Skip to content

Commit df7a18e

Browse files
IvanNardiIvanNardi
authored
Fix classification when non tcp/udp protocols are disabled (#2824)
1 parent 38be525 commit df7a18e

10 files changed

Lines changed: 136 additions & 15 deletions

File tree

‎src/lib/ndpi_main.c‎

Lines changed: 38 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4584,32 +4584,58 @@ static u_int16_t guess_protocol_id(struct ndpi_detection_module_struct *ndpi_str
45844584
} else {
45854585
/* No TCP/UDP */
45864586

4587+
/* All these calls to `is_proto_enabled()` are needed to avoid classification by-port
4588+
if the protocol is disabled */
45874589
switch(proto) {
45884590
case NDPI_IPSEC_PROTOCOL_ESP:
45894591
case NDPI_IPSEC_PROTOCOL_AH:
4590-
return(NDPI_PROTOCOL_IPSEC);
4592+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IPSEC))
4593+
return(NDPI_PROTOCOL_IPSEC);
4594+
break;
45914595
case NDPI_GRE_PROTOCOL_TYPE:
4592-
return(NDPI_PROTOCOL_IP_GRE);
4596+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IPSEC))
4597+
return(NDPI_PROTOCOL_IP_GRE);
4598+
break;
45934599
case NDPI_PGM_PROTOCOL_TYPE:
4594-
return(NDPI_PROTOCOL_IP_PGM);
4600+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_PGM))
4601+
return(NDPI_PROTOCOL_IP_PGM);
4602+
break;
45954603
case NDPI_PIM_PROTOCOL_TYPE:
4596-
return(NDPI_PROTOCOL_IP_PIM);
4604+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_PIM))
4605+
return(NDPI_PROTOCOL_IP_PIM);
4606+
break;
45974607
case NDPI_ICMP_PROTOCOL_TYPE:
4598-
return(NDPI_PROTOCOL_IP_ICMP);
4608+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_ICMP))
4609+
return(NDPI_PROTOCOL_IP_ICMP);
4610+
break;
45994611
case NDPI_IGMP_PROTOCOL_TYPE:
4600-
return(NDPI_PROTOCOL_IP_IGMP);
4612+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_IGMP))
4613+
return(NDPI_PROTOCOL_IP_IGMP);
4614+
break;
46014615
case NDPI_EGP_PROTOCOL_TYPE:
4602-
return(NDPI_PROTOCOL_IP_EGP);
4616+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_EGP))
4617+
return(NDPI_PROTOCOL_IP_EGP);
4618+
break;
46034619
case NDPI_SCTP_PROTOCOL_TYPE:
4604-
return(NDPI_PROTOCOL_IP_SCTP);
4620+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_SCTP))
4621+
return(NDPI_PROTOCOL_IP_SCTP);
4622+
break;
46054623
case NDPI_OSPF_PROTOCOL_TYPE:
4606-
return(NDPI_PROTOCOL_IP_OSPF);
4624+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_OSPF))
4625+
return(NDPI_PROTOCOL_IP_OSPF);
4626+
break;
46074627
case NDPI_IPIP_PROTOCOL_TYPE:
4608-
return(NDPI_PROTOCOL_IP_IP_IN_IP);
4628+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_IP_IN_IP))
4629+
return(NDPI_PROTOCOL_IP_IP_IN_IP);
4630+
break;
46094631
case NDPI_ICMPV6_PROTOCOL_TYPE:
4610-
return(NDPI_PROTOCOL_IP_ICMPV6);
4632+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_ICMPV6))
4633+
return(NDPI_PROTOCOL_IP_ICMPV6);
4634+
break;
46114635
case NDPI_VRRP_PROTOCOL_TYPE:
4612-
return(NDPI_PROTOCOL_IP_VRRP);
4636+
if(is_proto_enabled(ndpi_str, NDPI_PROTOCOL_IP_VRRP))
4637+
return(NDPI_PROTOCOL_IP_VRRP);
4638+
break;
46134639
}
46144640
}
46154641

‎tests/cfgs/disable_protocols/config.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
-B soap,dns,pluralsight,quic
1+
-B soap,dns,pluralsight,quic,ipsec,ospf

‎tests/cfgs/disable_protocols/pcap/esp.pcapng‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../default/pcap/esp.pcapng

‎tests/cfgs/disable_protocols/pcap/ospfv2_add_new_prefix.pcap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../default/pcap/ospfv2_add_new_prefix.pcap

‎tests/cfgs/disable_protocols/pcap/sctp.cap‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
../../default/pcap/sctp.cap

‎tests/cfgs/disable_protocols/result/dns_long_domainname.pcap.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (UDP): 2 (2.00 pkts/flow)
44
Confidence Match by IP : 1 (flows)
5-
Num dissector calls: 155 (155.00 diss/flow)
5+
Num dissector calls: 154 (154.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/disable_protocols/result/esp.pcapng.out‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
DPI Packets (UDP): 4 (4.00 pkts/flow)
2+
DPI Packets (other): 1 (1.00 pkts/flow)
3+
Confidence Unknown : 2 (flows)
4+
Num dissector calls: 168 (84.00 diss/flow)
5+
LRU cache ookla: 0/0/0 (insert/search/found)
6+
LRU cache bittorrent: 0/6/0 (insert/search/found)
7+
LRU cache stun: 0/0/0 (insert/search/found)
8+
LRU cache tls_cert: 0/0/0 (insert/search/found)
9+
LRU cache mining: 0/2/0 (insert/search/found)
10+
LRU cache msteams: 0/0/0 (insert/search/found)
11+
LRU cache fpc_dns: 0/2/0 (insert/search/found)
12+
Automa host: 0/0 (search/found)
13+
Automa domain: 0/0 (search/found)
14+
Automa tls cert: 0/0 (search/found)
15+
Automa risk mask: 0/0 (search/found)
16+
Automa common alpns: 0/0 (search/found)
17+
Patricia risk mask: 0/0 (search/found)
18+
Patricia risk mask IPv6: 0/0 (search/found)
19+
Patricia risk: 0/0 (search/found)
20+
Patricia risk IPv6: 0/0 (search/found)
21+
Patricia protocols: 4/0 (search/found)
22+
Patricia protocols IPv6: 0/0 (search/found)
23+
24+
Unknown 6 1856 2
25+
26+
Unrated 6 1856 2
27+
28+
29+
30+
Undetected flows:
31+
1 UDP 10.2.3.2:500 <-> 10.3.4.4:500 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][2 pkts/786 bytes <-> 2 pkts/738 bytes][Goodput ratio: 89/88][0.02 sec][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: Entropy: 6.387 (Executable?)][PLAIN TEXT (DELETE)][Plen Bins: 0,0,0,0,0,0,0,0,0,25,25,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
32+
2 ESP 10.2.3.2:0 <-> 10.3.4.4:0 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/166 bytes <-> 1 pkts/166 bytes][Goodput ratio: 0/0][0.00 sec][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: No server to client traffic / Entropy: 6.639 (Executable?)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/disable_protocols/result/ospfv2_add_new_prefix.pcap.out‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
DPI Packets (other): 1 (1.00 pkts/flow)
2+
Confidence Unknown : 1 (flows)
3+
Num dissector calls: 0 (0.00 diss/flow)
4+
LRU cache ookla: 0/0/0 (insert/search/found)
5+
LRU cache bittorrent: 0/3/0 (insert/search/found)
6+
LRU cache stun: 0/0/0 (insert/search/found)
7+
LRU cache tls_cert: 0/0/0 (insert/search/found)
8+
LRU cache mining: 0/1/0 (insert/search/found)
9+
LRU cache msteams: 0/0/0 (insert/search/found)
10+
LRU cache fpc_dns: 0/1/0 (insert/search/found)
11+
Automa host: 0/0 (search/found)
12+
Automa domain: 0/0 (search/found)
13+
Automa tls cert: 0/0 (search/found)
14+
Automa risk mask: 0/0 (search/found)
15+
Automa common alpns: 0/0 (search/found)
16+
Patricia risk mask: 0/0 (search/found)
17+
Patricia risk mask IPv6: 0/0 (search/found)
18+
Patricia risk: 0/0 (search/found)
19+
Patricia risk IPv6: 0/0 (search/found)
20+
Patricia protocols: 2/0 (search/found)
21+
Patricia protocols IPv6: 0/0 (search/found)
22+
23+
Unknown 2 200 1
24+
25+
Unrated 2 200 1
26+
27+
28+
29+
Undetected flows:
30+
1 OSPF 10.1.10.10:0 <-> 10.1.10.1:0 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][1 pkts/122 bytes <-> 1 pkts/78 bytes][Goodput ratio: 0/0][2.51 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

‎tests/cfgs/disable_protocols/result/quic-mvfst-27.pcapng.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ Guessed flow protos: 1
22

33
DPI Packets (UDP): 7 (7.00 pkts/flow)
44
Confidence Match by IP : 1 (flows)
5-
Num dissector calls: 176 (176.00 diss/flow)
5+
Num dissector calls: 175 (175.00 diss/flow)
66
LRU cache ookla: 0/0/0 (insert/search/found)
77
LRU cache bittorrent: 0/3/0 (insert/search/found)
88
LRU cache stun: 0/0/0 (insert/search/found)

‎tests/cfgs/disable_protocols/result/sctp.cap.out‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
Guessed flow protos: 2
2+
3+
DPI Packets (other): 2 (1.00 pkts/flow)
4+
Confidence Match by port : 2 (flows)
5+
Num dissector calls: 0 (0.00 diss/flow)
6+
LRU cache ookla: 0/0/0 (insert/search/found)
7+
LRU cache bittorrent: 0/6/0 (insert/search/found)
8+
LRU cache stun: 0/0/0 (insert/search/found)
9+
LRU cache tls_cert: 0/0/0 (insert/search/found)
10+
LRU cache mining: 0/2/0 (insert/search/found)
11+
LRU cache msteams: 0/0/0 (insert/search/found)
12+
LRU cache fpc_dns: 0/2/0 (insert/search/found)
13+
Automa host: 0/0 (search/found)
14+
Automa domain: 0/0 (search/found)
15+
Automa tls cert: 0/0 (search/found)
16+
Automa risk mask: 0/0 (search/found)
17+
Automa common alpns: 0/0 (search/found)
18+
Patricia risk mask: 2/0 (search/found)
19+
Patricia risk mask IPv6: 0/0 (search/found)
20+
Patricia risk: 0/0 (search/found)
21+
Patricia risk IPv6: 0/0 (search/found)
22+
Patricia protocols: 4/0 (search/found)
23+
Patricia protocols IPv6: 0/0 (search/found)
24+
25+
SCTP 4 340 2
26+
27+
Acceptable 4 340 2
28+
29+
1 SCTP 10.28.6.43:0 <-> 10.28.6.44:0 [proto: 84/SCTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Network/14][1 pkts/138 bytes <-> 1 pkts/62 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Susp Entropy **][Risk Score: 10][Risk Info: No server to client traffic / Entropy: 5.478 (Executable?)][PLAIN TEXT (MEGACO/2 )][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
30+
2 SCTP 10.28.6.42:0 <-> 10.28.6.44:0 [proto: 84/SCTP][IP: 0/Unknown][ClearText][Confidence: Match by port][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 1][cat: Network/14][1 pkts/70 bytes <-> 1 pkts/70 bytes][Goodput ratio: 0/0][< 1 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]

0 commit comments

Comments
 (0)