Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ndpiReader: explicitly remove non ipv4/6 packets #2601

Merged
merged 1 commit into from
Oct 19, 2024
Merged

ndpiReader: explicitly remove non ipv4/6 packets #2601

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 23 additions & 2 deletions example/reader_util.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2202,6 +2202,7 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
u_int16_t ip_offset = 0, ip_len;
u_int16_t frag_off = 0, vlan_id = 0;
u_int8_t proto = 0, recheck_type;
u_int8_t ip_ver, ppp_type;
/*u_int32_t label;*/

/* counters */
Expand Down Expand Up @@ -2270,7 +2271,13 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
type = ntohs(chdlc->proto_code);
} else {
ip_offset = eth_offset + 2;
type = ntohs(*((u_int16_t*)&packet[eth_offset]));
ppp_type = ntohs(*((u_int16_t*)&packet[eth_offset]));
if(ppp_type == 0x0021)
type = ETH_P_IP;
else if(ppp_type == 0x0057)
type = ETH_P_IPV6;
else
return(nproto);
}
break;

Expand Down Expand Up @@ -2364,6 +2371,15 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,

case DLT_RAW:
ip_offset = eth_offset;
/* Heuristic: no explicit field with next protocol */
ip_ver = (packet[ip_offset] & 0xF0) >> 4;
if(ip_ver == 4)
type = ETH_P_IP;
else if(ip_ver == 6)
type = ETH_P_IPV6;
else
return(nproto);

break;

case DLT_PPI:
Expand Down Expand Up @@ -2430,8 +2446,13 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
recheck_type = 1;
break;

default:
case ETH_P_IP:
case ETH_P_IPV6:
/* Good let's keep decoding */
break;

default:
return(nproto);
}

if(recheck_type)
Expand Down
15 changes: 3 additions & 12 deletions tests/cfgs/default/result/ajp.pcap.out
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,13 +1,11 @@
DPI Packets (TCP): 8 (4.00 pkts/flow)
DPI Packets (other): 6 (3.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence DPI : 2 (flows)
Num dissector calls: 2 (0.50 diss/flow)
Num dissector calls: 2 (1.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/2/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache fpc_dns: 0/2/0 (insert/search/found)
Automa host: 0/0 (search/found)
Expand All @@ -22,16 +20,9 @@ Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 4/0 (search/found)
Patricia protocols IPv6: 0/0 (search/found)

Unknown 6 2200 2
AJP 26 4446 2

Acceptable 26 4446 2
Unrated 6 2200 2

1 TCP 172.29.9.146:38856 <-> 172.29.9.147:8009 [VLAN: 7][proto: 139/AJP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][7 pkts/1554 bytes <-> 6 pkts/669 bytes][Goodput ratio: 68/36][0.17 sec][bytes ratio: 0.398 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 222/112 896/300 286/84][TCP Fingerprint: 40962_64_14600_2e3cee914fc1/Unknown][PLAIN TEXT (HTTP/1.1)][Plen Bins: 50,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 172.29.9.146:38856 <-> 172.29.9.147:8010 [VLAN: 7][proto: 139/AJP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][7 pkts/1554 bytes <-> 6 pkts/669 bytes][Goodput ratio: 68/36][< 1 sec][bytes ratio: 0.398 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 222/112 896/300 286/84][TCP Fingerprint: 40962_64_14600_2e3cee914fc1/Unknown][PLAIN TEXT (HTTP/1.1)][Plen Bins: 50,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]


Undetected flows:
1 80 93.88.129.0:0 -> 0.7.8.0:0 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][4 pkts/2012 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][0.17 sec][PLAIN TEXT (HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 80 142.243.129.0:0 -> 0.7.8.0:0 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][2 pkts/188 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][0.17 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
Loading
Loading