FoxIO-LLC / ja4

JA4+ is a suite of network fingerprinting standards
https://foxio.io
Other
989 stars 85 forks source link

ja4: Fix parsing of `tshark --version` output #165

Closed vvv closed 2 months ago

vvv commented 2 months ago

Problem

cargo test fails on CI:

test tls::tests::test_client_stats_into_out ... ok
test test_insta ... FAILED

failures:

---- test_insta stdout ----
thread 'test_insta' panicked at ja4/src/lib.rs:233:34:
called `Result::unwrap()` on an `Err` value: ParseTsharkSemver(Error("unexpected character '.' after patch version number"))
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

failures:
    test_insta

test result: FAILED. 16 passed; 1 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.15s

Analysis

The Rust ja4 app parses the output of tshark --version. The app expected the version number to be followed by a space, e.g. "TShark (Wireshark) 4.4.0 (v4.4.0-0-g009a163470b5).\n". It failed on "TShark (Wireshark) 4.4.0.\n".

Solution

Improve the parsing logic.