aboutsummaryrefslogtreecommitdiff
path: root/example/ndpi_util.c
diff options
context:
space:
mode:
Diffstat (limited to 'example/ndpi_util.c')
-rw-r--r--example/ndpi_util.c121
1 files changed, 109 insertions, 12 deletions
diff --git a/example/ndpi_util.c b/example/ndpi_util.c
index d57e9e90e..d0a8470dc 100644
--- a/example/ndpi_util.c
+++ b/example/ndpi_util.c
@@ -105,6 +105,61 @@ static void free_wrapper(void *freeable) {
/* ***************************************************** */
+static uint16_t ndpi_get_proto_id(struct ndpi_detection_module_struct *ndpi_mod, const char *name) {
+ uint16_t proto_id;
+ char *e;
+ unsigned long p = strtol(name,&e,0);
+ if(e && !*e) {
+ if(p < NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS &&
+ ndpi_mod->proto_defaults[p].protoName) return (uint16_t)p;
+ return NDPI_PROTOCOL_UNKNOWN;
+ }
+ for(proto_id=NDPI_PROTOCOL_UNKNOWN; proto_id < NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS; proto_id++) {
+ if(ndpi_mod->proto_defaults[proto_id].protoName &&
+ !strcasecmp(ndpi_mod->proto_defaults[proto_id].protoName,name))
+ return proto_id;
+ }
+ return NDPI_PROTOCOL_UNKNOWN;
+}
+static NDPI_PROTOCOL_BITMASK debug_bitmask;
+static char _proto_delim[] = " \t,:;";
+static int parse_debug_proto(struct ndpi_detection_module_struct *ndpi_mod, char *str) {
+char *n;
+uint16_t proto;
+char op=1;
+for(n = strtok(str,_proto_delim); n && *n; n = strtok(NULL,_proto_delim)) {
+ if(*n == '-') {
+ op = 0;
+ n++;
+ } else if(*n == '+') {
+ op = 1;
+ n++;
+ }
+ if(!strcmp(n,"all")) {
+ if(op)
+ NDPI_BITMASK_SET_ALL(debug_bitmask);
+ else
+ NDPI_BITMASK_RESET(debug_bitmask);
+ continue;
+ }
+ proto = ndpi_get_proto_id(ndpi_mod, n);
+ if(proto == NDPI_PROTOCOL_UNKNOWN && strcmp(n,"unknown") && strcmp(n,"0")) {
+ fprintf(stderr,"Invalid protocol %s\n",n);
+ return 1;
+ }
+ if(op)
+ NDPI_BITMASK_ADD(debug_bitmask,proto);
+ else
+ NDPI_BITMASK_DEL(debug_bitmask,proto);
+}
+return 0;
+}
+
+/* ***************************************************** */
+
+extern char *_debug_protocols;
+static int _debug_protocols_ok = 0;
+
struct ndpi_workflow * ndpi_workflow_init(const struct ndpi_workflow_prefs * prefs, pcap_t * pcap_handle) {
set_ndpi_malloc(malloc_wrapper), set_ndpi_free(free_wrapper);
set_ndpi_flow_malloc(NULL), set_ndpi_flow_free(NULL);
@@ -121,7 +176,18 @@ struct ndpi_workflow * ndpi_workflow_init(const struct ndpi_workflow_prefs * pre
NDPI_LOG(0, NULL, NDPI_LOG_ERROR, "global structure initialization failed\n");
exit(-1);
}
+ module->ndpi_log_level = nDPI_LogLevel;
+ if(_debug_protocols != NULL && ! _debug_protocols_ok) {
+ if(parse_debug_proto(module,_debug_protocols))
+ exit(-1);
+ _debug_protocols_ok = 1;
+ }
+#ifdef NDPI_ENABLE_DEBUG_MESSAGES
+ NDPI_BITMASK_RESET(module->debug_bitmask);
+ if(_debug_protocols_ok)
+ module->debug_bitmask = debug_bitmask;
+#endif
workflow->ndpi_flows_root = ndpi_calloc(workflow->prefs.num_roots, sizeof(void *));
return workflow;
}
@@ -296,6 +362,26 @@ static struct ndpi_flow_info *get_ndpi_flow_info(struct ndpi_workflow * workflow
idx = hashval % workflow->prefs.num_roots;
ret = ndpi_tfind(&flow, &workflow->ndpi_flows_root[idx], ndpi_workflow_node_cmp);
+
+ /* to avoid two nodes in one binary tree for a flow */
+ int is_changed = 0;
+ if(ret == NULL)
+ {
+ u_int32_t orig_src_ip = flow.src_ip;
+ u_int16_t orig_src_port = flow.src_port;
+ u_int32_t orig_dst_ip = flow.dst_ip;
+ u_int16_t orig_dst_port = flow.dst_port;
+
+ flow.src_ip = orig_dst_ip;
+ flow.src_port = orig_dst_port;
+ flow.dst_ip = orig_src_ip;
+ flow.dst_port = orig_src_port;
+
+ is_changed = 1;
+
+ ret = ndpi_tfind(&flow, &workflow->ndpi_flows_root[idx], ndpi_workflow_node_cmp);
+ }
+
if(ret == NULL) {
if(workflow->stats.ndpi_flow_count == workflow->prefs.max_ndpi_flows) {
NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_ERROR,
@@ -359,15 +445,26 @@ static struct ndpi_flow_info *get_ndpi_flow_info(struct ndpi_workflow * workflow
} else {
struct ndpi_flow_info *flow = *(struct ndpi_flow_info**)ret;
- if(flow->src_ip == iph->saddr
- && flow->dst_ip == iph->daddr
- && flow->src_port == htons(*sport)
- && flow->dst_port == htons(*dport)
- )
- *src = flow->src_id, *dst = flow->dst_id, *src_to_dst_direction = 1;
- else
- *src = flow->dst_id, *dst = flow->src_id, *src_to_dst_direction = 0, flow->bidirectional = 1;
-
+ if (is_changed) {
+ if(flow->src_ip == iph->saddr
+ && flow->dst_ip == iph->daddr
+ && flow->src_port == htons(*sport)
+ && flow->dst_port == htons(*dport)
+ )
+ *src = flow->dst_id, *dst = flow->src_id, *src_to_dst_direction = 0, flow->bidirectional = 1;
+ else
+ *src = flow->src_id, *dst = flow->dst_id, *src_to_dst_direction = 1;
+ }
+ else {
+ if(flow->src_ip == iph->saddr
+ && flow->dst_ip == iph->daddr
+ && flow->src_port == htons(*sport)
+ && flow->dst_port == htons(*dport)
+ )
+ *src = flow->src_id, *dst = flow->dst_id, *src_to_dst_direction = 1;
+ else
+ *src = flow->dst_id, *dst = flow->src_id, *src_to_dst_direction = 0, flow->bidirectional = 1;
+ }
return flow;
}
}
@@ -393,7 +490,7 @@ static struct ndpi_flow_info *get_ndpi_flow_info6(struct ndpi_workflow * workflo
iph.version = IPVERSION;
iph.saddr = iph6->ip6_src.u6_addr.u6_addr32[2] + iph6->ip6_src.u6_addr.u6_addr32[3];
iph.daddr = iph6->ip6_dst.u6_addr.u6_addr32[2] + iph6->ip6_dst.u6_addr.u6_addr32[3];
- iph.protocol = iph6->ip6_ctlun.ip6_un1.ip6_un1_nxt;
+ iph.protocol = iph6->ip6_hdr.ip6_un1_nxt;
if(iph.protocol == IPPROTO_DSTOPTS /* IPv6 destination option */) {
u_int8_t *options = (u_int8_t*)iph6 + sizeof(const struct ndpi_ipv6hdr);
@@ -403,7 +500,7 @@ static struct ndpi_flow_info *get_ndpi_flow_info6(struct ndpi_workflow * workflo
return(get_ndpi_flow_info(workflow, 6, vlan_id, &iph, iph6, ip_offset,
sizeof(struct ndpi_ipv6hdr),
- ntohs(iph6->ip6_ctlun.ip6_un1.ip6_un1_plen),
+ ntohs(iph6->ip6_hdr.ip6_un1_plen),
tcph, udph, sport, dport,
src, dst, proto, payload, payload_len, src_to_dst_direction));
}
@@ -815,7 +912,7 @@ struct ndpi_proto ndpi_workflow_process_packet (struct ndpi_workflow * workflow,
}
} else if(iph->version == 6) {
iph6 = (struct ndpi_ipv6hdr *)&packet[ip_offset];
- proto = iph6->ip6_ctlun.ip6_un1.ip6_un1_nxt;
+ proto = iph6->ip6_hdr.ip6_un1_nxt;
ip_len = sizeof(struct ndpi_ipv6hdr);
if(proto == IPPROTO_DSTOPTS /* IPv6 destination option */) {
Powered by cgit, Themed by Ted Yin.