Skip to content

Commit dfe59f6

Browse files
IvanNardiIvanNardi
committed
config: remove enum ndpi_prefs 
1 parent db7589d commit dfe59f6

22 files changed

+74
-88
lines changed

‎doc/configuration_parameters.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ TODO
77
| ------ | ------ | ------ | ------ | ------ | ------ | ------ |
88
| NULL | "packets_limit_per_flow" | 32 | 0 | 255 | The upper limit on the number of packets per flow that will be subject to DPI, after which classification will be considered complete (0 = no limit) |
99
| NULL | "flow.direction_detection.enable" | 1 | NULL | NULL | Enable/disable internal detection of packet direction (client to server or server to client) |
10+
| NULL | "flow.track_payload.enable" | 0 | NULL | NULL | Enable/disable tracking/export of flow payload (i.e. L5/7 data) |
11+
| NULL | "tcp_ack_payload_heuristic.enable" | 0 | NULL | NULL | In some networks, there are some anomalous TCP flows where the smallest ACK packets have some kind of zero padding. It looks like the IP and TCP headers in those frames wrongly consider the 0x00 Ethernet padding bytes as part of the TCP payload. While this kind of packets is perfectly valid per-se, in some conditions they might be treated by the TCP reassembler logic as (partial) overlaps, deceiving the classification engine. This parameter enable/disable an heuristic to detect these packets and to ignore them, allowing correct detection/classification. See #1946 for other details |
12+
| NULL | "fully_encrypted_heuristic.enable" | 1 | NULL | NULL | Enable/disable an heuristic to detect fully encrypted sessions, i.e. flows where every bytes of the payload is encrypted in an attempt to “look like nothing”. This heuristic only analyzes the first packet of the flow. See: https://www.usenix.org/system/files/sec23fall-prepub-234-wu-mingshi.pdf |
13+
| NULL | "libgcrypt.init" | 1 | NULL | NULL | Enable/disable initialization of libgcrypt. When using the external libgcrypt (instead of the internal crypto code) the libgcrypt runtime must be initialized. If, for whatever reasons, the application alread does it, nDPI must be told to skip it |
1014
| NULL | "flow_risk_lists.load" | 1 | NULL | NULL | Enable/disable loading of every IP addresses lists used to check any flow risks |
1115
| NULL | "flow_risk.anonymous_subscriber.list.icloudprivaterelay.load" | 1 | NULL | NULL | Enable/disable loading of internal iCouldPrivateRealy IP address list used to check `NDPI_ANONYMOUS_SUBSCRIBER` flow risk |
1216
| NULL | "flow_risk.anonymous_subscriber.list.protonvpn.load" | 1 | NULL | NULL | Enable/disable loading of internal IP address list of ProtonVPN exit nodes used to check `NDPI_ANONYMOUS_SUBSCRIBER` flow risk |

‎example/ndpiReader.c‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,6 @@ int nDPI_LogLevel = 0;
108108
char *_debug_protocols = NULL;
109109
char *_disabled_protocols = NULL;
110110
static u_int8_t stats_flag = 0;
111-
ndpi_init_prefs init_prefs = ndpi_no_prefs | ndpi_enable_tcp_ack_payload_heuristic;
112111
u_int8_t human_readeable_string_len = 5;
113112
u_int8_t max_num_udp_dissected_pkts = 24 /* 8 is enough for most protocols, Signal and SnapchatCall require more */, max_num_tcp_dissected_pkts = 80 /* due to telnet */;
114113
static u_int32_t pcap_analysis_duration = (u_int32_t)-1;
@@ -331,7 +330,7 @@ void ndpiCheckHostStringMatch(char *testChar) {
331330
if(!testChar)
332331
return;
333332

334-
ndpi_str = ndpi_init_detection_module(init_prefs);
333+
ndpi_str = ndpi_init_detection_module();
335334
ndpi_finalize_initialization(ndpi_str);
336335

337336
testRes = ndpi_match_string_subprotocol(ndpi_str,
@@ -376,7 +375,7 @@ static void ndpiCheckIPMatch(char *testChar) {
376375
if(!testChar)
377376
return;
378377

379-
ndpi_str = ndpi_init_detection_module(init_prefs);
378+
ndpi_str = ndpi_init_detection_module();
380379
NDPI_BITMASK_SET_ALL(all);
381380
ndpi_set_protocol_detection_bitmask2(ndpi_str, &all);
382381

@@ -561,7 +560,6 @@ static void help(u_int long_help) {
561560
" | 2 - List known risks\n"
562561
" -d | Disable protocol guess and use only DPI\n"
563562
" -e <len> | Min human readeable string match len. Default %u\n"
564-
" -E | Track flow payload\n"
565563
" -q | Quiet mode\n"
566564
" -F | Enable flow stats\n"
567565
" -t | Dissect GTP/TZSP tunnels\n"
@@ -609,7 +607,7 @@ static void help(u_int long_help) {
609607
max_num_reported_top_payloads, max_num_tcp_dissected_pkts, max_num_udp_dissected_pkts);
610608

611609
NDPI_PROTOCOL_BITMASK all;
612-
struct ndpi_detection_module_struct *ndpi_info_mod = ndpi_init_detection_module(init_prefs);
610+
struct ndpi_detection_module_struct *ndpi_info_mod = ndpi_init_detection_module();
613611
NDPI_BITMASK_SET_ALL(all);
614612
ndpi_set_protocol_detection_bitmask2(ndpi_info_mod, &all);
615613
ndpi_finalize_initialization(ndpi_info_mod);
@@ -769,7 +767,7 @@ void extcap_config() {
769767
ndpi_proto_defaults_t *proto_defaults;
770768
#endif
771769

772-
struct ndpi_detection_module_struct *ndpi_info_mod = ndpi_init_detection_module(init_prefs);
770+
struct ndpi_detection_module_struct *ndpi_info_mod = ndpi_init_detection_module();
773771
#if 0
774772
ndpi_num_supported_protocols = ndpi_get_ndpi_num_supported_protocols(ndpi_info_mod);
775773
proto_defaults = ndpi_get_proto_defaults(ndpi_info_mod);
@@ -988,7 +986,7 @@ static void parseOptions(int argc, char **argv) {
988986
#endif
989987

990988
while((opt = getopt_long(argc, argv,
991-
"a:Ab:B:e:Ec:C:dDFf:g:G:i:Ij:k:K:S:hHp:pP:l:r:Rs:tu:v:V:n:rp:x:X:w:q0123:456:7:89:m:MT:U:",
989+
"a:Ab:B:e:c:C:dDFf:g:G:i:Ij:k:K:S:hHp:pP:l:r:Rs:tu:v:V:n:rp:x:X:w:q0123:456:7:89:m:MT:U:",
992990
longopts, &option_idx)) != EOF) {
993991
#ifdef DEBUG_TRACE
994992
if(trace) fprintf(trace, " #### Handling option -%c [%s] #### \n", opt, optarg ? optarg : "");
@@ -1020,10 +1018,6 @@ static void parseOptions(int argc, char **argv) {
10201018
human_readeable_string_len = atoi(optarg);
10211019
break;
10221020

1023-
case 'E':
1024-
init_prefs |= ndpi_track_flow_payload;
1025-
break;
1026-
10271021
case 'i':
10281022
case '3':
10291023
_pcap_file[0] = optarg;
@@ -1239,7 +1233,7 @@ static void parseOptions(int argc, char **argv) {
12391233

12401234
case '9':
12411235
{
1242-
struct ndpi_detection_module_struct *ndpi_info_mod = ndpi_init_detection_module(init_prefs);
1236+
struct ndpi_detection_module_struct *ndpi_info_mod = ndpi_init_detection_module();
12431237
extcap_packet_filter = ndpi_get_proto_by_name(ndpi_info_mod, optarg);
12441238
if(extcap_packet_filter == NDPI_PROTOCOL_UNKNOWN) extcap_packet_filter = atoi(optarg);
12451239
ndpi_exit_detection_module(ndpi_info_mod);
@@ -2773,6 +2767,8 @@ static void setupDetection(u_int16_t thread_id, pcap_t * pcap_handle) {
27732767
if(_protoFilePath != NULL)
27742768
ndpi_load_protocols_file(ndpi_thread_info[thread_id].workflow->ndpi_struct, _protoFilePath);
27752769

2770+
ndpi_set_config(ndpi_thread_info[thread_id].workflow->ndpi_struct, NULL, "tcp_ack_payload_heuristic.enable", "1");
2771+
27762772
for(i = 0; i < num_cfgs; i++) {
27772773
rc = ndpi_set_config(ndpi_thread_info[thread_id].workflow->ndpi_struct,
27782774
cfgs[i].proto, cfgs[i].param, cfgs[i].value);
@@ -4756,7 +4752,7 @@ static void dgaUnitTest() {
47564752
};
47574753
int debug = 0, i;
47584754
NDPI_PROTOCOL_BITMASK all;
4759-
struct ndpi_detection_module_struct *ndpi_str = ndpi_init_detection_module(init_prefs);
4755+
struct ndpi_detection_module_struct *ndpi_str = ndpi_init_detection_module();
47604756

47614757
assert(ndpi_str != NULL);
47624758

‎example/ndpiSimpleIntegration.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -188,8 +188,7 @@ static struct nDPI_workflow * init_workflow(char const * const file_or_device)
188188
printf("pcap_setfilter error: '%s'\n", pcap_geterr(workflow->pcap_handle));
189189
}
190190

191-
ndpi_init_prefs init_prefs = ndpi_no_prefs;
192-
workflow->ndpi_struct = ndpi_init_detection_module(init_prefs);
191+
workflow->ndpi_struct = ndpi_init_detection_module();
193192
if (workflow->ndpi_struct == NULL) {
194193
free_workflow(&workflow);
195194
return NULL;

‎example/reader_util.c‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,6 @@ extern u_int8_t max_num_udp_dissected_pkts /* 24 */, max_num_tcp_dissected_pkts
7979
static u_int32_t flow_id = 0;
8080

8181
u_int8_t enable_doh_dot_detection = 0;
82-
extern ndpi_init_prefs init_prefs;
8382

8483
extern int malloc_size_stats;
8584
extern struct ndpi_bin malloc_bins;
@@ -410,7 +409,7 @@ int parse_proto_name_list(char *str, NDPI_PROTOCOL_BITMASK *bitmask, int inverte
410409
else
411410
op = 0; /* Default action: remove from the bitmask */
412411
/* Use a temporary module with all protocols enabled */
413-
module = ndpi_init_detection_module(0);
412+
module = ndpi_init_detection_module();
414413
if(!module)
415414
return 1;
416415
NDPI_BITMASK_SET_ALL(all);
@@ -466,7 +465,7 @@ struct ndpi_workflow* ndpi_workflow_init(const struct ndpi_workflow_prefs * pref
466465
#endif
467466

468467
/* TODO: just needed here to init ndpi ndpi_malloc wrapper */
469-
module = ndpi_init_detection_module(init_prefs);
468+
module = ndpi_init_detection_module();
470469

471470
if(module == NULL) {
472471
LOG(NDPI_LOG_ERROR, "global structure initialization failed\n");

‎fuzz/fuzz_common_code.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,11 @@ void fuzz_set_alloc_callbacks_and_seed(int seed)
3636

3737
void fuzz_init_detection_module(struct ndpi_detection_module_struct **ndpi_info_mod)
3838
{
39-
ndpi_init_prefs prefs = ndpi_no_prefs;
4039
NDPI_PROTOCOL_BITMASK all;
4140
NDPI_PROTOCOL_BITMASK debug_bitmask;
4241

4342
if(*ndpi_info_mod == NULL) {
44-
*ndpi_info_mod = ndpi_init_detection_module(prefs);
43+
*ndpi_info_mod = ndpi_init_detection_module();
4544

4645
NDPI_BITMASK_SET_ALL(debug_bitmask);
4746
ndpi_set_log_level(*ndpi_info_mod, 4);

‎fuzz/fuzz_config.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
3939
/* To allow memory allocation failures */
4040
fuzz_set_alloc_callbacks_and_seed(size);
4141

42-
ndpi_info_mod = ndpi_init_detection_module(fuzzed_data.ConsumeIntegral<u_int32_t>());
42+
ndpi_info_mod = ndpi_init_detection_module();
4343

4444
set_ndpi_debug_function(ndpi_info_mod, NULL);
4545

‎fuzz/fuzz_filecfg_categories.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
1111
/* To allow memory allocation failures */
1212
fuzz_set_alloc_callbacks_and_seed(size);
1313

14-
ndpi_struct = ndpi_init_detection_module(ndpi_no_prefs);
14+
ndpi_struct = ndpi_init_detection_module();
1515
NDPI_BITMASK_SET_ALL(all);
1616
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
1717

‎fuzz/fuzz_filecfg_malicious_ja3.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
1111
/* To allow memory allocation failures */
1212
fuzz_set_alloc_callbacks_and_seed(size);
1313

14-
ndpi_struct = ndpi_init_detection_module(ndpi_no_prefs);
14+
ndpi_struct = ndpi_init_detection_module();
1515
NDPI_BITMASK_SET_ALL(all);
1616
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
1717

‎fuzz/fuzz_filecfg_malicious_sha1.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
1111
/* To allow memory allocation failures */
1212
fuzz_set_alloc_callbacks_and_seed(size);
1313

14-
ndpi_struct = ndpi_init_detection_module(ndpi_no_prefs);
14+
ndpi_struct = ndpi_init_detection_module();
1515
NDPI_BITMASK_SET_ALL(all);
1616
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
1717

‎fuzz/fuzz_filecfg_protocols.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
1111
/* To allow memory allocation failures */
1212
fuzz_set_alloc_callbacks_and_seed(size);
1313

14-
ndpi_struct = ndpi_init_detection_module(ndpi_no_prefs);
14+
ndpi_struct = ndpi_init_detection_module();
1515
NDPI_BITMASK_SET_ALL(all);
1616
ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
1717

0 commit comments

Comments
 (0)