diff options
author | Luca Deri <deri@ntop.org> | 2021-04-26 10:17:29 +0200 |
---|---|---|
committer | Luca Deri <deri@ntop.org> | 2021-04-26 10:17:29 +0200 |
commit | 4a09707e4868cecb62cd8b115ea5eaf1cfa4f835 (patch) | |
tree | d7f2242326c2cb678284428f19e9e79a6557ad79 /example | |
parent | a04efb7ce76b796ec73decc1ec18827b51b0cb32 (diff) |
Added flow risk to wireshark dissection
Diffstat (limited to 'example')
-rw-r--r-- | example/ndpiReader.c | 10 | ||||
-rw-r--r-- | example/reader_util.c | 24 | ||||
-rw-r--r-- | example/reader_util.h | 53 |
3 files changed, 53 insertions, 34 deletions
diff --git a/example/ndpiReader.c b/example/ndpiReader.c index 00d62ffef..3a88c0aab 100644 --- a/example/ndpiReader.c +++ b/example/ndpiReader.c @@ -172,10 +172,12 @@ struct receiver { struct receiver *receivers = NULL, *topReceivers = NULL; +#define WIRESHARK_NTOP_MAGIC 0x19680924 struct ndpi_packet_trailer { - u_int32_t magic; /* 0x19682017 */ + u_int32_t magic; /* WIRESHARK_NTOP_MAGIC */ u_int16_t master_protocol /* e.g. HTTP */, app_protocol /* e.g. FaceBook */; + ndpi_risk flow_risk; char name[16]; }; @@ -3217,6 +3219,7 @@ static void ndpi_process_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) { struct ndpi_proto p; + ndpi_risk flow_risk; u_int16_t thread_id = *((u_int16_t*)args); /* allocate an exact size buffer to check overflows */ @@ -3226,7 +3229,7 @@ static void ndpi_process_packet(u_char *args, return ; } memcpy(packet_checked, packet, header->caplen); - p = ndpi_workflow_process_packet(ndpi_thread_info[thread_id].workflow, header, packet_checked, csv_fp); + p = ndpi_workflow_process_packet(ndpi_thread_info[thread_id].workflow, header, packet_checked, &flow_risk, csv_fp); if(!pcap_start.tv_sec) pcap_start.tv_sec = header->ts.tv_sec, pcap_start.tv_usec = header->ts.tv_usec; pcap_end.tv_sec = header->ts.tv_sec, pcap_end.tv_usec = header->ts.tv_usec; @@ -3281,7 +3284,8 @@ static void ndpi_process_packet(u_char *args, trailer = (struct ndpi_packet_trailer*)&extcap_buf[h.caplen]; memcpy(extcap_buf, packet, h.caplen); memset(trailer, 0, sizeof(struct ndpi_packet_trailer)); - trailer->magic = htonl(0x19680924); + trailer->magic = htonl(WIRESHARK_NTOP_MAGIC); + trailer->flow_risk = htonl(flow_risk); trailer->master_protocol = htons(p.master_protocol), trailer->app_protocol = htons(p.app_protocol); ndpi_protocol2name(ndpi_thread_info[thread_id].workflow->ndpi_struct, p, trailer->name, sizeof(trailer->name)); crc = (uint32_t*)&extcap_buf[h.caplen+sizeof(struct ndpi_packet_trailer)]; diff --git a/example/reader_util.c b/example/reader_util.c index 0e6cd8e97..b95168e8d 100644 --- a/example/reader_util.c +++ b/example/reader_util.c @@ -1306,8 +1306,9 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, u_int16_t ipsize, u_int16_t rawsize, const struct pcap_pkthdr *header, const u_char *packet, - pkt_timeval when, - FILE * csv_fp) { + pkt_timeval when, + ndpi_risk *flow_risk, + FILE * csv_fp) { struct ndpi_id_struct *src, *dst; struct ndpi_flow_info *flow = NULL; struct ndpi_flow_struct *ndpi_flow = NULL; @@ -1539,6 +1540,18 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, } } +#if 0 + if(flow->risk != 0) { + FILE *r = fopen("/tmp/e", "a"); + + if(r) { + fprintf(r, "->>> %u [%08X]\n", flow->risk, flow->risk); + fclose(r); + } + } +#endif + + *flow_risk = flow->risk; return(flow->detected_protocol); } @@ -1567,6 +1580,7 @@ int ndpi_is_datalink_supported(int datalink_type) struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, const struct pcap_pkthdr *header, const u_char *packet, + ndpi_risk *flow_risk, FILE * csv_fp) { /* * Declare pointers to packet headers @@ -1615,6 +1629,8 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, /* counters */ u_int8_t vlan_packet = 0; + *flow_risk = 0 /* NDPI_NO_RISK */; + /* Increment raw packet counter */ workflow->stats.raw_packet_count++; @@ -1638,7 +1654,6 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, datalink_type = (int)pcap_datalink(workflow->pcap_handle); #endif - datalink_check: // 20 for min iph and 8 for min UDP if(header->caplen < eth_offset + 28) @@ -1730,7 +1745,6 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, if(header->caplen < (eth_offset + radio_len + sizeof(struct ndpi_wifi_header))) return(nproto); - /* Calculate 802.11 header length (variable) */ wifi = (struct ndpi_wifi_header*)( packet + eth_offset + radio_len); fc = wifi->fc; @@ -2030,7 +2044,7 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, return(packet_processing(workflow, time_ms, vlan_id, tunnel_type, iph, iph6, ip_offset, header->caplen - ip_offset, header->caplen, header, packet, header->ts, - csv_fp)); + flow_risk, csv_fp)); } /* ********************************************************** */ diff --git a/example/reader_util.h b/example/reader_util.h index 5ec8b558c..c54d68aa4 100644 --- a/example/reader_util.h +++ b/example/reader_util.h @@ -94,38 +94,38 @@ extern int dpdk_port_deinit(int port); // inner hash table (ja3 -> security state) typedef struct ndpi_ja3_info { - char * ja3; - ndpi_cipher_weakness unsafe_cipher; - UT_hash_handle hh; + char * ja3; + ndpi_cipher_weakness unsafe_cipher; + UT_hash_handle hh; } ndpi_ja3_info; // external hash table (host ip -> <ip string, hash table ja3c, hash table ja3s>) // used to aggregate ja3 fingerprints by hosts typedef struct ndpi_host_ja3_fingerprints { - u_int32_t ip; - char *ip_string; - char *dns_name; - ndpi_ja3_info *host_client_info_hasht; - ndpi_ja3_info *host_server_info_hasht; + u_int32_t ip; + char *ip_string; + char *dns_name; + ndpi_ja3_info *host_client_info_hasht; + ndpi_ja3_info *host_server_info_hasht; - UT_hash_handle hh; + UT_hash_handle hh; } ndpi_host_ja3_fingerprints; //inner hash table typedef struct ndpi_ip_dns{ - u_int32_t ip; - char *ip_string; - char *dns_name; //server name if any; - UT_hash_handle hh; + u_int32_t ip; + char *ip_string; + char *dns_name; //server name if any; + UT_hash_handle hh; } ndpi_ip_dns; //hash table ja3 -> <host, ip, security>, used to aggregate host by ja3 fingerprints typedef struct ndpi_ja3_fingerprints_host{ - char *ja3; //key - ndpi_cipher_weakness unsafe_cipher; - ndpi_ip_dns *ipToDNS_ht; - UT_hash_handle hh; + char *ja3; //key + ndpi_cipher_weakness unsafe_cipher; + ndpi_ip_dns *ipToDNS_ht; + UT_hash_handle hh; } ndpi_ja3_fingerprints_host; struct flow_metrics { @@ -294,14 +294,14 @@ typedef struct ndpi_workflow { void **ndpi_flows_root; struct ndpi_detection_module_struct *ndpi_struct; u_int32_t num_allocated_flows; - } ndpi_workflow_t; +} ndpi_workflow_t; /* TODO: remove wrappers parameters and use ndpi global, when their initialization will be fixed... */ struct ndpi_workflow * ndpi_workflow_init(const struct ndpi_workflow_prefs * prefs, pcap_t * pcap_handle); - /* workflow main free function */ +/* workflow main free function */ void ndpi_workflow_free(struct ndpi_workflow * workflow); @@ -316,7 +316,8 @@ void ndpi_free_flow_info_half(struct ndpi_flow_info *flow); struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, const struct pcap_pkthdr *header, const u_char *packet, - FILE * csv_fp); + ndpi_risk *flow_risk, + FILE * csv_fp); int ndpi_is_datalink_supported(int datalink_type); @@ -334,7 +335,7 @@ static inline void ndpi_workflow_set_flow_giveup_callback(struct ndpi_workflow * workflow->__flow_giveup_udata = udata; } - /* compare two nodes in workflow */ +/* compare two nodes in workflow */ int ndpi_workflow_node_cmp(const void *a, const void *b); void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_flow_info *flow, FILE * csv_fp); u_int32_t ethernet_crc32(const void* data, size_t n_bytes); @@ -346,13 +347,13 @@ float ndpi_flow_get_byte_count_entropy(const uint32_t byte_count[256], unsigned extern int nDPI_LogLevel; #ifdef NDPI_ENABLE_DEBUG_MESSAGES - #define LOG(log_level, args...) \ - { \ - if(log_level <= nDPI_LogLevel) \ - printf(args); \ +#define LOG(log_level, args...) \ + { \ + if(log_level <= nDPI_LogLevel) \ + printf(args); \ } #else - #define LOG(...) {} +#define LOG(...) {} #endif #endif |