cleanupInterval: 30000
|
||||
};
|
||||
|
||||
this.tlsFragments = new FragmentHandler(tlsOptions);
|
||||
this.httpFragments = new FragmentHandler(httpOptions);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get fragment handler for protocol type
|
||||
*/
|
||||
getHandler(protocol: 'tls' | 'http'): FragmentHandler {
|
||||
return protocol === 'tls' ? this.tlsFragments : this.httpFragments;
|
||||
}
|
||||
|
||||
/**
|
||||
* Create connection ID from context
|
||||
*/
|
||||
static createConnectionId(context: IConnectionContext): string {
|
||||
return context.id || `${context.sourceIp}:${context.sourcePort}-${context.destIp}:${context.destPort}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Clean up all handlers
|
||||
*/
|
||||
cleanup(): void {
|
||||
this.tlsFragments.cleanup();
|
||||
this.httpFragments.cleanup();
|
||||
}
|
||||
|
||||
/**
|
||||
* Destroy all handlers
|
||||
*/
|
||||
destroy(): void {
|
||||
this.tlsFragments.destroy();
|
||||
this.httpFragments.destroy();
|
||||
}
|
||||
}
|
Reference in New Issue
Block a user