From fbedc55d5aa861c381701c9f913b34ee7ab57ec4 Mon Sep 17 00:00:00 2001 From: srdusr <99972264+srdusr@users.noreply.github.com> Date: Tue, 21 May 2024 22:24:00 +0200 Subject: Add GUI parity for -c/-a, mDNS/SSH dissectors, and two new fuzz harnesses GUI parity: checksum_status()/reassembled_http_status() moved out of main.cpp into a shared wireframe/packet_diagnostics.hpp so the GUI can show the same -c/-a diagnostics for the selected packet without duplicating the Ethernet/IPv4/TCP walk. Visually verified under Xvfb with the same split-segment scenario used to verify -a on the CLI. Two new L7 dissectors: mDNS (reuses parse_dns outright - RFC 6762 keeps DNS's wire format, just a different port) and SSH's cleartext identification banner. Live-verified against this machine's real sshd and a real DNS-wire-format packet sent to port 5353. Two new fuzz harnesses (fuzz_checksum, fuzz_tcp_reassembly) covering code added here that the original nine harnesses never touched. All 12 run clean across ~90M executions with no crashes. NAMES.md and PLAN.md updated with this round's decisions and naming candidates. --- include/wireframe/summarize.hpp | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) (limited to 'include/wireframe/summarize.hpp') diff --git a/include/wireframe/summarize.hpp b/include/wireframe/summarize.hpp index e7e9ae3..840ddf9 100644 --- a/include/wireframe/summarize.hpp +++ b/include/wireframe/summarize.hpp @@ -11,6 +11,8 @@ #include "wireframe/l7/dissector.hpp" #include "wireframe/l7/dns.hpp" #include "wireframe/l7/http.hpp" +#include "wireframe/l7/mdns.hpp" +#include "wireframe/l7/ssh.hpp" #include "wireframe/l7/tls.hpp" #include "wireframe/net/ethernet.hpp" #include "wireframe/net/icmp.hpp" @@ -57,16 +59,24 @@ inline std::string tcp_flags_to_string(std::uint8_t flags) { // DNS alone never did, since it only ever runs over UDP port 53. TLS // (also TCP, port 443) covers what HTTP increasingly can't: most web // traffic today is encrypted, and SNI is the one piece of a TLS -// handshake still readable without decrypting anything. +// handshake still readable without decrypting anything. mDNS reuses +// DNS's own parser (same wire format, different port/label) at +// essentially no extra cost. SSH is the first dissector whose *entire* +// protocol is one cleartext line before everything else encrypts -- +// unlike TLS's SNI, there's nothing further to ever add here. inline const net::L7Registry& l7_registry() { static const net::DnsDissector dns_dissector; static const net::HttpDissector http_dissector; static const net::TlsSniDissector tls_dissector; + static const net::MdnsDissector mdns_dissector; + static const net::SshDissector ssh_dissector; static const net::L7Registry registry = [] { net::L7Registry r; r.add(&dns_dissector); r.add(&http_dissector); r.add(&tls_dissector); + r.add(&mdns_dissector); + r.add(&ssh_dissector); return r; }(); return registry; -- cgit v1.2.3