[sans-io] fix nextlayer logic

This commit is contained in:
Maximilian Hils 2020-11-23 03:07:30 +01:00
parent 485c8eb3e9
commit 0d42499799

View File

@ -63,7 +63,7 @@ class NextLayer:
if not ctx.options.ignore_hosts and not ctx.options.allow_hosts: if not ctx.options.ignore_hosts and not ctx.options.allow_hosts:
return False return False
addresses: typing.List[str] = [context.server.address] addresses: typing.List[str] = [context.server.address[0]]
if is_tls_record_magic(data_client): if is_tls_record_magic(data_client):
try: try:
sni = parse_client_hello(data_client).sni sni = parse_client_hello(data_client).sni
@ -129,22 +129,22 @@ class NextLayer:
# 4. Check for --tcp # 4. Check for --tcp
if any( if any(
address and re.search(rex, address, re.IGNORECASE) address and rex.search(address)
for address in (context.server.address, context.client.sni) for address in (context.server.address[0], context.client.sni.decode("idna"))
for rex in ctx.options.allow_hosts for rex in self.tcp_hosts
): ):
return layers.TCPLayer(context) return layers.TCPLayer(context)
# 5. Check for raw tcp mode. # 5. Check for raw tcp mode.
sni_indicates_non_http = ( alpn_indicates_non_http = (
context.client.sni and context.client.sni not in HTTP_ALPNS context.client.alpn and context.client.alpn not in HTTP_ALPNS
) )
# Very simple heuristic here - the first three bytes should be # Very simple heuristic here - the first three bytes should be
# the HTTP verb, so A-Za-z is expected. # the HTTP verb, so A-Za-z is expected.
probably_no_http = ( probably_no_http = (
not data_client[:3].isalpha() not data_client[:3].isalpha()
) )
if ctx.options.rawtcp and (sni_indicates_non_http or probably_no_http): if ctx.options.rawtcp and (alpn_indicates_non_http or probably_no_http):
return layers.TCPLayer(context) return layers.TCPLayer(context)
# 6. Assume HTTP by default. # 6. Assume HTTP by default.