FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards
https://foxio.io
Other
774 stars 65 forks source link

Wireshark: use nstime helper functions #104

Closed Boolean263 closed 1 month ago

Boolean263 commented 1 month ago

Make more use of Wireshark's utility functions for nstime_ts for code clarity.

Use nstime_copy() instead of individually copying member attributes.

Use nstime_is_zero() to test for an unchanged timestamp instead of inconsistently testing .secs == 0 or .nsecs == 0 in different places.

Define a constant MAX_SYN_ACK_TIMES to replace the hardcoded magic number of elements in syn_ack_times. Fix an array bounds overflow that could happen when this size limit was hit.

Fix an apparent copy-paste error where timestamp_D was being tested but timestamp_C was being assigned to.