update
This commit is contained in:
@@ -5,7 +5,7 @@
|
||||
// TLS detector doesn't need plugins imports
|
||||
import type { IProtocolDetector } from '../models/interfaces.js';
|
||||
import type { IDetectionResult, IDetectionOptions, IConnectionInfo } from '../models/detection-types.js';
|
||||
import { readUInt16BE, BufferAccumulator } from '../utils/buffer-utils.js';
|
||||
import { readUInt16BE } from '../utils/buffer-utils.js';
|
||||
import { tlsVersionToString } from '../utils/parser-utils.js';
|
||||
|
||||
// Import from protocols
|
||||
@@ -24,17 +24,6 @@ export class TlsDetector implements IProtocolDetector {
|
||||
*/
|
||||
private static readonly MIN_TLS_HEADER_SIZE = 5;
|
||||
|
||||
/**
|
||||
* Fragment tracking for incomplete handshakes
|
||||
*/
|
||||
private static fragmentedBuffers = new Map<string, BufferAccumulator>();
|
||||
|
||||
/**
|
||||
* Create connection ID from context
|
||||
*/
|
||||
private createConnectionId(context: { sourceIp?: string; sourcePort?: number; destIp?: string; destPort?: number }): string {
|
||||
return `${context.sourceIp || 'unknown'}:${context.sourcePort || 0}->${context.destIp || 'unknown'}:${context.destPort || 0}`;
|
||||
}
|
||||
|
||||
/**
|
||||
* Detect TLS protocol from buffer
|
||||
@@ -224,29 +213,11 @@ export class TlsDetector implements IProtocolDetector {
|
||||
*/
|
||||
detectWithContext(
|
||||
buffer: Buffer,
|
||||
context: { sourceIp?: string; sourcePort?: number; destIp?: string; destPort?: number },
|
||||
_context: { sourceIp?: string; sourcePort?: number; destIp?: string; destPort?: number },
|
||||
options?: IDetectionOptions
|
||||
): IDetectionResult | null {
|
||||
const connectionId = this.createConnectionId(context);
|
||||
|
||||
// Get or create buffer accumulator for this connection
|
||||
let accumulator = TlsDetector.fragmentedBuffers.get(connectionId);
|
||||
if (!accumulator) {
|
||||
accumulator = new BufferAccumulator();
|
||||
TlsDetector.fragmentedBuffers.set(connectionId, accumulator);
|
||||
}
|
||||
|
||||
// Add new data
|
||||
accumulator.append(buffer);
|
||||
|
||||
// Try detection on accumulated data
|
||||
const result = this.detect(accumulator.getBuffer(), options);
|
||||
|
||||
// If detection is complete or we have too much data, clean up
|
||||
if (result?.isComplete || accumulator.length() > 65536) {
|
||||
TlsDetector.fragmentedBuffers.delete(connectionId);
|
||||
}
|
||||
|
||||
return result;
|
||||
// This method is deprecated - TLS detection should use the fragment manager
|
||||
// from the parent detector system, not maintain its own fragments
|
||||
return this.detect(buffer, options);
|
||||
}
|
||||
}
|
Reference in New Issue
Block a user